HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 20, 2017.
- Organization as reported
- Kaiser Foundation Health Plan, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 20, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14024, row:5163)
- Archived copy
- Held in the private archive (provenance)
On September 18, 2017, a business associate (BA) completed a batch mailing of outreach letters on behalf of the covered entity (CE), Kaiser Foundation Health Plan. The CE subsequently received reports of patients receiving other patient's outreach letters. A review of the files used by the BA revealed that the addresses for the entire batch had been superimposed, resulting in 720 patients receiving a letter intended for another patient. The PHI breached included demographic information (patients’ names and addresses). The CE provided breach notification to HHS, affected individuals, and the media. In response to OCR’s investigation, the CE worked with the BA to ensure that secondary Quality Assurance checks by the BA against all source files are now in place, and added a manager from the CE to do final checks and sign-off on lists prior to letters being mailed. OCR obtained assurances that the CE implemented the corrective actions noted above.