Breaching the Security of an Internet Patient Portal Essay

The penalties for violating the rules dictating by HIPAA are complicated because the guidelines are still very broad and the rules are still so new that with each case new standards are being set as to the way violations are being handled. Violation of HIPAA rules can result in civil and criminal consequences. There is case that marked history as the first health care organization to be fined for a HIPAA violation. Cignet Health in Maryland was fined $4.3 million for two violations: failure to provide patients a copy of their medical records within 60 days of a request and failure to cooperate with civil investigators. “HIPAA calls for civil and criminal penalties for privacy and security violations, including: -- fines up to $25K for multiple violations of the same standard in a calendar year -

Kaiser Permanente is a large nonprofit integrated healthcare plan. This organization serves a tremendous amount of patients all over the United States with more than 38 hospitals and more than 600 medical offices. They offer medical care from chronic care visits to deliveries and prescription refills ("Who We Are - Kaiser Permanente," n.d.) Kaiser Permanente conducts campaigns to spread their care knowledge to others. They perform sick care, prevention care, and treatment for those who need it.

Kaiser Permanente is a managed care facility that provides services across the health care continuum. Over the years the organization has continually made efforts toward improvements since it was first founded in 1945. These improvements generate a series of successes that set Kaiser apart from similar organizations. But, just as any health care delivery system, Kaiser has faced challenges in the past, present and may continue to do so in the future. In this paper I will explain what attributes to the success of Kaiser Permanente and some of the challenges they face.

If one violates one’s privacy they are looking at very costly civil violations. For unknowing violations, one’s privacy, you will owe $100 per violation and $25,000 for a repeat violation. For violation HIPAA for a reasonable cause, it is $1,000 per violation with $100,000 for repeat violations. As for willful neglect but the violation is corrected within a certain time period it is $10,000 per violation with $250,000 for a repeat violation. Lastly, someone could owe $50,000 per violation and up to a maximum of $1.5 million for a repeat violation that is not corrected within the required time period (Brown,2014). As if that doesn’t seem to get any worse someone is also looking to facing criminal penalties when violating these laws. For individuals who knowingly violate HIPAA laws they can face up to a year of imprisonment. With someone who has the intentions to sell someone’s information to another individual can face up to ten years in prison (Brown, 2014). When starting a job in a hospital all employees are required to sign their understanding of the HIPAA laws for that hospital. Many hospitals require certain training and in-services to provide understanding of the laws and its importance in the hospital setting. If HIPAA is violated most hospitals let the employee know in the paperwork that they sign that they will be terminated immediately.

Whenever any healthcare personal violates the HIPAA policy the punishments can be minor to server. The individual who bleaches privacy of any medical records the punishment can be verbal warning without further punishment the individual doesn’t violates the rules and regulation. If the individual in question violates the rule or regulation the individual can be place on probation, suspended without pay until further notice. Some one can be signed to look over you and check out all what you do on regular basic as you work. If you have authorization for high level clearance documents, it would be stripe from whoever violated the rules and regulations.

6. A breach of confidentiality can result in what consequences for a health care professional? The penalties for violating HIPAA range from civil penalties of up to $100 per person per incident for minor improper disclosures of health information, and up to $25,000 for multiple violations of the same standard in a calendar year. Federal criminal liability for improper disclosure of information or for obtaining information under false pretenses carries sanctions (fines) of $50,000 and one year in prison. The liability for obtaining protected health information under false pretenses with the intent to sell, transfer, or use the information for personal gain or for a malicious action, such as Medicare fraud, carries penalties of $250,000 and/or up to ten years in prison. Severe penalties are in effect if lax security allows health information to be stolen. There is also a risk of a class action suit as well as public relations damage to the institution’s or physician’s image.

Kaiser Permanente is a large health care delivery system that serves over eight million individuals across nine states, and the District of Columbia. In 1990 Kaiser Permanente developed a internet patient portal, KP Online. KP Online enabled members to make appointments, request prescription refills, seek clinical advice, obtain health care information, and interact with patients in forums.

Kaiser Permanente (KP) was founded in California in 1945. It is one of the largest non-profit healthcare organizations in the United States, made up of three entities: the Kaiser Foundation Hospital, the Kaiser Foundation Health Plan and the Permanente Medical Groups. It currently serves about 9.1 members within the following states: California, Colorado, Washington DC, Maryland, Virginia, Washington, Oregon, Hawaii, and Georgia. With a few exceptions, it mostly operates under a managed care model, owning the physician network and the facilities its members use to receive medical services (Fast Facts, 2013).

"HIPAA doesn?t necessarily prescribe the solutions, but it does require physicians to look at all of the ways that they use and access data today and determine whether that?s reasonable or not." to help you begin your HIPAA compliance process, following are some practical ideas for rethinking how you maintain and use patient information in your office. Appoint one or two staff members (depending on the size of your office) to review the HIPAA act, determine the changes your practice needs to make, and decide if you?ll need outside help. To keep this project manageable, do not wait until the last minute. Remember: most of the healthcare industry will have to be HIPAA compliant by April 14, 2003. Furthermore, compliance is not optional. Those found in violation of the act will be penalized: "Civil penalties range up to $25,000 per violation of each standard. Criminal penalties range up to $250,000 in fines and/or up to 10 years in prison."3

HIPAA fines are per violation, and are categorized by: Reasonable Cause or Willful Neglect and can be up to $1,500,000 if not corrected.

Security breaches of EMRs vary from someone without consent viewing the patient’s information, to a hacker using the information to steal one’s identity. According to Privacy Rights Clearing House, more than 260 million data breaches have occurred in the United States, including those of health related records. Approximately 12 percent of data breaches involve medical organizations (Gellman, 2012). According to Redspin, a provider of Health Insurance Portability and Accountability Act risk analysis and IT security assessment services, more than 6 million individual’s health records were compromised during a period from August 2009 and December 2010 (Author Unknown, 2010). A provision of the Health Information Technology for Economic and Clinical Health (HITECH) Act requires all breaches affecting 500 or more people to be reported to the Department of Health and Human Services. This reporting is to be accomplished within 60 days of discovery. The Redspin report covering the period above involved 225 breaches of protected health information. The amount of people with access to an individual’s health record creates concern with confidentiality. According to the Los Angeles

The main focus of the article is to look at the absolute value of patients’ confidentiality. Blightman et al. look at the pros and cones of breaking patient’s confidentiality and conclude that a breached of confidentiality is in order when it is necessary to obtain consent, as required by law, or when it is in the best interest of the public. The article is useful to my subject, since it examines in details the main issues involving the safeguard of patients’ information. In addition, the authors define confidential information, looks at breaching confidentiality for consent, audits, protection of children, disclosure to family and friends, statutory disclosure, prevention of crime, public interest, public safety, public health, and disclosure to the media. The paper publication is Continuing Education in Anaesthesia, Critical Care & Pain, which s a joint publication of the British Journal of Anaesthesia and The Royal College of Anaesthetists in the UK. It is also the official journal of The Faculty of Pain Medicine and The College of Anaesthetists of Ireland. Publication in such an esteemed journal requires utterly scrutinized of reliability and credibility of the information provided. I found the article educational and thorough in its coverage of aspects of breach of patient information. It is also well written and easy to understand.

In this paper, I will discuss the principles that permit disclosure of protected health information with or without the patient’s consent for each of the four categories, government agencies, legal agencies or representatives and research groups. I will also state whether I feel privacy safeguards are adequate to support those principles.

Privacy and confidentiality are basic rights in our society. Safeguarding those rights, with respect to an individual’s personal health information, is our ethical and legal obligation as health care providers. Doing so in today’s health care environment is increasingly challenging (OJIN, 2005).

did publish in 45 CFR Part 142 a proposal for that Security Standard. That Notice of