[ Wednesday, June 22, 2005 ]
Kaiser: An open conversation:Before I start this, let me get this out of the way, for Elisa, Kaiser, and anyone else: I don't represent Elisa Cooper or Kaiser in this matter, and never will. I have never represented Kaiser or any affiliate or subsidiary to my knowledge, but I have in the past been at least potentially adverse to them (I've reviewed a couple of employment contracts for doctors joining Kaiser). So, this is not legal advice, and nobody should interpret or imply that it is.
Furthermore, I think that Kaiser screwed up by putting real data in a test site; that's a pretty inexcusable mistake for a company as big and sophisticated as Kaiser. They should never have used real information; maybe they should've taken the site down sooner; maybe they should've notified the 140 individuals sooner (not that HIPAA requires it, and if it really was such a techincal and innocuous breach, maybe they didn't need to). They aren't angels in this. But I also think there are a lot of folks with irrational enmity for Kaiser, and I think their rantings should be viewed in light of that irrationality. I also only know what I've been told and read, and I'm being as honest as I can be (hey, remember, I'm a lawyer) in my analysis. I may not have all the facts and could be way off base, and I'll keep the comments open for anyone else who wants to lob in responses.
I don't know any other way to do this, so I'm going to post the Diva's comment from below (in italics) and respond interlineally (in bold). This isn't really a Fisking, since I'm not sure either that she means what she says or says what she says clearly enough for me to comment on it. Either way, here goes:
Hi, Jeff -Funny you should use the word "vindication". Every single person who asked me for a comment yesterday asked me if I felt "vindicated". I think this comes from a fundamental misunderstanding of the problem in the first place. Right now I'm mostly relieved that the DMHC has confirmed I wasn't the one who posted the Systems Diagrams on the web. [I don't think DMHC has confirmed that; I think they've confirmed that Kaiser put PHI on the web when they put the Systems Diagrams on the web; but I think you even admit below that you did in fact put PHI on the web when you re-established the web site after Kaiser took it down. You say you did so to "show" OCR that it was up there, but you could've shown OCR without showing the world, couldn't you? Kaiser made a mistake in including real PHI in the Systems Diagrams site that was avaiable over the internet; they can't put the genie back in the bottle, but they can remove the website and/or the PHI, which is what they did. You then re-posted the PHI on the web. Isn't this using the PHI of those poor 140 individuals as a part of your personal grudge against Kaiser?] I've been fending off Kaiser's insinuations that I stole patient data as an employee for three months, and I hope the DMHC's determination will finally put a stop to that. [Kaiser shouldn't have put the PHI up. Once they took it down and you put it back up again, it would seem that either you got the info from your relationship with Kaiser as an employee, or got it over the net and reposted it. I don't see where Kaiser is making that insinuation, but I don't think it's unreasonable to insinuate that you might've gotten that information from your employment relationship with Kaiser.]You're wrong about many aspects of this situation. If you have questions, feel free to ask (kaiser_scapegoat@hotmail.com). My policy has been to offer people all the information I can and not edit anything. Unfortunately, this meant leaving "Diva of Disgruntled" as the title of my blog, even though it encourages assumptions like yours. I felt if I were going to complain about Kaiser's destruction of documents, it would be hypocritical to run around and "clean up" my own history even if it would hurt my legal situation. I'm hoping that what I get in return for my integrity is a fair hearing. [The issue here is simply not the destruction of documents, it's the improper disclosure of PHI. If you complained to the neighbors that they were making too much noise, would you them complain if they turned the stereo down, since that would be "covering up" the basis of your complaint? Anyway, my biggest complaint about the name of your blog is that Disgruntled is an adjective; you should've called it "Diva of the Disgruntled" or "Diva of Disgruntlement" to put a noun after that preposition. However, calling yourself that gives anyone reading you the right to question your motives.]I am a former employee of Kaiser. I lost my job in 2003. I admit to being disgruntled about the circumstances and frustrated about my lack of recourse. I don't want to go into detail here because that happened over a year before I even found the Systems Diagrams. I'm happy to answer any questions about it, if you want to ask. I did not do anything to deserve to be "fired". The Systems Diagrams were not "leverage" for anything. I went through a long dispute resolution process with Kaiser that did indeed contribute to my "disgruntlement", but that was over with 6 months before I found the Systems Diagrams. I had no contact with Kaiser after the dispute resolution process except for the incident which launched my blog. [I don't know anything about your employment complaint with Kaiser; the fact that there is one is evidence of a possible motive on your part. You should realize that.]I'm a pretty mousy person, and putting myself on public display is about the worst experience I could put myself through. However, someone from Kaiser tried to intimidate me. A Kaiser investigator left his card on my doorstep while I was at home to imply he was lurking around outside. [How do you know he was trying to intimidate you? It seems that if intimidation was his motive, he would've knocked on the door and confronted you. Or maybe he came while you weren't there and left his card then, and you didn't see it until later? What did the card say, "Joe Friday, Kaiser Investigations and Intimidators Service"? I'm being facetious, but there seems like there could be a logical and entirely benign explanation for this. The place I live is behind another house, and the mailbox is out on the street. If someone comes back to where my house is, it's only to knock on the door. Once I saw the card, I had to wonder what else the Investigator had done: did he put cameras in my windows? Tap my phone? What else was he capable of? [If he wanted to tap your phone or spy, why would he have left a card? Wouldn't he have tried to slip away unnoticed if surveilance was his gig? This seems totally incompatible with the possibility that he was there to intimidate you.]I don't know who sent the Investigator or why. [I thought you said he was a Kaiser investigator. Now you day you don't know who sent him.] He may have been a friend of my former manager's rather than someone officially sent by Kaiser to intimidate me. There are a number of things Kaiser could have been responding to. I had filed complaints with a number of agencies, and I had been writing political representatives. I made a business ethics complaint through EthicsPoint. It's also possible he was responding to the eBay thing, though I think Kaiser would have approached that head on instead of dispatching someone to lurk around my house. [Lurk? And leave a business card?] The eBay incident was something stupid I did, but it has nothing to do with the Systems Diagrams or patient data. My termination from Kaiser was conducted as a deliberate surprise (because it was illegal), [Illegal? What law did Kaiser break by terminating you? I know California is a pretty odd place, but is there a law out there that prevents employers from terminating the employment of employees? That must be why Donald Trump does his show from New York. Did you call the police to report this crime? Or was there something else? Do you mean to say it was tortious and you have legal recourse against Kaiser? If that's what you mean, I would think you'd be able to find a lot of lawyers who would take your case here.] and this left me holding a lot of documents from work. I never had any access to patient data, and the documents are the type everybody has from work. Mostly high level web philosophy stuff. I've seen a couple of them posted on other people's web sites as samples of their work for their resume. One night I saw a news segment about weird items on eBay. I had been through months of an exhausting, futile dispute resolution process with Kaiser, and I was having no luck finding a lawyer or getting a political representative to look at my case. Kaiser had called the last letter of the dispute resolution process "final", and I wanted them to know I was still pursuing it, and I wanted them to know that by covering for my manager they had left me with all these documents (and maybe they'd think twice before doing the same thing to someone else). So my ever-so-brilliant idea was to list a bunch of document titles on eBay, tip my hat at Kaiser and maybe get some attention for my case at the same time (the idea was that a reporter would ask me why I did it, I would tell them about Kaiser destroying all my email to cover up an illegal termination, they would write an article, and that might ultimately get me a lawyer). I listed about 12 titles: I set an outrageously high bid price and emphasized these were beat-up papers with highlighting all over them. I didn't want anyone to actually bid on them. Kaiser noticed, as expected. [Okay, so you intended this threatened disclosure of these documents to be a way to get at Kaiser to force them to deal with your "pursuit" of their "illegal" termination of your employment? And you got the "expected" reaction from Kaiser. Do you see why it appears to me that your later disclosure of PHI by reposting the website information might be interpreted as an attempt by you to "get at Kaiser" in connection with your employment dispute? You were willing to threaten disclosure of (at least what was intended to look like) internal Kaiser documents to gain leverage in your employment dispute; is it unreasonable to interpret your motives in the later disclosure of PHI to be any less honorable?] I got an email with an obvious legal question about document formats. I tipped my hat at them and signed my name. Kaiser blocked the auction as expected. No sympathetic journalist noticed. I didn't do anything further. I never sold anything. No patient data was involved. I didn't post actual documents - just the titles. I didn't run out and try to sell them elsewhere. I just wanted Kaiser to know they left me with all those documents. It's just a stupid thing I did when everything else felt hopeless. [Okay, even if there was no PHI here, would Kaiser have reason to believe that you were trying to disclose information that might be considered trade secrets to them? If a company doesn't try to protect its trade secrets from one incident of wrongful disclosure, it can have a hard time protecting them later on.]The Investigator thing happened later, so if it was actually an official Kaiser action, it was probably for all the trouble I was causing put together including the above-mentioned eBay incident.I don't think there are words strong enough to describe how traumatized I was by this. It's really creepy to think some guy may be looking in your windows. *This* is when I started blogging about Kaiser. I'm a pretty mild-manner, docile person. Notice how I pursued Kaiser's own 7-month dispute resolution process before even looking for a lawyer. I also went to the Dept. of Fair Employment and Housing. My instinct is to do things in the lowest profile way possible. However, the Investigator incident was the final straw for me. I'd been wrongfully terminated by Kaiser, trudged through months of "proper channels" , and now I had some Kaiser guy wandering around my house. The police told me they couldn't do anything. I wanted to show Kaiser this was a bad, bad, bad move on their part. The only thing I had, though, was my ability to shout back. Therefore, used my LiveJournal (which I had started about a month before to make anonymous vague philosophical statements about corporate ethics) to start shouting at Kaiser. I also posted some pages from some of the documents I had just to underscore that they had turned me into a loose canon. Once more, no patient data involved. [But again, there's a disclosure of information due to your dispute with Kaiser, in an effort to gain leverage or help your position in that dispute. This could certainly lead someone to assume that your later actions were motivated by the same goals.]At this time, I was pretty miserable. As mentioned above, it's not really in my personality to make a spectacle of myself. I was embarrassed and angry that this was the only thing I had left. However, my blog attracted other people who had had similar experiences with Kaiser (mostly in regard to document destruction during arbitration proceedings). They were supportive. One, who became a very good friend, told me I shouldn't be embarrassed be embarrassed about being disgruntled - that I had good reason to be, and that I should own it and be proud of it. That's when I added the "Diva of Disgruntled" tagline to my blog. It was a way I could get reframe my situation and get back some dignity. I was also asked to speak on a local radio show about Kaiser's EMR.A couple months go by. During this time I help the patient advocacy groups with research, mostly gathering Kaiser-related documents from the Internet. One day I Googled my former manager's name, and I found the Systems Diagrams. I didn't know what to make of them - I thought they might be some sort of honeypot Kaiser put out to attract hackers. This was such a weird discovery that I put more energy into Googling, and I made a second amazing discovery. Part of Kaiser Colorado Intranet was apparently not behind a firewall, because I was getting all sorts of documents related to Kaiser's not-yet-launched Thrive campaign. I handed these over to the person who runs the Kaiser Thrive web site. Because this was such a wild find, the Systems Diagrams were overshadowed. I wanted to report them somewhere instead of just giving them to Kaiser because I had direct, personal experience of Kaiser destroying documents to cover stuff up. I felt that some cosmic force had put the Systems Diagrams in my way to give me a chance to prevent Kaiser from covering this up. It took me a couple of weeks to figure out the Office of Civil Rights was the place to report the Systems Diagrams. [So at this point you discover that Kaiser has PHI out there accessible on the web. But you don't tell Kaiser. You tell them about the "Thrive" campaign information you've accessed, but you don't tell them about the Systems Diagrams or the PHI that's there. You don't tell them because you're afraid they'll take them down; but isn't that what they should do? Shouldn't they fix the breaches in the firewall and take the PHI off the web? I don't really understand why you would tell them about their inadvertent disclosure of competitive business information, but wouldn't tell them about their inadvertent disclosure of the personal medical information of unwitting Kaiser subscribers? Is there no way you could have done screen captures or otherwise downloaded the information that was then on the web as proof that it had been on the web? This doesn't make a lot of sense to me.]I also told Matthew Holt of the Health Care Blog, and after he discussed the Systems Diagrams, Kaiser took them down. I had taken a copy for evidence [OK, I guess you could have taken copies as evidence], and I felt the sudden and quiet disappearance of the Systems Diagrams confirmed Kaiser had responded by covering their tracks [were they covering their tracks or removing PHI that had inadvertently been disclosed?]. I had already confirmed that the Systems Diagrams had been on the web for several years via the Internet Archive (the earliest date I saw was 2002, but the DMHC is now saying 1999). I also thought that the main issue was the leak of technical information [why would this be the "main issue," and to whom? Kaiser? OCR? The DMHC spanked Kaiser for disclosing PHI, not technical information.]. I saw a couple of names, but I thought they were probably test data. (Recently when I was combing through the Systems Diagrams for dates to show the site was being maintained and updated after I was no longer working for Kaiser, I found a list of patient Medical Record Numbers - I think this is the "private information" and the source of the 140 figure). Anyway, I put my copy of the web site up [if I'm reading this right, at this point you took PHI that Kaiser had improperly exposed but had removed, and re-exposed it on a web site; correct?] to show the OCR that it was a web site: I really thought the damage had already been done as far as it being on the web, and I planned to take it down after the OCR had a chance to look at it. However, the OCR didn't get back to me for four months [in the meantime, the PHI of the poor 140 folks is still out there, actively on the web. Because of you. That doesn't seem responsible to me.]. Complete silence. In the meantime I had a medical emergency, and I had to cope with the ramifications of being uninsured. I just forgot about the web site while waiting for the OCR.The OCR finally got back to me four months later. They asked me about my copy of the web site, and they didn't say anything about taking it down or how long they would need to investigate. A month later I got a generic letter from the OCR saying they had offered Kaiser some "training" in HIPAA. I was astounded. Having worked in that area, I knew Kaiser was well aware of HIPAA and managers in that area wouldn't have "mistakenly" posted anything on the web. I was sure this was posted as a means for technical consultants to communicate with and train each other: and it was on the Internet (a cheesy Tripod web site) because they were communicating with consultants outside Kaiser's Intranet. It was amazing that the OCR fell for some "we didn't know about HIPAA" routine, and I felt Kaiser had lied to the OCR. [Kaiser's explanation for the PHI being on the Tripod site was that it was a mistake to have posted it (which it was). Are you saying Kaiser intentionally posted that PHI? There's nothing wrong, under HIPAA or any other law, with Kaiser posting technical information on an open website so their consultants could work with it. Let's say Kaiser did the exact same thing, but it changed all of the identifying data to phony names from English Literature (Charles Dickens' CBC shows cholesterol at 328, so he gets Lipitor, etc.). Would the cheesy Tripod site be a bad thing? Why? Shouldn't Kaiser try to set up its systems so its consultants can access, test, utilize, perform, etc.? Wouldn't having some data on the site make it easier to see if it would work or to work out bugs? The only problem is that Kaiser used real information. I can see OCR hearing that explanation and buying it; in fact, I would probably buy it. It's still a mistake, but the way to fix it is to take it off the web. Which is what Kaiser did. Again, what would you rather they have done? I don't get it.] At that point I griped about the outcome of the investigation on my blog, and I linked to the copy site as proof. Kaiser diddled around for two months, and then they issued a Cease & Desist Order. I thought this was a SLAPP, so I ignored it: if Kaiser wanted me to do anything, they could just ask, and that would give me the opportunity to talk with them about the document destruction issue. I posted my link again to defy the C&D, and I called for people to contact the OCR and demand a real investigation. Kaiser then called 140 patients and told them something to the effect that I had stolen patient data, and I was the one who put it on the web [well, you had put it on the web; maybe you hadn't stolen it, and it had already been on the web once and removed, but you did, in fact, put the PHI of the 140 patients on the web, undoing Kaiser's attempt to fix the bad disclosure (which could have, in fact, been nothing but a simple mistake). When a reporter called me, I told her that wasn't true. I told her everything I knew and offered whatever evidnce she wanted. This was the San Jose Mercury News, and she did a pretty good job of checking the facts and getting comments from both sides. You'd think Kaiser would realize that they had done an evil thing at this point [what was the evil thing? Inadvertently posting the PHI? Taking it down when they found out about it? Do you think they somehow gained in any way by putting that PHI out there? Do you think it was intentional? And if their unintentional disclosure of the PHI was "an evil thing," what was your intentional re-posting of it?]. Instead, they poured on the smear campaign. I took down the copy site once the 140 number hit me - and I thought a public investigation was assured at that point, anyway. Kaiser dragged me into Court for a symbolic Restraining Order. When they didn't get it right away, they went to the DMHC and cried Disgruntled Employee Stole Data! Note the DMHC confirmed they were only told in March 2005 in their Kaiser judgment. The DMHC saw the "Diva of Disgruntled" tagline, and they jumped to conclusions. They issued a press release that corroborated Kaiser's story, and I've been dealing with the fallout ever since.Kaiser is suing me, but they have no breach of contract claim since I wasn't working for them when I found the Systems Diagrams. The only reason they can keep on litigating is that I'm too poor to afford a lawyer. Because I didn't run and hide "Diva of Disgruntled", I apparently don't have the public sympathy to get a pro bono lawyer. Kaiser can just keep peppering me with paperwork for years. They want me to settle and give them a symbolic victory so they can decrease their liability and make the fact they tried to frame me look like some justified act. As long as they are suing me, their PR people can keep pointing to the suit to show how wrong and bad and disgruntled I am.I think you don't understand the nature of the site, either. It wasn't a test app. It was training documentation. It contained a lot of systems diagrams, screenshots, and even some code. The patient data is in the screen shots and some generated output lists. Some of the screenshots have personal information like addresses, and perhaps social security numbers (I'm not going to go check). The big list is the one with Kaiser Medical Record Numbers (MRNs). I don't think there is much, if any, really personal health information: Kaiser exaggerated this to get the restraining order when they thought they were going to pin it on me. [If there's very little PHI, what has Kaiser done wrong? If there were no PHI on that site (or if the PHI were de-identified and re-identified with phony names), Kaiser would be $200,000 richer. Kaiser's "crime" was disclosing the PHI; why would they exagerate that? To get at you? That does not make sense.]I would like to mention the DMHC never apologized for what they did to me. Instead they offered a quiet settlement in which they would "revise" the original Order. I signed this settlement on April 15, and I will show it to you if you want. [I would like to see it.] The DMHC broke the settlement when I complained they had slipped extra language back in. They probably attempted to do that because in the settlement the DMHC claims the authority to deem linking to public web sites injurious. The DMHC didn't have jurisdiction over a private citizen in the first place. To abet Kaiser in an "unclean hands" act against me and then to break a settlement in which I was allowing them to quietly save face - that's all just an outrageous tyranny of the State. [Um, I think you're leaving the reservation here. I don't think DMHC has jurisdiction over you, but I'm not a California lawyer and know nothing about DMHC. But it wouldn't make sense. However, DMHC fined Kaiser for wrongfully disclosing PHI. You also (re)disclosed the same PHI. If I were the DMHC, I don't think I'd be heaping praises on you for that.] The Kaiser fine probably reflects the DMHC's frustration at being put in that position. The good news is since the DMHC's decision clears me of being a rogue employee data bandit, the patient advocacy groups I was working with will now be able to admit to knowing me in public without hurting their cause, and with their help I might be able to get some legal help. [I don't know if the DMHC decision really clears you. It punished Kaiser for carelessness (at the least) in the original disclosure of PHI on the Systems Diagrams. Whether you tried to sell Kaiser trade secrets on Ebay, stole the PHI, or otherwise were a rogue employee or data bandit, DMHC doesn't say.]As for "further publication of the information" I hope you will keep in mind that I didn't know I was perpetuating a lot of patient data. I thought I was preserving the evidence of a leak of technical information. I had a First Amendment right to point it out once that information had been put out in public by Kaiser. Moreover, that data was on the Internet since 1999. It would still be there today, if I hadn't pointed it out. [Right. Those 140 patients thank you for pointing it out, so that Kaiser could take it down. Too bad Kaiser doesn't have access to a time machine so they could go back and unpost it before it was ever posted. Of course, you'll understand if those 140 patients aren't thankful of you re-posting the information. And "it would still be there today" as a result of your re-posting of it if Kaiser hadn't come after you with guns blazing to get you to remove it again, wouldn't it?] The patients would never have been informed if I hadn't resisted the C&D Order. Kaiser missed several chances to do that (for instance, Sept. 2004 and January 2005). [HIPAA doesn't require Kaiser to notify the patients unless it needs to do so to mitigate potential damage. You yourself said there was little to no PHI in the disclosed information, so why would Kaiser need to notify the patients? And if the "cheesy Tripod site" was a bunch of system diagrams and screen shots that was well hidden and unlikely to be found by anyone not a consultant to Kaiser or otherwise involved in the Kaiser EMR project (all of whom, I bet, have signed BAAs with Kaiser to protect any PHI they come into contact with), should Kaiser have unnecessarily alerted and scared some patient when there was little info and few likely predatory viewers?] If that patient data had been previously misused in any way, no one would have known where it was coming from. The OCR didn't inform the patients, either. It was only my determination to keep Kaiser from covering something up that led to a real outside investigation.Your summary of my situation contains a number of inaccuracies, which helps Kaiser spread its various character smears. You could have come to me and asked for my version of events. I've left comments on your blog before, too. I hope that you will ask me for more information if you have any questions. [True, you did contact me in the past, and I didn't respond because I got busy. Sorry, my bad. But now, you've got plenty to respond to.]
Jeff [10:19 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
