Kaiser Discloses Health Insurance Data Breach

Health insurance company Kaiser is notifying millions of its current and former members about a data breach. The breach occurred when Kaiser shared patients’ information with third-party advertisers like Google, Microsoft, and X (formerly Twitter).

According to a press release, “The sensitive personal data of 13,400,000 current and former Kaiser customers has been compromised. Now, patients’ names, browsing habits and other information may be in the hands of criminals, putting victims at a greater risk of identity theft and other frauds.”

The investigation conducted by Kaiser discovered that certain online technologies installed on its websites and mobile applications transmitted personal information to these third-party vendors. The data shared included member names, IP addresses, and details indicating whether members were signed into a Kaiser Permanente account or service. Additionally, information about members’ interactions with the website and mobile apps, as well as search terms used in the health encyclopedia, were compromised.

To address the issue, Kaiser promptly removed the tracking code from its platforms. This incident adds Kaiser to the list of healthcare organizations that inadvertently shared patients’ personal information with advertisers through online tracking code.

Kaiser plans to notify approximately 13.4 million affected current and former members and patients who accessed its websites and mobile apps, starting in May. The company also filed a legally required notice with the U.S. government on April 12, disclosing the exposure of information of 13.4 million residents.

Under the health privacy law HIPAA, U.S. organizations must inform the Department of Health and Human Services of data breaches involving protected health information. Kaiser also notified California’s attorney general about the breach, although no further details were provided.

The Kaiser Foundation Health Plan, the parent organization of Kaiser Permanente, serves as one of the largest healthcare organizations in the United States. As of the end of 2023, it reported 12.5 million members. The breach at Kaiser stands as the largest confirmed health-related data breach of 2024 so far, according to the Department of Health and Human Services’ website.