HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 6, 2016.
- Organization as reported
- Kaiser Foundation Healthplan, Inc. of Southern California, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Nov. 6, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14376, row:5515)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Kaiser Permanente (KP), reported that an error in its website configuration setting allowed some users to view the protected health information (PHI) of others. The breach affected approximately 3,044 individuals. The types of PHI involved included names, addresses, dates of birth, claims information, clinical information, financial information, medications prescribed, and other treatment information. In response to the breach, KP created a corrective action plan to help mitigate the chances of a misconfiguration error and retrained its staff. It also implemented additional administrative, technical and security safeguards. OCR provided KP with technical guidance regarding the Security Rule including risk analysis and risk management processes and procedures.