KAISER FOUNDATION HEALTH PLAN, INC.

Kaiser Foundation Health Plan, Inc. reported a data breach affecting its email system containing protected health information (PHI). The incident, discovered on November 13, 2017, involved unauthorized access to patient records including names, medical record numbers, diagnoses, and dates of birth. No Social Security numbers or financial information were compromised. Kaiser launched an investigation and notified government agencies.

Kaiser Foundation Health Plan, Inc. reported to HHS on 2017-12-14 a Hacking/IT Incident affecting 4389 individuals. Breached information located on Email. A physician's Outlook account was accessed using compromised credentials, exposing PHI including demographic, clinical, and claims data.

Affected (this filing): 4,389

Kaiser Foundation Health Plan, Inc. reported to HHS on 2017-12-22 a Unauthorized Access/Disclosure affecting 638 individuals. Breached information located on Paper/Films. The breach involved impermissible disclosure of PHI (names, medications) due to a mail merge quality assurance flaw.

Affected (this filing): 638

On October 9, 2017, Kaiser Foundation Health Plan inadvertently mailed a letter containing a member's protected health information (name and prescription medication) to another Kaiser Permanente member. The incident was reported to the California AG. No SSN, Medical Record Number, or financial information was disclosed. The incident was under review per Kaiser Permanente's policies.