KAISER FOUNDATION HEALTH PLAN, INC.

On August 9, 2017, Kaiser Foundation Health Plan inadvertently emailed a document containing protected health information (name, medical record number, procedure, and date of service) to an unknown external email address. The incident was classified as an inadvertent error with no evidence of hacking or bad intent. Notification was sent on August 30, 2017.

Kaiser Foundation Health Plan reported to HHS on 2017-10-20 a Unauthorized Access/Disclosure affecting 720 individuals. Breached information located on Paper/Films. A business associate superimposed patient addresses during a batch mailing of outreach letters, resulting in 720 patients receiving letters intended for others. Demographic information (names and addresses) was exposed. Corrective actions included implementing secondary Quality Assurance checks and adding a CE manager for final sign-off.

Affected (this filing): 720

Kaiser Foundation Health Plan, Inc. notified members that a letter intended for one member was inadvertently mailed to another. The letter referenced the Liver Care Program and contained the member's first and last name and medical record number. No financial data or other medical information was involved. The organization is reviewing internal processes to prevent recurrence.