Breaching the Security of an Internet Patient Portal In August 2000, a breach occurred when an Operations technician applied patches to servers in support of a new KP Online pharmacy refill application.
Full Answer
A full understanding of the KP Online breach requires technical, individual, group, organizational, and cross-level analysis. Technical Level: The Architecture and Management of the Kaiser IT Infrastructure Two individuals made specific mistakes that led to the immediate breach of message security.
1 Complex, tightly-coupled computerized health information system architectures potentially aggravate security breaches or other mistakes with their capacity to transform errors into cascading system accidents.
A full understanding of the KP Online breach requires technical, individual, group, organizational, and cross-level analysis. Technical Level: The Architecture and Management of the Kaiser IT Infrastructure
2 Security training is necessary but not sufficient to prevent information security breaches because individual errors, group failures, and system accidents may contribute to information security breaches without violating the HIPAA security rules or standard information security policies, procedures, or practices.
The Kaiser Permanente leadership reacted quickly to mitigate the damage of the breach because the company was non-compliant with good information security practice and regulations such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) which established standards for the confidentiality and security of health care information . The advances in technology including computerized medical data has the potential to be breached regarding patients privacy and confidentiality health information. The ANA supports the following principles with respect to patient privacy and confidentiality.
In August 2000, a breach occurred when an Operations technician applied patches to servers in support of a new KP Online pharmacy refill application. Subsequently, the outgoing e-mail function of KP Online failed and created a dead letter file of outbound messages with replies to patient inquiries that contained individually identifiable patient information (Collmann & Cooper, 2007). In trying to clear the e-mail file, a flawed computer script was created that concatenated over 800 individual e-mail messages, which contained personal identifiable.