Kaiser Permanente Health Plan, Inc of Northern California

Kaiser Permanente Health Plan, Inc of Northern California disclosed a misconfiguration error on kp.org during a website upgrade on October 12, 2016. For approximately two hours, protected health information (PHI) viewed by signed-in members may have been mistakenly visible to other visitors. The error was repaired by 1:43 a.m. on October 13, 2016. No Social Security numbers or banking information were disclosed. The organization is updating testing procedures for website updates.

Kaiser Permanente Northern California reported the theft of ultrasound machines containing Protected Health Information (PHI) and Member Reference Numbers (MRN). Two employees stole equipment from multiple sites between 2010 and 2016. The incident was reported to law enforcement. No financial information or SSNs were involved.

Two former employees of Kaiser Permanente Northern California stole over 2,000 pieces of clinical technology ultrasound units and related parts between June 6, 2010, and May 19, 2016. The breach affected approximately 1,136 patients and included names, internal medical record numbers, and ultrasound images. The entity notified HHS, affected individuals, and the media, and also reported the theft to the FBI. In response, the company trained staff on safeguarding protected health information (PHI) and proper equipment decommissioning, and established new quality assurance processes. The HHS Office for Civil Rights (OCR) provided technical assistance regarding the entity's security management process.