Kaiser Health Plan, Southern California

The covered entity (CE), Kaiser Health Plan, Southern California, reported that an employee inadvertently mailed the protected health information (PHI) of 167,095 individuals to the wrong addresses. The PHI involved included names, addresses, birthdates, diagnoses, lab results, medications prescribed, and claims information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. A toll-free telephone number was established for questions or concerns. In its mitigation efforts, the CE implemented additional administrative safeguards and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.