Health IT

By Alice Lipowicz

Blog archive

Kaiser official defends security practices for veterans health data

In the last several days, I have read a news article and a blog post that raise questions about Kaiser Permanente’s privacy and security policies regarding the medical records of its patients — including the records of about 450 veterans participating in a Kaiser/Veterans Affairs Department health data exchange pilot program in San Diego.

The articles suggest that Kaiser handles patient data security differently, and possibly more daringly, than other health plans.

I spoke with Dr. John Mattison, chief medical information officer for Kaiser Permanente Southern California, about the situation. He told me Kaiser uses a comprehensive system of privacy and security based on compliance with the Health Insurance Portability and Accountability Act and all applicable laws. The system includes using role-based access privileges like most other health systems, and Kaiser has been performing algorithmic surveillance of the systems to detect anomalies that could indicate unauthorized access, he said.

“We do not allow everyone to see everything,” Mattison said today. “We allow access based on roles — which include receptionist, medical assistant, quality assurance officer, coding or billing officers. We have security profiles, and you can only see what is allowed for that role.”

Typically, health systems have about 40 to 2,000 different user profiles and corresponding levels of access in their systems, Mattison said. Kaiser’s number of roles “is in the middle of that range.”

“We are using the same restrictions as the rest of the industry, and we are pretty much in the middle of the industry for integrated organizations,” Mattison said. Also, Kaiser is forging ahead in deploying its surveillance software to better detect anomalies, he added.

As for suggestions that Kaiser’s security is more “daring” than other health plans, Mattison disagreed with that assessment. “There are some false assumptions underlying that premise,” Mattison said.

The veterans who are sharing data with Kaiser through the Nationwide Information Health Network (NHIN) should be confident that their data is secure, Mattison said. That is because all of the NHIN’s stringent security and privacy protocols are being followed, he said. He noted that Kaiser and veterans health facilities have been exchanging records for many years in a paper format by mail. The paper records pass from mail room to mail room, with numerous clerks involved.

“Your records are more secure in being exchanged through the NHIN than through the U.S. mail,” Mattison said.

Posted by Alice Lipowicz on Mar 05, 2010 at 12:14 PM


Featured

  • Defense
    The Pentagon (Photo by Ivan Cholakov / Shutterstock)

    DOD CIO hits pause on JEDI cloud acquisition

    Dana Deasy set cloud as his office's top priority. But when it comes to the JEDI request for proposal, he's directed staff to "pause" to compile a comprehensive review.

  • Cybersecurity
    By Gorodenkoff shutterstock ID 761940757

    Waging cyber war without a rulebook

    As the U.S. looks to go on the offense in the cyber domain, critical questions remain unanswered around who will take the lead and how clearly to draw the rules of engagement.

  • Government Innovation Awards
    Government Innovation Awards - https://governmentinnovationawards.com

    Deadline extended for Rising Star nominations

    You now have until July 18 to help us identify the early-career innovators and change agents in government IT.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.