HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 11, 2015.
- Organization as reported
- Courier Corporation of Hawaii, HI
- Entity type as reported
- Business Associate
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- Feb. 11, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14882, row:6021)
- Archived copy
- Held in the private archive (provenance)
Documents containing the protected health information (PHI) of 3,959 Kaiser Permanente patients, spilled onto the highway when the business associate (BA), Courier Corporation of Hawaii, transported the covered entity’s (CE) documents to storage. Many but not all of the documents were retrieved from the road. The types of PHI involved in the breach included names, addresses, dates of birth, driver’s license information, social security numbers, and other identifiers. The CE provided breach notification to HHS, affected individuals, and the media, and provided affected individuals with free credit monitoring. To prevent a similar breach from happening in the future, the CE and BA retrained staff on HIPAA requirements, revised policies and procedures, and sanctioned workforce members (including termination). The CE and BA also took steps to mitigate harm. As a result of OCR’s investigation, OCR obtained assurances that the notifications and corrective actions listed above were completed.