Just recently, California Attorney General Kamala Harris filed
suit against Kaiser Foundation Health Plan, Inc.
("Kaiser") because of an alleged 2011 data privacy
incident. It seems as though a simple accident led to sensitive
data being accessed by unauthorized third parties, and ultimately
exposed Kaiser to legal and financial risk. In this case, an
external hard drive containing the sensitive personal information
of Kaiser's patients was sold to a retail thrift
shop.
The case alleges, among other things, that Kaiser failed
to notify the affected individuals timely under California's
data breach notification statute. While the outcome of this
particular case may be a year or more away, businesses which handle
regulated information such as HIPAA protected data
("HPI") or non-public personally identifiable information
("NPII") may be able to learn something from this fact
case. We recommend including the elow strategies for
mitigating risk in the area of data
