Aetna Secures HIPAA Learning Application

Imagine embarking on the development of a self-guided e-learning application with the knowledge that the user-to-support staff ratio will be 35,000 to one and you are the "one."

Donna Richmond, information security manager, Aetna (Hartford, $25.2 billion in assets), faced such a challenge when beginning development of the company's 2001 version of Aetna's Security Awareness e-Learning Exam. This was the third version of a program that is a requirement for all employees, and which has addressed a new security awareness issue annually since 1999. The 2001 version was slated to introduce Aetna's 35,000 employees to HIPAA (Health Insurance Portability and Accountability Act) regulations, as well as inform them of their security responsibilities.

Aetna decided it would develop the e-learning application with Human Performance Technologies (HPT, Farmington, CT) because it had worked with the vendor to develop past Security Awareness exams and was pleased with the results. In the fourth quarter of 2000, a team led by Aetna's Security Policy and Practices Organization developed the requirements for the system. It decided that the application would address HIPAA administrative simplification and privacy. It was also determined that the application that would be accessed via Aetna's intranet would be developed based on the following assumptions: Users would be utilizing a 486/66 MHz or higher processor, and a hard drive with at least 2MB of free space running in a Microsoft (Redmond, WA) Windows NT 4.0 environment.

Conveying the Message

HPT created a high-level design document based upon Aetna's requirements. According to Margaret Rueda, HPT's president, "this document becomes Human Performance Technology's bible. It outlines everything from course content objectives to technical specifications." Also during the first phase of development, which lasted for seven weeks, HPT developed the application's theme, "For Your Eyes Only." Graphically, the application would have the look of an eye doctor's office. During the first quarter of 2001 HPT created a prototype so that the For Your Eyes Only concept could be tested in Aetna's usability lab.

Aetna's usability testing facilities, explains Richmond, are equipped with a number of cameras, which are focused on a user's face, keyboard and screen during testing. These cameras allow Aetna to record changes in facial expressions that might indicate confusion or irritation, as well as the exact parts of the application that trigger these emotions. As it turned out, after reviewing the results of the testing it was determined that the For Your Eyes Only concept needed to be changed. During debriefing interviews all six Aetna employee testers were asked if they could connect the concept with the content and none of the six testers could. Aetna subsequently came up with the idea of "Operation HIPAA," which used graphics such as a prescription pad and had a medical feel. After the completion of phase one, the code for the application was delivered to Aetna information services personnel for installation. The code is linked to Aetna's database so that employees' course and exam completion activity can be tracked.

Phase two of development, which began in the spring of 2001, lasted three months. During this time the four remaining application topics and content were developed: HIPAA Privacy, Security is Good Business, Information Security Incident Reporting, and Electronic Communications. Testing in phase two focused on the content of the application's five modules.

The application went live in October 2001. At press time, Aetna had three weeks left until the program had to be completed and a 95 percent completion rate. Because the application is intuitive, according to Richmond, she receives few support calls. "Its no small accomplishment to make 35,000 people, A, do something and B, do it without irritating them so that there is actually a transfer of knowledge," says Richmond.

CASE STUDY CLOSEUP

COMPANY:

Aetna, Hartford, $25.2 billion in assets.

LINES OF BUSINESS:

Health, dental, vision, group life, disability and long-term care.

VENDOR/TECHNOLOGY:

Human Performance Technology (Farmington, CT), Microsoft (Redmond, WA) Windows NT.

CHALLENGE:

Develop an intuitive e-learning application for 35,000 users.