HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 7, 2016.
- Organization as reported
- Kaiser Permanente Health Plan, Inc of Northern California, CA
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Nov. 7, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14375, row:5514)
- Archived copy
- Held in the private archive (provenance)
On October 12, 2016, Kaiser Permanente upgraded its website, kp.org, which resulted in an incorrect configuration setting for caching data. This website upgrade affected several covered entities (CEs), including Kaiser Permanente Health Plan of Northern California. As a result of the error, some users who logged into the website may have had some of the protected health information (PHI) they viewed online saved into the cache where it could be seen by other visitors to the webpage. Kaiser Permanente was alerted to the incident and took action to repair the error. The breach affected approximately 4,432 individuals participating with this CE. The types of PHI involved in the breach included financial, clinical and demographical information. The CE provided breach notification to HHS, affected individuals, and the media. It also provided substitute notice. In response to the breach, the CE created a corrective action plan to help mitigate the chances of a misconfiguration error by educating the relevant IT staff, creating new processes, ensuring sign offs and approvals at appropriate points in the process, testing an outcome before going live, and engaged a subject matter expert. OCR provided the CE with technical assistance regarding the HIPAA Security Rule including risk analysis and risk management.