Good News and Bad News About Incentives to Violate the Health Insurance Portability and Accountability Act (HIPAA): Scenario-Based Questionnaire Study

Abstract

Background The health care industry has more insider breaches than any other industry. Soon-to-be graduates are the trusted insiders of tomorrow, and their knowledge can be used to compromise organizational security systems. Objective The objective of this paper was to identify the role that monetary incentives play in violating the Health Insurance Portability and Accountability Act’s (HIPAA) regulations and privacy laws by the next generation of employees. The research model was developed using the economics of crime literature and rational choice theory. The primary research question was whether higher perceptions of being apprehended for violating HIPAA regulations were related to higher requirements for monetary incentives. Methods Five scenarios were developed to determine if monetary incentives could be used to influence subjects to illegally obtain health care information and to release that information to individuals and media outlets. The subjects were also asked about the probability of getting caught for violating HIPAA laws. Correlation analysis was used to determine whether higher perceptions of being apprehended for violating HIPAA regulations were related to higher requirements for monetary incentives. Results Many of the subjects believed there was a high probability of being caught. Nevertheless, many of them could be incentivized to violate HIPAA laws. In the nursing scenario, 45.9% (240/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, that is acceptable for violating HIPAA laws. In the doctors’ scenario, 35.4% (185/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, for violating HIPAA laws. In the insurance agent scenario, 45.1% (236/523) of the participants indicated that there is a price, ranging from US $1000 to over US $10 million, for violating HIPAA laws. When a personal context is involved, the percentages substantially increase. In the scenario where an experimental treatment for the subject’s mother is needed, which is not covered by insurance, 78.4% (410/523) of the participants would accept US $100,000 from a media outlet for the medical records of a politician. In the scenario where US $50,000 is needed to obtain medical records about a famous reality star to help a friend in need of emergency medical transportation, 64.6% (338/523) of the participants would accept the money. Conclusions A key finding of this study is that individuals perceiving a high probability of being caught are less likely to release private information. However, when the personal context involves a friend or family member, such as a mother, they will probably succumb to the incentive, regardless of the probability of being caught. The key to reducing noncompliance will be to implement organizational procedures and constantly monitor and develop educational and training programs to encourage HIPAA compliance.

Dark Traits and Hacking Potential

“…Individuals can be deterred, despite possible monetary gains, if the probability and severity of punishment are sufficiently high (Becker, 1968;Levitt, 2017). The market model assumes that offenders have expectations about returns, the potential for being caught, and the resulting punishment (Gaia et al 2020).…”

“…The probability of being apprehended construct was initially developed as part of another large study involving 523 subjects and was focused on the economics of crime (Gaia et al 2020). That study's objective was to identify the role of monetary incentives in violating HIPAA regulations and privacy laws in the next generation of employees.…”

“…As noted earlier, wrongdoers use a calculus of rational choice in determining whether to engage in criminal activity (Becker, 1968;Gaia, Wang, Yoo, & Sanders, 2020;Loughran et al, 2016). This calculus is affected by an individual's personality traits related to the probability of being caught.…”

“…This relationship did not hold for computer science students in the study. The real dilemma is that the probability of being apprehended and convicted is exceedingly small (Gaia et al, 2020). Between April 2003 and July 2018, 186,453 health information privacy complaints were submitted to the US Department of Health and Human Services.…”

“…However, the Department of Justice levied very few fines and jail sentences during that period. One security expert estimated that for every individual who gets caught, 10,000 people go free and for every individual prosecuted successfully, 100 go free or just receive a warning (Gaia et al, 2020).…”