This Article Full Text Full Text (PDF) All Versions of this Article: M2195v1 14/2/239    most recent Submit a response Alert me when this article is cited Alert me when eLetters are posted Alert me if a correction is posted Services Similar articles in this journal Similar articles in PubMed Alert me to new issues of the journal Download to citation manager Citing Articles Citing Articles via Google Scholar Google Scholar Articles by Collmann, J. Articles by Cooper, T. Search for Related Content PubMed PubMed Citation Articles by Collmann, J. Articles by Cooper, T.

Breaching the Security of the Kaiser Permanente Internet Patient Portal: the Organizational Foundations of Information Security

^a Georgetown University Medical Center, Washington, DC
^b Stanford University Medical Center, Palo Alto, CA.

^_* Correspondence and reprints: Jeff Collmann, Ph.D., 5319 29th St, NW, Washington, DC, 20015. (Email: collmanj{at}georgetown.edu).

Received for publication: 07/06/06; accepted for publication: 10/29/06.

This case study describes and analyzes a breach of the confidentiality and integrity of personally identified health information (e.g. appointment details, answers to patients’ questions, medical advice) for over 800 Kaiser Permanente (KP) members through KP Online, a web-enabled health care portal. The authors obtained and analyzed multiple types of qualitative data about this incident including interviews with KP staff, incident reports, root cause analyses, and media reports. Reasons at multiple levels account for the breach, including the architecture of the information system, the motivations of individual staff members, and differences among the subcultures of individual groups within as well as technical and social relations across the Kaiser IT program. None of these reasons could be classified, strictly speaking, as "security violations." This case study, thus, suggests that, to protect sensitive patient information, health care organizations should build safe organizational contexts for complex health information systems in addition to complying with good information security practice and regulations such as the Health Insurance Portability and Accountability Act (HIPAA) of 1996.