Kaiser Permanente agrees to $46M settlement over data incident affecting 13.4M people
Managed care group Kaiser Permanente has agreed to pay at least $46 million to resolve a class action lawsuit over its sharing of personal data and protected health information on 13.4 million patients with tech companies.
Law 360 was the first to report the news, shortly after a California federal judge granted approval for the agreement on November 25.
The lawsuit stems from Kaiser’s use of tracking cookies on its website, which gather information used to create advertising profiles on users. Third parties with an interest in serving up custom ads scoop up this data, which includes IP addresses and browsing history. In this case, it also included things like patient names, search queries on Kaiser’s website and possibly details on diagnosis, lab results and more that could be extracted from a patient portal login.
Kaiser has denied that the tracking technologies were used for any other purpose beyond marketing. Companies that had access to the data include Google, Microsoft, Meta, Twitter and possibly others.
Second-largest breach of 2024
Under federal law, this sharing constituted a data breach. As a result, Kaiser had to send notices to all victims and report the details to the U.S. Department of Health and Human Services Office for Civil Rights.
The incidents were made public in April 2024, with a lawsuit filed shortly after. If not for the February 2024 Change Healthcare ransomware attack, it would have been the largest data breach on record for the year.
Victims of the Change Healthcare cyberattack have been tallied at nearly 200 million.
Kaiser has denied it did anything wrong, but agreed to comply with federal laws and to settle the consolidated lawsuits in order to avoid a lengthy court battle.
The settlement is set to be finalized during a hearing scheduled for April 30, 2026. The amount could rise as high as $47.5 million, depending on how costly it is for Kaiser to meet the specific terms of the yet-to-be-disclosed agreement with lawyers representing victims.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.