Kaiser reports 13.4 million people affected by data breach

Kaiser Foundation Health Plan has reported a data breach affecting over 13 million people.

Kaiser Permanente has determined that certain online technologies, previously installed on its websites and mobile apps, may have transmitted personal information to third-party vendors when members & patients accessed its websites or mobile applications.

The information that may have been involved was limited to: IP address, name, information that could indicate a member or patient was signed into a Kaiser Permanente account or service, information showing how a member or patient interacted with and navigated through the website and mobile applications, and search terms used in the health encyclopedia. No usernames, passwords, Social Security numbers, financial account information, or credit card numbers were included in the transmission to these third parties. 

A record was set in 2023 with 725 large security breaches in healthcare, according to The HIPAA Journal.

“A breach like this happens for one reason only – because healthcare executives and their employees don’t understand basic digital concepts such as how web cookies work to collect site visitor data. We’ve known this is a problem for healthcare organizations for several years now, and yet Kaiser leadership chose not to make this a priority and their delays have cost patients their privacy,” says DoorSpace CEO Sarah M. Worthy.

This recent healthcare data breach is yet another example that highlights the urgent need for healthcare organizations to skill-up their executives and to mandate cybersecurity training across their organizations.

“Hospital CEOs need to understand that digital technologies don’t simply put their current processes and data into a cloud based environment and everything else remains ‘business as usual.’ Digital tech requires CEOs to upskill to become data-centric in their operational strategies and focus. Otherwise, we will continue to see big data problems plague the healthcare industry at the cost of billions of dollars and patient safety and well being,” Worthy states.

The data breach reported by Kaiser Foundation Health Plan is particularly alarming due to the vast number of individuals affected. The integration of digital technologies increases the vulnerability to data security threats. Kaiser Permanente’s incident involved unauthorized data access through online technologies that were meant to enhance user experience but inadvertently exposed personal information. Breaches primarily include sensitive data such as names, addresses, medical record numbers, and possibly other highly personal and sensitive health information, which could have severe implications for the privacy and security of potentially millions of patients.

This breach illuminates the challenges healthcare organizations face in protecting patient information amid increasing reliance on digital platforms for service delivery. As healthcare providers continue to adopt more sophisticated technology solutions to improve patient engagement and streamline operations, the risk of such breaches may increase unless stringent cybersecurity measures are implemented. The breach at Kaiser Permanente could push the healthcare sector to re-evaluate the security protocols around third-party vendors and the technologies used on platforms that handle sensitive patient information. There’s a critical need for robust security frameworks that can shield against both direct cyber-attacks and inadvertent data leaks through third-party services.

The record-setting number of large security breaches in healthcare reported in 2023 serves as a stark reminder of the persisting threats facing the industry. The HIPAA Journal’s findings indicate that healthcare entities must prioritize data security to protect against the reputational damage, legal ramifications, and the trust deficit that inevitably follow such incidents. Moving forward, the healthcare sector might need to consider more proactive measures, including advanced real-time monitoring systems, regular audits, and stricter compliance checks with technology vendors to ensure that patient data is securely managed and protected. These steps are essential to safeguard sensitive health information in an era where digital health services are becoming the norm rather than the exception.