KAISER PERMANENTE GROUP TRUST

Kaiser Permanente notified members that a provider's email account containing protected health information was compromised by an unknown individual for approximately 13 hours on August 12, 2019. The incident was discovered on August 19, 2019. Affected data included names, medical record numbers, dates of service, diagnoses, and treatment details. Social Security numbers and financial information were not involved. Kaiser changed the account password and strengthened email security controls.

Kaiser Permanente (Oakland, CA) reported to HHS on 2019-09-26 a Hacking/IT Incident — email phishing scheme — affecting 990 individuals. An employee was the victim of a phishing attack that exposed ePHI including names, birthdates, gender, diagnoses, health insurance information, clinical information, and other treatment information. Breached information located in Email. The CE notified HHS, affected individuals, and the media, and implemented additional administrative, technical, and security safeguards. OCR provided technical assistance regarding the HIPAA Security Rule.

Affected (this filing): 990