KAISER FOUNDATION HEALTH PLAN, INC.

Philips Respironics, Inc. notified Washington AG that an unauthorized party exploited a vulnerability in MOVEit Transfer software to access and exfiltrate files containing patient PII (name, address, DOB, email, phone, insurance ID) from a server on May 31, 2023. 17,530 Washington residents were affected. Notification was sent in June 2024.

Kaiser Foundation Health Plan, Inc. (CA) reported to HHS on 2024-04-12 an Unauthorized Access/Disclosure affecting up to 13,400,000 individuals. The CE disclosed PHI — including clinical, demographic, and financial information — while using third-party tracking technologies embedded in its authenticated online platforms. Location of breached information: Network Server. In response, Kaiser removed all third-party tracking technologies, retrained workforce members, and implemented additional administrative safeguards. The CE notified HHS, affected individuals, and the media.

Kaiser Permanente disclosed that cookies/pixels on its websites and apps may have transmitted member personal information (IP address, name, account status, navigation data, search terms) to third-party vendors Google, Microsoft Bing, and X (Twitter). Credentials, SSNs, and financial data were not involved. The technologies were removed following an internal investigation.

Kaiser Foundation Health Plan, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2024-04-12. 13,400,000 individuals were affected.

Kaiser Foundation Health Plan of the Mid-Atlantic States, Inc. reported to HHS on 2022-11-17 a Unauthorized Access/Disclosure affecting 8556 individuals. Breached information located on Electronic Medical Record.

Kaiser Permanente discovered on May 20, 2022, that an iPad containing photos of COVID-19 lab specimen labels was stolen from a locked storage area at the Los Angeles Medical Center. The photos potentially contained first name, last name, medical record number, date of birth, and date/location of service for affected individuals. No SSNs or credit card numbers were involved. The device was remotely wiped, and law enforcement was notified.

Kaiser Foundation Health Plan, Inc., Southern California reported to HHS on 2022-07-15 a Theft affecting 75,010 individuals. Breached information located on Other Portable Electronic Device. Data included PHI, SSNs, and financial info.

Kaiser Foundation Health Plan reported that a business associate exposed PHI (names and financial information) of 695 individuals by making the data viewable to others on a network server. The covered entity notified HHS, affected individuals, and the media, posted substitute notice, and implemented additional administrative and technical safeguards.

Kaiser Foundation Health Plan of the Mid-Atlantic States reported to HHS on 2020-05-22 a Unauthorized Access/Disclosure affecting 2756 individuals. Breached information located on Electronic Medical Record.

Kaiser Foundation Health Plan (Kaiser Permanente) reported to HHS on 2019-11-07 an Unauthorized Access/Disclosure affecting 515 individuals. Breached information located on Paper/Films. An employee sent PHI including names and health insurance information to the wrong recipients.

On October 9, 2017, Kaiser Foundation Health Plan inadvertently mailed a letter containing a member's protected health information (name and prescription medication) to another Kaiser Permanente member. The incident was reported to the California AG. No SSN, Medical Record Number, or financial information was disclosed. The incident was under review per Kaiser Permanente's policies.

Kaiser Foundation Health Plan, Inc. reported to HHS on 2017-12-22 a Unauthorized Access/Disclosure affecting 638 individuals. Breached information located on Paper/Films. The breach involved impermissible disclosure of PHI (names, medications) due to a mail merge quality assurance flaw.

Kaiser Foundation Health Plan, Inc. reported to HHS on 2017-12-14 a Hacking/IT Incident affecting 4389 individuals. Breached information located on Email. A physician's Outlook account was accessed using compromised credentials, exposing PHI including demographic, clinical, and claims data.

Kaiser Foundation Health Plan, Inc. reported that a Kaiser Permanente email system containing protected health information was compromised. The incident occurred on November 2, 2017, and was discovered on November 13, 2017. Affected data included names, medical record numbers, dates of service, diagnoses, and other PHI. Social Security numbers and financial information were not involved. Kaiser launched an investigation and notified government agencies.

Kaiser Foundation Health Plan reported to HHS on 2017-10-20 a Unauthorized Access/Disclosure affecting 720 individuals. Breached information located on Paper/Films. A business associate superimposed patient addresses during a batch mailing of outreach letters, resulting in 720 patients receiving letters intended for others. Demographic information (names and addresses) was exposed. Corrective actions included implementing secondary Quality Assurance checks and adding a CE manager for final sign-off.

Kaiser Foundation Health Plan, Inc. notified members that a letter intended for one member was inadvertently mailed to another. The letter referenced the Liver Care Program and contained the member's first and last name and medical record number. No financial data or other medical information was involved. The organization is reviewing internal processes to prevent recurrence.

Kaiser Foundation Health Plan reported to HHS on 2017-09-08 an Unauthorized Access/Disclosure affecting 609 individuals. Breached information located on Email. A physician inadvertently emailed patient PHI (names, MRNs, procedure types) to an external account.

On August 9, 2017, Kaiser Foundation Health Plan inadvertently emailed a document containing protected health information (name, medical record number, procedure, and date of service) to an unknown external email address. The incident was classified as an inadvertent error with no evidence of hacking or bad intent. Notification was sent on August 30, 2017.

On March 12, 2016, Kaiser Foundation Health Plan, Inc. (CA) discovered that a truck belonging to its business associate Postage One was stolen, and a pallet of printed 'evidence of coverage' booklets for Inland Empire Health Plan members was missing. The booklets contained names, addresses, and a generic overview of covered benefits for 2,451 individuals. Breach notification was submitted to HHS on 2016-04-22. Remediation included revised mail security policies and workforce training. Breached information located on Paper/Films.

Kaiser Foundation Health Plan of the Mid-Atlantic States, Inc. reported to HHS on 2015-01-29 a Unauthorized Access/Disclosure affecting 630 individuals. Breached information located on Paper/Films. Due to a printing error, patients received appointment reminders containing other patients’ protected health information (PHI), including names, medical record numbers, appointment types, and provider information. Additional safeguards were implemented to prevent future disclosures.

Kaiser Foundation Health Plan, Inc. disclosed that an employee accidentally emailed a file containing confidential member information to an unauthorized recipient on May 16, 2013. The file included names, medical record numbers, phone numbers, email addresses, employer details, and appointment times for a wellness screening pilot. The error was discovered in late July 2013. The recipient deleted the file and attested it was not viewed. No screening results were shared.

Kaiser Foundation Health Plan disclosed a breach of confidential employee information found on a non-Kaiser Permanente external hard drive purchased second-hand. The data included names, Social Security Numbers, dates of birth, and addresses. The breach was brought to attention in late September 2011. The investigation is ongoing. One year of credit monitoring is being provided.