Most everyone in the United States and millions of people around the world have become familiar with “Octomom†Nadya Suleman, who gave birth to octuplets, all of whom survived. Since this story garnered so much public interest, it piqued the media’s collective interest as well, which resulted in some unfortunate behavior.
Employees at the Kaiser Permanente Bellflower Medical Center, where the octuplets were born, were accused of accessing Suleman’s medical records without specific permission. Fifteen of these workers were fired and eight more were reprimanded for deciding to take a peek. In addition, investigators fined the hospital for negligence, since management did not do enough to keep the information confidential after being notified that the file was less than secure.
A lot of people say that this need to protect celebrities’ private information from the public eye is what helped to spawn a California law stating that all hospitals must report incidences of information breaches to the state’s department of public health, whether they are intentional or unintentional. Between January 1 and June 1 of this year the department has received over 500 such incident reports.
Even the data breaches that are unintentional, such as if an employee faxes a patient’s records to the incorrect fax number, can leave a patient in trouble. Identity thieves can take that information and use it to create fraudulent medical cards so they can bill treatments to the patient instead of having to pay for them. Also, medical files can contain a person’s date of birth, place of birth, employer, Social Security number, and all the other good stuff you write on the form when you go to see a new physician.
Hospitals and other healthcare providers argue that the provisions in the law are too stringent. It is arguable whether or not administrators have any power to really prevent unintentional breaches. For example, there is no way to force someone to check to make sure they are faxing records to the right place.
However, there are steps that healthcare providers can and must take, or they can be slapped with a fine of up to $250,000. If money doesn’t talk, perhaps patients will, choosing to do business with hospitals that have cleaner data breach records. It’s bad enough to have to go to the hospital to get an illness or injury attended to. It’s even worse when you have to fear losing your livelihood in the process, when a thief ruins your credit with thousands of dollars of unpaid medical bills.
Identity theft protection can help you here, by alerting you when someone is accessing your credit that should not be doing so, but a vigilant administration can be even more important. Unless employees face strict consequences for looking at information they are not supposed to see, they could continue to treat secure information as their own and even distribute it to the media. It would not be the first time that this has occurred, as anyone who has seen the Drudge Report can attest to.