HIM 422 Module 6 Final Project Milestone Three Example

Final Project Milestone Three: What Anthem Owed, and What Should Change

[Student Name]

Southern New Hampshire University

HIM 422: Ethical and Legal Considerations in Health Information Management

Final Project Milestone Three

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone Three: What Anthem Owed, and What Should Change

Earlier milestones showed that a single phishing message opened the door to Anthem's systems, that the intruders roamed unnoticed for months and that they carried off identifiers for 78.8 million people, and that the consequences included $170.5 million in public settlements and lasting harm to members. This milestone asks two further questions. What did the law and professional ethics require of Anthem? And what should Anthem, or any organization holding similar data, change? Legal considerations come first, then ethical ones, then recommendations.

Legal Considerations: The Security Rule

The federal findings map directly onto the HIPAA Security Rule. The rule makes an accurate and thorough risk analysis the foundation of every other safeguard, and regulators found that Anthem had not conducted one across the enterprise. The rule expects covered entities to review records of system activity such as logins and queries, and regulators found that review insufficient. It requires procedures to identify and respond to security incidents, and the attack ran for months before anyone noticed. It also requires technical controls that limit access to those who need it, and regulators found those controls inadequate. None of these duties requires perfect security. Each requires a reasonable, documented process, and the findings suggest that process was missing where it mattered most.

Legal Considerations: Negligence and State Law

The class action rested largely on negligence: a duty to protect members' data, a breach of that duty through inadequate security, and harm caused by the breach. Proving harm is often the hardest element in breach cases, because courts have disagreed about whether the risk of future identity theft is itself an injury. The exposure of Social Security numbers made harm easier to argue here. State laws added obligations of their own, including breach notification deadlines and consumer protection statutes, which is why more than 40 attorneys general could pursue a separate settlement. McCoy and Perlis (2018) showed that large hacking incidents at health plans came to dominate the number of breached records, which suggests regulators and courts were learning from this case how to treat the next one.

Ethical Considerations

Law sets a floor; ethics asks what the organization owed the people whose data it held. Four principles help. Nonmaleficence, the duty to avoid harm, asks whether Anthem took reasonable steps to prevent a foreseeable injury; the regulatory findings suggest it did not. Justice asks how burdens are distributed, and the Module 4 analysis showed that members, especially those whose permanent identifiers were taken, bore lasting risk while receiving two years of protection. Fidelity concerns keeping faith with people who trusted the organization, including members of other Blue plans who never chose Anthem at all. Transparency is where Anthem acted best: it disclosed the attack publicly within about a week of discovering it and cooperated with law enforcement.

The AHIMA Code of Ethics asks health information professionals to protect the confidentiality and security of health information and to advocate for appropriate uses of it. For Anthem's information governance staff, that obligation raises a hard question: why was a data warehouse holding Social Security numbers for former members at all? Reports at the time noted that the data were not encrypted at rest, and Anthem responded that encryption would not have stopped attackers who used valid administrator credentials. Both points can be true. The deeper problem is that data kept without a current purpose can only create risk.

Recommendations

Kruse et al. (2017) concluded that health care has lagged other industries in cybersecurity while holding especially valuable data, so the recommendations aim to close specific gaps rather than add general awareness. Table 1 lists ten recommendations, each linked to a finding, an owner and a timeline.

Table 1. Recommendations With Owners and Timelines

Note. Recommendations developed by the author from the findings in Milestones One and Two.

Why These Recommendations

Several recommendations rest directly on evidence. Gordon et al. (2019) found that about one in seven simulated phishing emails at health care institutions was clicked, and that the likelihood of clicking fell with repeated campaigns, which supports recurring simulations rather than a single annual training module. Multifactor authentication and privileged access management address the fact that stolen credentials, not broken encryption, gave the attackers their reach. Data minimization addresses the ethical problem at its root: information that no longer exists cannot be stolen. Longer identity protection answers the justice concern by matching the protection to the length of the risk.

Implementing Without New Harm

Security changes can create their own problems. Choi et al. (2019) found that hospitals that had experienced breaches saw slower delivery of time-sensitive heart attack care in the following years, which the authors linked to new security procedures. For an insurer, rushed controls can delay claims, lock out providers or frustrate members. The recommendations are therefore phased over 18 months, tested with the staff who use the systems and paired with measures of their effect on service as well as on security.

Conclusion

Anthem's legal failures were failures of process: no enterprise risk analysis, weak monitoring, slow detection and broad access. Its ethical failures ran deeper, leaving lifelong risk with the people least able to control it and holding data no longer needed. The ten recommendations address both, and the final project will bring the summary, impacts and these recommendations together into one case analysis.

References

Choi, S. J., Johnson, M. E., & Lehmann, C. U. (2019). Data breach remediation efforts and their implications for hospital quality. Health Services Research, 54(5), 971-980. https://doi.org/10.1111/1475-6773.13203

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

Kruse, C. S., Frederick, B., Jacobson, T., & Monticone, D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care, 25(1), 1-10. https://doi.org/10.3233/THC-161263

McCoy, T. H., Jr., & Perlis, R. H. (2018). Temporal trends and characteristics of reportable health data breaches, 2010-2017. JAMA, 320(12), 1282-1284. https://doi.org/10.1001/jama.2018.9222