AccidentalHealthcareHealthcareProgramming ErrorCustomer Data InvolvedData ExfiltratedPHIIdentity (basic)Health (basic)Financial accountLowResolved

Kaiser Foundation Hospitals

bd_0c98f04ac29362cd · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 28, 2016

Filed

Dec 20, 2016

To disclose

22 days

Affected

Not disclosed

Confidence

65%

Full breach record for Kaiser Foundation Hospitals →3 incidents on file

Kaiser Foundation Hospitals disclosed a system error in its online Estimates tool on kp.org. Between November 16 and 28, 2016, a software update caused a small chance that subsequent users could view previous users' protected health information, including name, age, address, and copay/deductible spending. The issue was discovered on November 28, 2016, and the update was immediately rolled back. No SSNs or banking details were exposed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 22 days

Nov 16, 2016

Begins

Nov 28, 2016

Discovered

Dec 20, 2016

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Kaiser Foundation Hospitals
norm: kaiser foundation hospitals
Domain: healthy.kaiserpermanente.org

Name: Kaiser Foundation Hospitals
norm: kaiser foundation hospitals
Domain: healthy.kaiserpermanente.org
Industry: Healthcarellm

Discovered: Nov 28, 2016
Breach occurred: Nov 16, 2016 – Nov 28, 2016
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)Financial account
Attack vector: Misconfiguration

During the incident: Immediately rolled back the update to keep similar errors from happening again
Corrected the problem with the Estimates tool upgrade
Reviewing our processes and procedures to help prevent errors like this in the future
Changes made: Reviewing our processes and procedures to help prevent errors like this in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-65536
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 20, 2016
Raw hash: b115b3e1df431c763497e3ea4f198c102629ff7f54fad586ea6127131753d6ac

Reporting entityKaiser Foundation Hospitals

Victim entityKaiser Foundation Hospitals

Incidentdiscovered Nov 28, 2016

Stated responseImmediately rolled back the update to keep similar errors from happening again

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov