Kaiser Permanente Health Plan, Inc of Northern California

On October 12, 2016, Kaiser Permanente upgraded its website, kp.org, which resulted in an incorrect configuration setting for caching data. This website upgrade affected several covered entities (CEs), including Kaiser Permanente Health Plan of Northern California. As a result of the error, some users who logged into the website may have had some of the protected health information (PHI) they viewed online saved into the cache where it could be seen by other visitors to the webpage. Kaiser Permanente was alerted to the incident and took action to repair the error. The breach affected approximately 4,432 individuals participating with this CE. The types of PHI involved in the breach included financial, clinical and demographical information. The CE provided breach notification to HHS, affected individuals, and the media. It also provided substitute notice. In response to the breach, the CE created a corrective action plan to help mitigate the chances of a misconfiguration error by educating the relevant IT staff, creating new processes, ensuring sign offs and approvals at appropriate points in the process, testing an outcome before going live, and engaged a subject matter expert. OCR provided the CE with technical assistance regarding the HIPAA Security Rule including risk analysis and risk management.