Correction: Good News and Bad News About Incentives to Violate the Health Insurance Portability and Accountability Act (HIPAA): Scenario-Based Questionnaire Study.

[This corrects the article DOI: 10.2196/15880.].

Good News and Bad News About Incentives to Violate the Health Insurance Portability and Accountability Act (HIPAA): Scenario-Based Questionnaire Study.

BACKGROUND: The health care industry has more insider breaches than any other industry. Soon-to-be graduates are the trusted insiders of tomorrow, and their knowledge can be used to compromise organizational security systems. OBJECTIVE: The objective of this paper was to identify the role that monetary incentives play in violating the Health Insurance Portability and Accountability Act's (HIPAA) regulations and privacy laws by the next generation of employees. The research model was developed using the economics of crime literature and rational choice theory. The primary research question was whether higher perceptions of being apprehended for violating HIPAA regulations were related to higher requirements for monetary incentives. METHODS: Five scenarios were developed to determine if monetary incentives could be used to influence subjects to illegally obtain health care information and to release that information to individuals and media outlets. The subjects were also asked about the probability of getting caught for violating HIPAA laws. Correlation analysis was used to determine whether higher perceptions of being apprehended for violating HIPAA regulations were related to higher requirements for monetary incentives. RESULTS: Many of the subjects believed there was a high probability of being caught. Nevertheless, many of them could be incentivized to violate HIPAA laws. In the nursing scenario, 45.9% (240/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, that is acceptable for violating HIPAA laws. In the doctors' scenario, 35.4% (185/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, for violating HIPAA laws. In the insurance agent scenario, 45.1% (236/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, for violating HIPAA laws. When a personal context is involved, the percentages substantially increase. In the scenario where an experimental treatment for the subject's mother is needed, which is not covered by insurance, 78.4% (410/523) of the participants would accept US $100,000 from a media outlet for the medical records of a politician. In the scenario where US $50,000 is needed to obtain medical records about a famous reality star to help a friend in need of emergency medical transportation, 64.6% (338/523) of the participants would accept the money. CONCLUSIONS: A key finding of this study is that individuals perceiving a high probability of being caught are less likely to release private information. However, when the personal context involves a friend or family member, such as a mother, they will probably succumb to the incentive, regardless of the probability of being caught. The key to reducing noncompliance will be to implement organizational procedures and constantly monitor and develop educational and training programs to encourage HIPAA compliance.

Putting the Focus Back on the Patient: How Privacy Concerns Affect Personal Health Information Sharing Intentions.

BACKGROUND: Health care providers are driven by greater participation and systemic cost savings irrespective of benefits to individual patients derived from sharing Personal Health Information (PHI). Protecting PHI is a critical issue in the sharing of health care information systems; yet, there is very little literature examining the topic of sharing PHI electronically. A good overview of the regulatory, privacy, and societal barriers to sharing PHI can be found in the 2009 Health Information Technology for Economic and Clinical Health Act. OBJECTIVE: This study investigated the factors that influence individuals' intentions to share their PHI electronically with health care providers, creating an understanding of how we can represent a patient's interests more accurately in sharing settings, instead of treating patients like predetermined subjects. Unlike privacy concern and trust, patient activation is a stable trait that is not subject to change in the short term and, thus, is a useful factor in predicting sharing behavior. We apply the extended privacy model in the health information sharing context and adapt this model to include patient activation and issue involvement to predict individuals' intentions. METHODS: This was a survey-based study with 1600+ participants using the Health Information National Trends Survey (HINTS) data to validate a model through various statistical techniques. The research method included an assessment of both the measurement and structural models with post hoc analysis. RESULTS: We find that privacy concern has the most influence on individuals' intentions to share. Patient activation, issue involvement, and patient-physician relationship are significant predictors of sharing intention. We contribute to theory by introducing patient activation and issue involvement as proxies for personal interest factors in the health care context. CONCLUSIONS: Overall, this study found that although patients are open to sharing their PHI, they still have concerns over the privacy of their PHI during the sharing process. It is paramount to address this factor to increase information flow and identify how patients can assure that their privacy is protected. The outcome of this study is a set of recommendations for motivating the sharing of PHI. The goal of this research is to increase the health profile of the patients by integrating the testing and diagnoses of various doctors across health care providers and, thus, bring patients closer to the physicians.