 most serious problems concerning web vulnerability are email address and network database leakages. These leakages have many causes. For example, malicious users can steal database contents, taking advantage of mistakes made by programmers and administrators (11). The security of electronic health records (EHR) is critical (12). The important role of electronic health records should influence the development of essential infrastructures for safety and privacy preservation. The technology used must be accepted by users, inexpensive and simple enough while less vulnerable to changes and data breaches. Increasing healthcare cost due to trends such as demographic and epidemiologic transition and uncontrolled increase in using new technologies in health care is one of the most important threats that the health system will be facing (13). Our empirical study shows that the confidentiality of electronic health records (EHR) is breached at an unprecedented level. As much as half of the US population may have electronic health records compromised and it calls for a social action.

Methods
The methods used in this study were simple statistics driven by the discovery of data collected by the Office for Civil Rights, Department of Health and Human Services (HHS). Discovery is regarded as the act of detecting something previously unrecognized as meaningful. In our case, it was the extent of health data breaches in USA gathered from October 2009 till June 2017 by HHS. Access to the analyzed data is public on the website. We also use data taken from the Internet Live Stats (www.internetlivestats.com/), which is a part of the Real Time Statistics Project. The data were stored in one Excel worksheet which was subsequently analyzed by basic statistics of R (a statistical open source system). In addition, two statistical systems: Statistica and Origin were used to extract data, produce presented tables, histograms, and visualizations. Data analysis was conducted by a three-step approach. In the first step, we extracted data only related to health record breaches. The next step was to divide the extracted health data breaches into two main categories: the number of individuals affected (NIA) and the number of breaches (NB).
Step three is referred to as the detailed analysis of NIA and NB. Functions included in the R package divided the extracted data into: (i) five main categories of breaches location: Business Associate (BA); Health Plan (HP); Healthcare Clearing House (HCH); Healthcare Provider (HPr), and Uncategorised (UN); (ii) seven categories related to the type of breach: Hacking/IT Incident (A); Improper Disposal (B); Loss (C); Other (D); Theft (E); Unauthorized Access/Disclosure (F); Unknown (G). This extraction was possible thanks to the preliminary data categorization available from original data sources. It was done in order to highlight only those cases, which were important for the analyzed topic. Histograms (related to NIA and NB) were produced and presented as bar charts for categories obtained in step 2.

The general data breaches situation
Let us see how the general (not necessary health care situation) looks like. The disastrous data breaches are nicely visualized in (14). Unfortunately, they rely on public media as the source hence not acceptable for research. The portal presents infographics from well-known sources such as Routers, Consumer News and Business Channel (CNBC), National Broadcasting Company (NBC), New York Times (NYTimes), Cable News Network (CNN), Guardian, and many industry portals PC World, Computer Weekly, etc. The portal's mission is to distill the world's data, information and knowledge into impressive and useful graphics and diagrams. They base all graphics and visualisations on facts and data. The top 10 lost records are shown in Table 1. Table 2 and Fig. 1 show the top 10 data of healthcare records stolen.
Our privacy is at stake. We have the right to privacy and high expectations that our medical records are protected, but are they really? Our findings have stunned us to the extent that we needed to assess whether or not they could be regarded as credible. However, the reliability of the data source (number of security of data breaches recorded by the US government agency) and its availability (posted for everyone to access and verify our finding) as well as the importance of data (https://ocrportal.hhs.gov/ocr/breach/breach_r eport.jsf) have convinced us that publishing our findings is in the public interest. The legal term: the number of individuals affected (NIA) is carefully chosen by the governmental agency and it does not reflect a simple fact that it may be you or someone close to you. For sure, it is a human being. His/her life may be ruined or even shortened if he/she has an illness or condition which may not be wise for him/her to disclose.   (over 91 million). In time series analysis of truncated HHS data we observe a slow upward trend of number of breaches (NB). Table 3 illustrates the total NIA and total NB in years (only 3 months in 2009 and 2017). The development of the market for stolen data and related hacking skills indicate that the business of perpetrators in the health care sector is growing. Actions of perpetrators are becoming more and more aggressive and it is not uncommon for them to even use online ads and social media for recruiting health care insiders having access to valuable data. Upon stealing a cache of medical records, it is likely perpetrators have to analyze the data, and perhaps cross-reference it with data from other sources before lucrative fraud, theft, extortion, or blackmail opportunities can be identified (15). Financial data, therefore, still present a faster, more attractive return-oninvestment opportunity for perpetrators. An important issue to resolve is the effect of Internet security breach announcements on market value. Any information that leaks into the network poses a major threat to the capital markets, companies and may be a source of speculation on the stock markets.

Security breach data regulations of the Office for Civil Rights, Department of Health and Human Services (HHS) in USA
The security breach data has been collected by the Office for Civil Rights, HHS in the USA. • Health care provider that transmits any health information electronically in connection with a covered transaction, such as submitting health care claims to a health plan. There are 12 top breaches with NIA for entities with "healthcare" in their name higher than 1,000,000 (Table 4). A business associate, defined by the HIPAA Rules, is a person or service performing functions or activities on behalf of a covered entity. It involves the use or disclosure of individually identifiable health information. Business associates include third party administrators or pharmacy benefit managers involved in health plans, claims processing. Business associated may work in billing companies, transcription companies. They may also provide legal, actuarial, accounting, management, or administrative services for covered entities and who require access to protected health data.

According to (16):
The HIPAA Rules define "protected health information" as the individually identifiable health information held or transmitted in any form or medium by these HIPAA covered entities and business associates, subject to certain limited exceptions. The HITECH Act requires HIPAA covered entities to provide notification to affected individuals and to the Secretary of HHS following the discovery of an unsecured protected health information breach. The unsecured protected health information is the official Act term. In addition, in some cases, the Act requires covered entities to provide notification about breaches to the media. In case of a breach of unsecured protected health information at or by a business associate of a covered entity, the Act requires the business associate to notify the covered entity of the breach. Finally, the Act requires the Secretary to post on an HHS Web site a list of covered entities that experience breaches of unsecured protected health information involving more than 500 individuals. Section number 13400 (1) of the HITECH Act defines "breach" to mean, generally, the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information. The Act provides exceptions to this definition to encompass disclosures where the recipient of the information would not reasonably have been able to retain the information, certain unintentional acquisition, access, or use of information by employees or persons acting under the authority of a covered entity or business associate, as well as certain inadvertent disclosures among persons similarly authorized to access protected health information at a business associate or covered entity.
Further, section number 13402(h) of the HITECH Act defines "unsecured protected health information" as "protected health information that is not secured through the use of a technology or methodology specified by the Secretary in guidance" and provides that the guidance specify the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. Covered entities and business associates that implement the specified technologies and methodologies with respect to protected health information are not required to provide notifications in the event of a breach of such information -that is, the information is not considered "unsecured" in such cases.
Section number 13407 (f) (3) of the HITECH Act stipulates that "unsecured personal health records" (UPHR) are "identifiable health information" that is not protected through the use of a technology or methodology specified by the Secretary of HHS. Section 13402 of the Act requires breach notification following the discovery of a breach of unsecured protected health information.

Health data security problems, collected data, and methodology
Internet Live Stats (www.internetlivestats.com/) is a part of the Real Time Statistics Project (Worldometers and 7 Billion World). The following global data website Worldometers has been voted as the best on-line reference website by the American Library Association (ALA). Their statistics are referenced in over 400 published books and more than 150 professional journal articles. It allows us to watch the Internet statistics as they change in real