Ethics Related to the HIPAA Privacy Rule Assignment 2022

Running Head: ETHICS RELATED TO THE HIPAA PRIVACY RULE 1
Ethics Related to the HIPAA Privacy Rule
Name
Institution

ETHICS RELATED TO THE HIPAA PRIVACY RULE 2
Ethics Related to the HIPAA Privacy Rule
The nature of the health sector is that a sufficient flow of health information is necessary
for ensuring quality health care. However, this raises a serious ethical concern regarding
individual privacy. It is for this reason that the HIPAA privacy rule was established. According
to HHS.gov (2019), the regulations set parameters as to how individual health information can be
used and disclosed by various entities in the health sector. The OCR( Office of civil rights) in the
Health and Human Services department is responsible for enforcing and investigating breaches
to the HIPAA privacy rules. Over the years, the OCR has investigated and settled multiple cases
involving the exposure of protected health information. One such case involved Anthem Inc., a
major health insurance firm in the USA. However, typical of such cases, various ethical biases
and legal implications exist. Thus, this paper will analyze the various elements of the case.
Case Background
In 2015, Anthem Inc. was hit by a cyberattack series that led to the exposure of
electronically protected health information. According to McGee (2018), this incident is
considered the biggest data breach in history, whereby 79 million individuals were affected.
Investigations indicated that cyberattackers gained accessed to Anthem Inc.’s IT system and
continuously extracted individual health information across two months. Details obtained
included personal information such as names, medical identification numbers, social security
numbers, addresses, emails, and employment information (McGee, 2018). The primary way that
the attackers accessed the system was by sending phishing emails to employees belonging to
Anthem Inc,’s subsidiary. One employee made a response to the email leading to the attack.

ETHICS RELATED TO THE HIPAA PRIVACY RULE 3
OCR’s investigation revealed that Anthem failed to safeguard private information in
many ways. First, Anthem did not carry out an enterprisewide analysis of risk (McGee, 2018).
Also, the firm did not put in place minimum access controls that would prevent the access of
sensitive private health information by the attackers. Another failure by Anthem was the lack of
sufficient procedures for reviewing activity in its information system. It is this aspect that led to
the lack of detection of the cyberattacks, which continuously happened across two months.
Consequently, Anthem was found guilty of a data breach and was fined $16 million.
Notably, as per McGee (2018), this was the biggest ever fine issued for HIPAA regulations. Such
a settlement decision indicates the degree of seriousness by OCR in regards to HIPAA rules
enforcement. For example, in this case, the biggest data breach was settled with the biggest civil
monetary penalty. Thus, this decision shows the legal liability faced by firms who are negligent
on privacy rules. Firms that show negligence in the protection of private information face the risk
of substantial financial penalties if such events occur. Therefore, responsible health entities need
to ensure that they follow HIPAA rules in enhancing health data privacy.
Biases related to this case.
The biases related to this case stem from two aspects. First is that the disclosure of
protected information was carried out by an external agent. Anthem Inc. did not intentionally
disclose protected data. Instead, the disclosure was done through a cyberattack conducted in the
firm’s IT system by malicious individuals. However, despite this fact, Anthem Inc had to bear
full responsibility for the incident. This is without putting into consideration that these were
actions by external attackers. As McGee (2018) points, there is less information in regards to the
perpetrators. It is not known who the perpetrators were, why they accessed the private
information and their origin.