Kaiser Foundation Health Plan, Inc.

Kaiser Foundation Health Plan (Kaiser), the covered entity (CE), reported that it had impermissibly disclosed protected health information (PHI) due to a flaw in its mail merge and quality assurance process. The breach affected 638 individuals. The PHI involved included names, medications prescribed, and health plan members. Following the breach, Kaiser strengthened its quality assurance process for mail merging and provided training on the revised process as well as refresher HIPAA training on protecting the privacy and security of PHI.