Kaiser Permanente Northern California Division of Research

Kaiser Permanente Northern CA Department of Research notified California regulators of a cybersecurity incident involving a research server infected with malicious software between October 2011 and February 2014. The breach potentially exposed patient research data including names, dates of birth, and medical record numbers, though SSNs were excluded. No unauthorized access was confirmed, but the server was removed and authorities alerted.

Kaiser Permanente Northern California Division of Research reported a breach affecting 5,178 individuals after a malware infection on a computer server. Compromised ePHI included names, dates of birth, gender, address, race/ethnicity, medical record numbers, lab results, and research questionnaire responses. The entity notified HHS, affected individuals, and the media, conducted a security analysis, revised policies, and trained workforce members. OCR provided technical assistance on the HIPAA Security Rule.

Affected (this filing): 5,178