Kaiser Foundation Healthplan, Inc. of Southern California

The covered entity (CE), Kaiser Permanente (KP), reported that an error in its website configuration setting allowed some users to view the protected health information (PHI) of others. The breach affected approximately 3,044 individuals. The types of PHI involved included names, addresses, dates of birth, claims information, clinical information, financial information, medications prescribed, and other treatment information. In response to the breach, KP created a corrective action plan to help mitigate the chances of a misconfiguration error and retrained its staff. It also implemented additional administrative, technical and security safeguards. OCR provided KP with technical guidance regarding the Security Rule including risk analysis and risk management processes and procedures.