Breaching The Security Of An Internet Patient Portal Essay

Kaiser Permanente is a large nonprofit integrated healthcare plan. This organization serves a tremendous amount of patients all over the United States with more than 38 hospitals and more than 600 medical offices. They offer medical care from chronic care visits to deliveries and prescription refills ("Who We Are - Kaiser Permanente," n.d.) Kaiser Permanente conducts campaigns to spread their care knowledge to others. They perform sick care, prevention care, and treatment for those who need it.

In August 2000, Kaiser Permanente Online experienced a serious security breach, due to a flawed script written in the pharmacy refill application. The security breach concatenated several hundred individual e-mails containing personal patient data. As a result of the breach, 19 members received Private Health Information (PHI) about other members. Kaiser Permanente was made aware of the breach when two members notified the organization that they had received the concatenated e-mail messages.

In August 2000, Kaiser Permanente Online experienced a serious breach in security. The security breach concatenated several hundred individual e-mails containing personal patient data. As a result of the security breach, 19 members receiving private data about other members. Kaiser Permanente was made aware of the breach when two members notified the organization that they had received the concatenated e-mail messages.

Patient portals are designed to allow the patient to see parts of the medical record. However, the majority of portals do not push the entire medical record into the portal. The reasons for this decision vary from system to system. There are two reason, while valid, do not allow the patient to become a full participant in healthcare. The first is security and access. Security pertains to mobile and web based use and how to protect the information. Access pertains to how the information is accessed and whom. The second is medical information sensitivity. This can become complicated and, in some cases, cause mistrust from the patient .The patient has the

report that ?? percent of healthcare organizations experienced at least one data breach. In addition, this research introduced two major causes of data breaches that most of healthcare organizations suffered. First is . Second is . Further, when the organization is full compliance with HIPAA privacy and security requirement, it would lead to reduce data breaches and improve the privacy and security of patient's

On February, 8, 2011, Ortho Montana, PSC, a healthcare provider submitted a data breach which affected thirty seven thousand people. The type of breach described was ‘Theft’ and information was breached from Laptop. The exact description included in the web description states a laptop which had electronic unsecured protected health information was either lost or stolen. This took place when the laptop was taken to an event by a workforce member.

Kaiser Permanente is a health system which serves over eight million members in nine states and the District of Columbia. In the 1990’s the KP Northern California region created an Internet Patient Portal known as “Kaiser Permanente Online” (KP Online)(Wager, 2009). KP Online provides members access to request appointments and prescription refills, obtain health information, and receive medical advice from staff.

Security breaches of EMRs vary from someone without consent viewing the patient’s information, to a hacker using the information to steal one’s identity. According to Privacy Rights Clearing House, more than 260 million data breaches have occurred in the United States, including those of health related records. Approximately 12 percent of data breaches involve medical organizations (Gellman, 2012). According to Redspin, a provider of Health Insurance Portability and Accountability Act risk analysis and IT security assessment services, more than 6 million individual’s health records were compromised during a period from August 2009 and December 2010 (Author Unknown, 2010). A provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act requires all breaches affecting 500 or more people to be reported to the Department of Health and Human Services. This reporting is to be accomplished within 60 days of discovery. The Redspin report covering the period above involved 225 breaches of protected health information. The amount of people with access to an individual’s health record creates concern with confidentiality. According to the Los Angeles

In this paper, I will discuss the principles that permit disclosure of protected health information with or without the patient’s consent for each of the four categories, government agencies, legal agencies or representatives and research groups. I will also state whether I feel privacy safeguards are adequate to support those principles.

Numerous health care industries have been victims of cyber-attacks. Such attacks occur when an isolated device transfers the stored medical data to the hospital’s network, which could possibly takeover the entire network of the hospital and intercept data exchange between the patient and the healthcare center. For instance, wearable devices such as the (insulin) diabetes kit that determines the exact amount to be discharged into the patient’s blood, based on

The department of Health and Human Services protects and guides the health and well being of individuals here in America (Thacker, 2014). They fulfill these duties providing Americans with adequate and efficient health and human services and monitoring services designed to increase the efficiency of care in the health system (Thacker, 2014). One of the services being monitored by the department of Health and Human Services is the electronic health record system, which carries private and vital information of patient’s health record enabling all eligible participating health workers access to these records (Thacker, 2014). A breach of the protective health information of patients in a health organization creates chaos as these are against the health insurance portability and accountability (HIPAA) law (Thacker, 2014). Hence, measure will have to be put in place to determine what caused the breach and how to rectify it to ensure the breach never happens again (Thacker, 2014).

Privacy and confidentiality are basic rights in our society. Safeguarding those rights, with respect to an individual’s personal health information, is our ethical and legal obligation as health care providers. Doing so in today’s health care environment is increasingly challenging (OJIN, 2005).

In today’s society, medical records becomes a huge issue. In many organizations such as healthcare, patient confidentiality becomes a high concern. Having internet health services, creates a challenge for compliance in healthcare. Providers have treated application security and infrastructure security independently until now. Access must be secured for clinical applications to alleviate the concern from providers in healthcare. Therefore, IT infrastructure must be protected from hackers, misusing information as well as thieves. (FairWarning, n.d.)

It is critical now more than ever, due to the lack sufficient security, to protect patient data in the healthcare industry. Therefore, in order to accomplish this goal, investigation into the possible causes of inadequate security as well as the other causes of healthcare breaches and cyber-threats must be explored. Without this analysis, patient data will continue to be compromised, which will cause devastating damage to both patients and healthcare organizations. From the extensive research on the outbreak of healthcare data breaches, the major factors that contribute to the increase of this issue were discovered. By thorough analysis of these factors, useful solutions will be developed to decrease the compromise of patient data as well as healthcare organizations implementing better security measures.

The rapid changes in technology over the past few decades has left the healthcare industry ill-prepared to operate in today’s environment. Most substantial protections of sensitive consumer information has come as a result of federal regulation, most notably in 1996 with the Health Insurance Portability and Accountability Act and 2009 as part of the American Recovery and Reinvestment Act. Protection of information in the healthcare industry has lagged behind all other industries, perhaps because the records aren’t financial in nature or sensitive government information. Implementing simple steps for many organizations may be enough to limit the vast majority of breaches, although a layered, comprehensive security approach should be the ultimate goal for companies.