kaiserfraud (![[info]](http://p-stat.livejournal.com/img/userinfo.gif){kind=small} corphq) wrote,@ 2003-05-06 23:30:00 |
|
Timeline of the Systems Diagrams Affair
June 2003: I was terminated from my job as a web coordinator for Kaiser's Northern California Technology Group. This had nothing to do with security, technology, whistleblowing, or even performance. I loved my job and was very good at it. I got along with everyone, and people came from other departments to see my work. The only problem was that I was assigned to a new manager after I was converted from a contractor to a full fime employee. This new manager was scheming against my former manager, and she kept probing for complaints and urging me to complain to the Director of the department. (More detailed account here). I tried to avoid getting involved, and she thus decided I was a "bad fit" and fired me as a total surprise. Kaiser HR destroyed all the evidence, and they gave me the run around for seven months to cover up for what she did.
July 2004: I found the Systems Diagrams on a public web site while doing research for a patient advocacy group. The Systems Diagrams were a vast collection of technical schematics for important Kaiser systems (what were then serving as the EMR in Northern California). These schematics included database names, IP addresses, computer code, and screenshots. I did not have anything to do with any of these systems when I worked for Kaiser. I thought this technical exposure was a HIPAA violation: I want to underscore that I never knew about the 150 Kaiser patient medical record numbers until Kaiser announced this to the press in March, 2005. The Internet Archive (Wayback Machine) showed they had been on the Internet for several years.
The only thing any of this has to do with the way I lost my job at Kaiser is that all my decisions have been strongly influenced by the fact Kaiser HR destroyed the evidence pertaining to my employment dispute: from that point on I assumed that Kaiser approaches all problems by destroying the evidence, and it was up to the person making a complaint to make every effort to preserve that evidence.
September 2004: After a month of reporting the Systems Diagrams everywhere I could find, I finally reported them to the right place: the Office of Civil Rights (U.S. Dept of Health and Human Services).
December 2004: The Office of Civil Rights (OCR) finally got back to me and asks me some questions.
January 2005: The OCR sent me a copy of a letter to Kaiser, which says all they've chosen to do is offer Kaiser HIPAA training. I complained about this on my blog since I couldn't believe Kaiser had just gotten away with posting technical diagrams on the Internet for years.
March 2005:
* I got a phone call from the Mercury News from a reporter that told me Kaiser had called 140+ patients to tell them that I had taken their patient information and was rampantly posting it on the Internet.
* At the same time I got a Cease and Desist Notice from Kaiser. This was Kaiser's response to the OCR complaint. Since Kaiser was lying about me stealing the patient info, I didn't know whether to believe them about the patient info. I hadn't seen anything like this in the Systems Diagrams (the info turned out to be a list of Kaiser Medical Record Numbers - Kaiser released the same thing themselves a few months later when they printed MRNs on magazines they sent out to patients). Anyway, since Kaiser was trying to frame me and they were trying to distract from the fact they posted the Systems Diagrams on the Internet, I posted on my blog that I was defying the Cease & Desist.
*However, I'd like to make it clear that I cut the links on my blog in response to the call from the reporter. These links were removed before Kaiser filed its lawsuit and before the DMHC got into it, so no one had to "stop" me. Everything that happened after this point was basically Kaiser's PR plan to make me look like a hacker and deflect attention from what they had done.
*Kaiser then filed a lawsuit, relying on the fact I was too poor to get a lawyer. Kaiser also told the CA Department of Managed Health Care (DMHC) that I was an imminent threat (invoking the stereotype of employee revenge theft), so the DMHC issued a public order (and a press release!) against me without doing an investigation first. This was all a coordinated PR attack on Kaiser's part. Between Kaiser's lawsuit and the DMHC's mistake, the media initially did Kaiser's bidding. NBC local news actually spliced an interview with me with new questions to make me look like a hacker/thief.
* At the first court hearing, the Judge didn't get my faxed filings. Therefore he only read Kaiser's side of the story before the hearing. Kaiser on the other hand was lying up and down the block to make it look like I stole the patient information, because they had no other basis for a breach of contract lawsuit (this was eventually thrown out a year later). If I had had a lawyer, this would have been tossed as a SLAPP suit. Repeating information found in the public domain is a common, even celebrated, Internet practice. (Here's one of many examples. And here's another one.)
* I discovered that the boss of the Kaiser lawyers produces the International HIPAA Summit, and Kaiser's propaganda is being spread to academics, government leaders, and other influential thinkers through conference presentations. I was blocked from contacting the presenters. I also found that the Director of the OCR was the keynote speaker at the conference!
April 2005:
* After I point out the evidence from the Internet Archive and dates on the Systems Diagrams that show they continued to be maintained long after I had lost my job at Kaiser, the DMHC realized its mistake. When I went to a pre-Hearing conference, they offered me a "settlement" in which they would revise the rewording of their original order. When I complained about the DMHC's press release, the Judge said this wasn't even on the table to discuss. Because I was trying to defend myself from Kaiser's lawsuit and the DMHC was making threats about what they'd put me through in the course of a Hearing, I agreed to their settlement just to get it over with. After I signed the settlement, the DMHC snuck some of their wording back in. When I complained, the DMHC said they could put in anything that hadn't been discussed, and to punish me for complaining they left their original order that spread lies about me up on their web site for many months. I have never been able to get any other State agency to investigate how the DMHC broke the settlement that I was pressured into in the first place. This entire situation was illegal because the DMHC had no jurisdiction over private citizens. The Governor's office told me to send all the evidence to the CA Bureau of State Audits, but they didn't do anything.
June 2005:
* The Office of Civil Rights got around to denying my request for whistleblower protection on the basis of the DMHC's original (false!) order against me. When I repeatedly wrote the contact person given in the OCR letter to point out the OCR made a mistake, she didn't reply.
* The DMHC finished their investigation and confirmed that Kaiser had posted the Systems Diagrams on the Internet, and they had been on the Internet since around 1999. The DMHC fined Kaiser $200,000. Since I didn't have a lawyer at that time, I couldn't get the information before the judge in Kaiser's lawsuit. The judge made use of something called tentative rulings, which allowed him to avoid giving me a hearing.
December 2005: The judge gives Kaiser an Injunction against me. While I have no wish to further post the Systems Diagrams, I'm appealing this judgment because it suggests I did something illegal, and it reinforces Kaiser's propaganda painting me as a hacker/thief/etc. This process will take many more months, and I have no money to put up much of a fight.
*****
This is a basic timeline of the Systems Diagrams Affair, and Kaiser's multi-pronged PR attack that was used to deflect public attention from what they did and display how they could punish whistleblowers. While Kaiser's actions are unsurprising, it was a real disappointment to see how easily they roped in the media and the relevant oversight agencies. I have yet to receive an apology from any involved. If anyone wants to help, I have a big list of people to write/call here.
June 2003: I was terminated from my job as a web coordinator for Kaiser's Northern California Technology Group. This had nothing to do with security, technology, whistleblowing, or even performance. I loved my job and was very good at it. I got along with everyone, and people came from other departments to see my work. The only problem was that I was assigned to a new manager after I was converted from a contractor to a full fime employee. This new manager was scheming against my former manager, and she kept probing for complaints and urging me to complain to the Director of the department. (More detailed account here). I tried to avoid getting involved, and she thus decided I was a "bad fit" and fired me as a total surprise. Kaiser HR destroyed all the evidence, and they gave me the run around for seven months to cover up for what she did.
July 2004: I found the Systems Diagrams on a public web site while doing research for a patient advocacy group. The Systems Diagrams were a vast collection of technical schematics for important Kaiser systems (what were then serving as the EMR in Northern California). These schematics included database names, IP addresses, computer code, and screenshots. I did not have anything to do with any of these systems when I worked for Kaiser. I thought this technical exposure was a HIPAA violation: I want to underscore that I never knew about the 150 Kaiser patient medical record numbers until Kaiser announced this to the press in March, 2005. The Internet Archive (Wayback Machine) showed they had been on the Internet for several years.
The only thing any of this has to do with the way I lost my job at Kaiser is that all my decisions have been strongly influenced by the fact Kaiser HR destroyed the evidence pertaining to my employment dispute: from that point on I assumed that Kaiser approaches all problems by destroying the evidence, and it was up to the person making a complaint to make every effort to preserve that evidence.
September 2004: After a month of reporting the Systems Diagrams everywhere I could find, I finally reported them to the right place: the Office of Civil Rights (U.S. Dept of Health and Human Services).
December 2004: The Office of Civil Rights (OCR) finally got back to me and asks me some questions.
January 2005: The OCR sent me a copy of a letter to Kaiser, which says all they've chosen to do is offer Kaiser HIPAA training. I complained about this on my blog since I couldn't believe Kaiser had just gotten away with posting technical diagrams on the Internet for years.
March 2005:
* I got a phone call from the Mercury News from a reporter that told me Kaiser had called 140+ patients to tell them that I had taken their patient information and was rampantly posting it on the Internet.
* At the same time I got a Cease and Desist Notice from Kaiser. This was Kaiser's response to the OCR complaint. Since Kaiser was lying about me stealing the patient info, I didn't know whether to believe them about the patient info. I hadn't seen anything like this in the Systems Diagrams (the info turned out to be a list of Kaiser Medical Record Numbers - Kaiser released the same thing themselves a few months later when they printed MRNs on magazines they sent out to patients). Anyway, since Kaiser was trying to frame me and they were trying to distract from the fact they posted the Systems Diagrams on the Internet, I posted on my blog that I was defying the Cease & Desist.
*However, I'd like to make it clear that I cut the links on my blog in response to the call from the reporter. These links were removed before Kaiser filed its lawsuit and before the DMHC got into it, so no one had to "stop" me. Everything that happened after this point was basically Kaiser's PR plan to make me look like a hacker and deflect attention from what they had done.
*Kaiser then filed a lawsuit, relying on the fact I was too poor to get a lawyer. Kaiser also told the CA Department of Managed Health Care (DMHC) that I was an imminent threat (invoking the stereotype of employee revenge theft), so the DMHC issued a public order (and a press release!) against me without doing an investigation first. This was all a coordinated PR attack on Kaiser's part. Between Kaiser's lawsuit and the DMHC's mistake, the media initially did Kaiser's bidding. NBC local news actually spliced an interview with me with new questions to make me look like a hacker/thief.
* At the first court hearing, the Judge didn't get my faxed filings. Therefore he only read Kaiser's side of the story before the hearing. Kaiser on the other hand was lying up and down the block to make it look like I stole the patient information, because they had no other basis for a breach of contract lawsuit (this was eventually thrown out a year later). If I had had a lawyer, this would have been tossed as a SLAPP suit. Repeating information found in the public domain is a common, even celebrated, Internet practice. (Here's one of many examples. And here's another one.)
* I discovered that the boss of the Kaiser lawyers produces the International HIPAA Summit, and Kaiser's propaganda is being spread to academics, government leaders, and other influential thinkers through conference presentations. I was blocked from contacting the presenters. I also found that the Director of the OCR was the keynote speaker at the conference!
April 2005:
* After I point out the evidence from the Internet Archive and dates on the Systems Diagrams that show they continued to be maintained long after I had lost my job at Kaiser, the DMHC realized its mistake. When I went to a pre-Hearing conference, they offered me a "settlement" in which they would revise the rewording of their original order. When I complained about the DMHC's press release, the Judge said this wasn't even on the table to discuss. Because I was trying to defend myself from Kaiser's lawsuit and the DMHC was making threats about what they'd put me through in the course of a Hearing, I agreed to their settlement just to get it over with. After I signed the settlement, the DMHC snuck some of their wording back in. When I complained, the DMHC said they could put in anything that hadn't been discussed, and to punish me for complaining they left their original order that spread lies about me up on their web site for many months. I have never been able to get any other State agency to investigate how the DMHC broke the settlement that I was pressured into in the first place. This entire situation was illegal because the DMHC had no jurisdiction over private citizens. The Governor's office told me to send all the evidence to the CA Bureau of State Audits, but they didn't do anything.
June 2005:
* The Office of Civil Rights got around to denying my request for whistleblower protection on the basis of the DMHC's original (false!) order against me. When I repeatedly wrote the contact person given in the OCR letter to point out the OCR made a mistake, she didn't reply.
* The DMHC finished their investigation and confirmed that Kaiser had posted the Systems Diagrams on the Internet, and they had been on the Internet since around 1999. The DMHC fined Kaiser $200,000. Since I didn't have a lawyer at that time, I couldn't get the information before the judge in Kaiser's lawsuit. The judge made use of something called tentative rulings, which allowed him to avoid giving me a hearing.
December 2005: The judge gives Kaiser an Injunction against me. While I have no wish to further post the Systems Diagrams, I'm appealing this judgment because it suggests I did something illegal, and it reinforces Kaiser's propaganda painting me as a hacker/thief/etc. This process will take many more months, and I have no money to put up much of a fight.
*****
This is a basic timeline of the Systems Diagrams Affair, and Kaiser's multi-pronged PR attack that was used to deflect public attention from what they did and display how they could punish whistleblowers. While Kaiser's actions are unsurprising, it was a real disappointment to see how easily they roped in the media and the relevant oversight agencies. I have yet to receive an apology from any involved. If anyone wants to help, I have a big list of people to write/call here.
