Kaiser Foundation Health Plan, Inc.

On December 14, 2017, the covered entity (CE) reported that on November 2, 2017, a physician’s Outlook email account was accessed by unknown parties that used the physician's compromised login credentials. The breach potentially affected the protected health information (PHI) of approximately 4,389 individuals, including demographic, clinical, and health claims/account information. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. The CE revised its policies and procedures specific to the allegations of the breach. OCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.