Kaiser reports 13.4 million people affected by data breach
Patient and plan members' information was reportedly shared through tracking codes on its websites and apps.
Photo: Sundry Photography/Getty Images
Kaiser Foundation Health Plan has reported a data breach affecting over 13 million people.
Kaiser Permanente has determined that certain online technologies, previously installed on its websites and mobile applications, may have transmitted personal information to third-party vendors Google, Microsoft Bing, and X (Twitter) when members and patients accessed its websites or mobile applications, the health system said by statement.
Kaiser has begun notifying affected members and patients.
The information that may have been involved was limited to: IP address, name, information that could indicate a member or patient was signed into a Kaiser Permanente account or service, information showing how a member or patient interacted with and navigated through the website and mobile applications, and search terms used in the health encyclopedia. No usernames, passwords, Social Security numbers, financial account information, or credit card numbers were included in the transmission to these third parties.
"Nevertheless, out of an abundance of caution, we are informing approximately 13.4 million current and former members and patients who accessed our websites and mobile applications," Kaiser said. "We apologize that this incident occurred."
The Kaiser Foundation Health Plan reported the disclosure or unauthorized access to its network server in an April 12 filing with the Office for Civil Rights, Department of Health and Human Services. The notice was reportedly made public on Thursday.
Kaiser Permanente conducted a voluntary internal investigation into the use of these online technologies, and subsequently removed them from the websites and mobile applications. In addition, Kaiser Permanente has implemented additional measures with the guidance of experts designed to safeguard against recurrence of this type of incident.
WHY THIS MATTERS
Kaiser was required to report the potential breach to federal regulators and to notify those potentially affected.
The release of personal information was not due to bad actors hacking into the system demanding ransomware, as has often been the case for the increasing number of cybersecurity incidents at healthcare organizations.
Cybersecurity risk has become more of high profile issue since Change Healthcare reported a ransomware cyberattack on February 21.
This week MGMA has sent a letter to the OCR seeking clarity on whether providers or Change Healthcare are responsible for alerting affected patients that their personal health information may have been compromised.
The burden of HIPAA-required breach notifications should fall to Change, MGMA said.
THE LARGER TREND
An unwanted record was set in 2023 with 725 large security breaches in healthcare reported to the Department of Health and Human Services Office for Civil Rights, according to The HIPAA Journal. This beat the record of 720 healthcare security breaches set the previous year.
Email the writer: SMorse@himss.org
