Kaiser Permanente Northern California

Two former employees stole over 2,000 pieces of Clinical Technology ultrasound units and related parts over a period of years, from June 6, 2010, to May 19, 2016. The breach affected approximately 1,136 patients of the covered entity (CE), Kaiser Permanente Northern California and included names, internal medical record numbers, and ultrasound images. The CE provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. Following the breach, the CE reported the theft to the FBI. As a result of this incident, the CE trained staff on safeguarding PHI and proper decommissioning of medical equipment and established quality assurance monitoring processes and quarterly reviews to prevent a similar breach from occurring in the future. In addition, OCR provided the CE with technical assistance regarding its security management process.