Kaiser Permanente Settles $46M Over Unauthorized Sharing of Patient Data U.S. healthcare provider Kaiser Permanente has agreed to a $46 million settlement following allegations that it shared sensitive patient data with third-party companies, including Google, Microsoft, Meta, and X, without consent. The settlement stems from multiple lawsuits filed in April and May 2024, which were consolidated into a class-action case. Between November 2017 and May 2024, Kaiser’s websites and mobile apps allegedly used tracking code from services like Google Analytics and Meta Pixel, inadvertently transmitting members’ personal and health information such as IP addresses, names, search terms, medical histories, and communications with healthcare providers to these tech firms. While Kaiser denies wrongdoing and asserts no evidence of data misuse, the company opted to settle to avoid prolonged litigation. The settlement covers approximately 13 million current and former Kaiser members in California, Colorado, Georgia, Hawaii, Maryland, Oregon, Virginia, Washington, and Washington, D.C. Eligible individuals have until March 12, 2026, to file a claim, with payments expected to range between $20 and $40 per person. The final court approval hearing is scheduled for May 7, 2025, after which payments will be distributed. Kaiser removed the tracking code in 2024 and implemented additional security measures to prevent future incidents. While Social Security numbers and other highly sensitive data were not exposed, the breach highlights risks associated with third-party tracking tools in healthcare.

The California Office of the Attorney General reported that Kaiser Foundation Health Plan, Inc. experienced a data breach on October 9, 2017. The breach involved the inadvertent mailing of protected health information to another member. Approximately one affected individual was identified, and the information disclosed included the individual's name and prescription medication. A breach notification letter was also available.

On September 21, 2017, Kaiser Permanente Health Plan experienced a data breach reported by the California Office of the Attorney General on October 20, 2017. The incident involved an operational error where personal health information intended for one member was inadvertently mailed to another member. The exposed data included member names and medical record numbers, but no financial information or extensive medical details were compromised. The breach was limited to a misdirection of physical mail, resulting in unauthorized access to basic personal and health identifiers. While the incident did not involve cybercriminal activity, malicious intent, or large-scale data exposure, it still posed a risk of privacy violations for the affected individuals. Kaiser Permanente likely took corrective measures to prevent similar errors in the future, including reviewing mailing protocols and reinforcing data handling procedures. The breach highlights the importance of safeguarding even seemingly low-sensitivity information, as improper disclosure can erode trust and potentially lead to identity-related risks.

The California Office of the Attorney General reported that Kaiser Foundation Health Plan, Inc. experienced a data breach on May 16, 2013. An employee accidentally emailed confidential member information, including personal details, to an unauthorized recipient. The breach was reported on September 11, 2013.

The California Office of the Attorney General reported that Kaiser Foundation Health Plan experienced a data breach on September 26, 2011, affecting confidential employee information, including names, Social Security Numbers, Dates of Birth, and addresses. The breach was reported on March 16, 2012.