Regulators Fine Kaiser Unit $200,000

The nation's largest nonprofit health insurer began a test program to make medical records of some of its members available electronically to physicians, and to give members access to their own records over the Internet.

But the Kaiser website in 1999 included confidential patient information, such as addresses, phone numbers and lab tests, that was available for public viewing. Oakland-based Kaiser did not remove the site until it was brought to the attention of federal authorities in January 2005, according to the California Department of Managed Health Care.

And Kaiser told patients about the medical records just three months ago, after it was reported in the media, the state said.

"Not only was this a grave security breach, Kaiser did not actively work to protect patients until after they had been caught," said Cindy Ehnes, director of the state agency. "We're imposing this fine because we consider this act to be irresponsible and negligent at the expense of members' privacy and piece of mind."

The $200,000 fine against Kaiser Foundation Health Plan is the largest the state has imposed against a health insurer for a breach of patient confidentiality violation, the agency said.

"It was an oversight and it will not happen again. We regret it," said Rick Malaspina, a spokesman for Kaiser in Northern California. "We've learned a lot from this."

Under state law, a health plan can be fined if it violates the confidentiality of medical information, without first obtaining the patient's authorization, state officials said. Kaiser Permanente, with 8.3 million members, reported first-quarter net income of $552 million on revenue of $7.7 billion.

A former Kaiser Web coordinator, Elisa D. Cooper, 35, first brought the security breach to the public's attention by posting links to the site on her blog. The Berkeley resident then notified civil rights authorities. Kaiser then sued her, accusing her of invasion of privacy and breaking a confidentiality agreement; that suit is still pending in Alameda County Superior Court. Cooper was let go by Kaiser in 2003.

"I'm glad to see this action," Cooper said Monday. "People don't understand this information was there for years."