HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Sept. 8, 2017.
- Organization as reported
- Kaiser Foundation Health Plan, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Sept. 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14066, row:5205)
- Archived copy
- Held in the private archive (provenance)
On September 8, 2017, the covered entity (CE), Kaiser Foundation Health Plan, discovered that a physician at its Riverside Medical Center scanned his daily schedule for dates of service between August 2014 to August 2017, which contained patient information including names, medical record numbers, and procedure types for 609 patients. The physician inadvertently e-mailed the information to an external gmail account that does not belong to the physician. Following the breach, the CE re-programed the device that was used to scan/email the document at issue so that it is no longer possible for an email to leave the CE's information technology network from the device. The CE provided notification to HHS, affected individuals, and the media pursuant to the Breach Notification Rule. Following the breach, the CE retrained the physician who mis-sent the PHI at issue in this breach. OCR obtained assurances that the CE implemented the corrective actions noted above.