Abstract

Personal health data is a coveted resource for a variety of interested parties. One of these is agents operating in illegal markets, comparable to the black markets on which stolen credit card data and other unlawfully obtained information are sold. Since the safety of personal health data is not only dependent on the quality of safety measures adopted by health care entities but also on the motivation and resources of potential attackers, the question of the value of personal health data on the black market is a highly critical one and not an easy one to answer. Illegal actors can extract profits from patient data in a variety of ways, the best documented of which are direct sale and extortion of ransom. Prices attained in these transactions can help to estimate the financial value of patient data on the black market in the US – where instances of health care data breaches have been most frequent and well documented – and in Germany.