Kaiser Foundation Health Plan

On September 18, 2017, a business associate (BA) completed a batch mailing of outreach letters on behalf of the covered entity (CE), Kaiser Foundation Health Plan. The CE subsequently received reports of patients receiving other patient's outreach letters. A review of the files used by the BA revealed that the addresses for the entire batch had been superimposed, resulting in 720 patients receiving a letter intended for another patient. The PHI breached included demographic information (patients’ names and addresses). The CE provided breach notification to HHS, affected individuals, and the media. In response to OCR’s investigation, the CE worked with the BA to ensure that secondary Quality Assurance checks by the BA against all source files are now in place, and added a manager from the CE to do final checks and sign-off on lists prior to letters being mailed. OCR obtained assurances that the CE implemented the corrective actions noted above.