MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Kaiser Foundation Hospitals, Northern California

bd_2c298c8bd0d24abf · schema v1 · pii pii-v1

Severity

Low

Discovered

May 16, 2024

Filed

Jul 15, 2024

To disclose

9 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

67%

Full breach record for Kaiser Foundation Hospitals, Northern California →

Kaiser Permanente Northern California reported that a workforce member inappropriately accessed patient medical records without a reasonable basis. The incident was discovered on May 16, 2024. Affected data included demographic information (name, address, email, phone, DOB, medical record number) and medical information. Social Security numbers and financial information were not involved. Access was removed and an investigation was launched.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

May 16, 2024

Discovered

Jul 15, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_7555c4fb887800542024-07-15Verified by operator

Name: Kaiser Foundation Hospitals, Northern California
norm: kaiser foundation hospitals northern california
Domain: kp.org

Name: Kaiser Foundation Hospitals, Northern California
norm: kaiser foundation hospitals northern california
Domain: kp.org
Industry: Healthcarellm

Discovered: May 16, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Insider
Threat actor: Internal
Regulator citations: Reporting these facts to federal and state agencies
Initial access: insider_action

During the incident: Promptly began an investigation
Removed access to the medical record system
Acted to prevent further occurrences
Will take appropriate action against the workforce member responsible
Changes made: Reviewing policies and procedures governing access to patients’ medical records to determine whether additional safeguards are needed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJul 15 · first

California State AGJul 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-588624
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2024
Raw hash: a54b620a0f419b3c2685c46b1c8d7cd906ebef85621ea0a557ec14f8fd3fd0f8

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKaiser Foundation Hospitals, Northern California

Victim entityKaiser Foundation Hospitals, Northern California

Incidentdiscovered May 16, 2024

Stated responsePromptly began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov