Kaiser Health Plan, Southern California
Disclosed Feb 6, 20206 years ago167,095 affectedConfirmed
The covered entity (CE), Kaiser Health Plan, Southern California, reported that an employee inadvertently mailed the protected health information (PHI) of 167,095 individuals to the wrong addresses. The PHI involved included names, addresses, birthdates, diagnoses, lab results, medications prescribed, and claims information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. A toll-free telephone number was established for questions or concerns. In its mitigation efforts, the CE implemented additional administrative safeguards and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.
What is known
| People affected | 167,095 (as reported to HHS) |
|---|---|
| Disclosed | Feb 6, 2020 |
| Happened | Oct 6, 2019 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Kaiser Health Plan, Southern Californiaoag.ca.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Kaiser Health Plan, Southern California (Health Plan, CA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Feb 6, 2020 | 167,095 |
| California AGresidents of CA | Feb 28, 2020 |
History of this record
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 167095 · backfill source
- 2026-09-25 · disclosed: 2020-02-28 to 2020-02-06 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Kaiser Health Plan, Southern California, reported that an employee inadvertently mailed the protected health information (PHI) of 167,095 individuals to the wrong addresses. The PHI involved included names, addresse · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.