The number of data breaches has declined slightly over the past year. But the state of patient privacy and data protection is not good, according to the Fourth Annual Benchmark Study on Patient Privacy and Data Security.

Data breaches cost healthcare organizations an average of $2 million over a two-year period, according to the survey, conducted by the Ponemon Institute and sponsored by ID Experts. This is down from $2.4 million a year ago. While employee negligence is responsible for the largest number of breach incidents, the number of breaches caused by malicious attacks has increased 100 percent over the past four years.

Malicious attacks have increased in frequency because of the value of healthcare data, according to Rick Kam, president and co-founder of ID Experts, a software and service firm that assists organizations with the disclosure of breaches. Social security numbers used to carry the highest street value, he said. But now an insurance identification number is worth about $50 on the black market. Social security numbers can fetch about $1.

Healthcare identities are like "an unlimited credit card," Kam said. They can be used to gain services and goods, such as prescriptions and healthcare supplies, that can be monetized by the thieves.

Also piquing the hackers' interest in healthcare organizations is the relative ease they have penetrating the electronic systems used to store and transfer the data, said Larry Ponemon, chairman and founder of Ponemon Institute, a research firm dedicated to data privacy and security. Healthcare organizations are considered to be an easy target compared with other industries.

Healthcare organizations often don't take data security seriously until they have experienced a breach. But, the survey found, it takes some organizations several times before they understand their vulnerabilities — 38 percent reported having five or more breaches over the past two years.

Breach prevention hasn't been a priority for many, Ponemon said. Also, the incidents "have not been painful enough for many of these organizations to start cracking down and stepping up to the plate and ensuring greater levels of security," he added.

Another weakness is business associates (BAs), according to the survey. Despite the HIPAA Omnibus rule, which spread the liability of breaches equally to business associates, a staggering 73 percent of survey respondents said they were not confident or only slightly confident in their business associates' ability to detect a security breach.

The BAs that survey respondents thought posed the greatest risk are IT service providers, claims processors and benefits managers. Ponemon said the lack of confidence in BAs, in many cases, is warranted. They are considered to be much less capable than healthcare providers to protect patient data.

"And healthcare providers aren't necessarily doing a stellar job," he said.

Kam said while progress toward HIPAA compliance has been made, advancements to technology and business processes that create new risks and vulnerabilities are causing organizations to be in a perpetual state of playing catch-up. They are always one step behind, he said.

"Instead of looking forward as to what current and new threats are emerging, they are essentially trying to patch the holes of a leaky bucket, if you will, as new challenges emerge," Kam said.

While it remains to be seen how implementation of the Affordable Care Act will impact patient privacy, 70 percent of those surveyed believe it has increased or significantly increased the risk to patients. Their concerns include the exchange of information between providers and the government, or between providers and insecure databases or insecure websites.

Every organization is exposed, Ponemon said, but he hasn't heard of any exchange-related breaches.

"When it's perception versus reality," he said, "perception is often a very important issue because people act on their concerns."