Somewhere in the past, an article put the value of a health record at $50. I’m really not sure who or what wrote the original article or set the price at $50, but that value has been perpetuated in article after article on the internet. Yes, that’s one of the features of the internet. It perpetuates misinformation (kind of like an EMR).
When people make the claim that a compromised health record is worth $50, they usually then say that it’s more valuable than a credit card which is only worth $5 (probably something else that’s debatable). When I hear this, I’ve always wondered how they got the $50 price tag. The reality is that the value of a health record is only what someone is willing to pay. You can say something has a certain value, but without a market to validate that people will consistently pay that price, then does it really have that value?
I’ve always wanted to dig into the black market of health records to try and validate the $50 price tag that everyone likes to claim for health records. However, there are some obvious reasons why I don’t want to dig around in the black market of health records. So, I’ve avoided touching that story.
The good news is that HIStalk discovered a great story by Krebs on Security that puts a value on the health record. Here’s an excerpt from the story:
How much are your medical records worth in the cybercrime underground? This week, KrebsOnSecurity discovered medical records being sold in bulk for as little as $6.40 apiece. The digital documents, several of which were obtained by sources working with this publication, were apparently stolen from a Texas-based life insurance company that now says it is working with federal authorities on an investigation into a possible data breach.
When you read the rest of the article, it’s amazing the sophisticated methods they’re using to sale, pay for and distribute these records. Reminds me of how many incredible things society could create if these smart people turned their efforts to good instead of bad, but I digress.
I love the last line of the article, “Incidentally, even at $8 per record, that’s cheaper than the price most stolen credit cards fetch on the underground markets.”
Like most markets, prices fluctuate based on supply and demand. So, I’m sure we could find various prices for health records. However, I hope we can do away with the blanket statement that health records are worth $50 and worth more than credit cards. Articles like this illustrate why I’m not sure that’s the case.
Thank you for the info! I, too had heard the $50 story. And like you, I’ve always wondered ” how many incredible things society could create if these smart people turned their efforts to good instead of bad.”
The reason credit card numbers have more value is like anything else, it already exists and can be used immediately.
Med records generally contain all the details needed for an ID thief to do their thing, but…that requires work (getting credit card, etc).
In the long run, the ROI of buying a med record vs a credit card is much greater, but you need to have the skills and desire to put in the work to steal said identity.
Don’t forget, most thieves are lazy.
[…] How much is your health record really worth? It has been published that your health records are worth $50. Do you agree? John states that “the reality is that the value of a health record is only what someone is willing to pay for it.” Join John Lynn in his discussion about the black market value for health records here. […]
[…] medical data is now worth 10 times more than your credit card number on the black market (even if John has argued otherwise). Why? Well, among other things, because medical identity theft isn’t tracked well by […]