Kaiser Permanente

This was not a hack. Kaiser installed the tracking code itself - pixels and analytics tags from Google, Microsoft Bing, X, Adobe and Quantum Metric - and left them running on authenticated pages, meaning a logged-in member searching the health encyclopedia for a specific diagnosis had that search, their IP address, their device and account-linked identifiers transmitted to advertising companies. 13.4 million people were affected, the largest confirmed healthcare breach involving website trackers to date, and reporting indicates the trackers were in place from roughly 2017 until Kaiser's own internal review caught them in October 2023. The settlement runs up to $47.5 million, of which counsel sought about $15.7 million - a third of the fund - so the per-member recovery is small relative to what was disclosed. The uncomfortable context: studies cited alongside this case put tracker use at roughly 99% of US hospital websites.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Case status. Private litigation; the legal tier of its sources has not been assigned yet.

Primary source. www.hipaajournal.com/kaiser-permanente-website-tracker-breach-affects-13-4-million-individuals/ — Verified - primary source confirmed.

Arbitration

Class members RELEASE any individual legal claims related to the tracking-technology conduct as part of accepting settlement payment — standard for a class settlement, but worth noting explicitly since it forecloses separate individual suits over the same underlying conduct.

Data sharing

DIRECTLY COVERS MARYLAND, VIRGINIA, AND DC MEMBERS: a consolidated class action (filed June 2023) alleged Kaiser Foundation Health Plan embedded THIRD-PARTY TRACKING CODE on its websites and mobile apps that transmitted confidential personal and health information WITHOUT MEMBER CONSENT to Google, Microsoft, Meta, and Twitter/X, between November 2017 and May 2024 — the same Meta/Google Pixel pattern documented repeatedly elsewhere in this tracker (Kroger, Costco, Chick-fil-A, BetterHelp), here applied at healthcare scale. Kaiser's own INTERNAL investigation confirmed up to 13.4 MILLION individuals were potentially affected — the SECOND-LARGEST healthcare data breach announced in 2024. Kaiser reached a settlement of $46 MILLION (potentially up to $47.5 million) covering members specifically in California, Colorado, Georgia, Hawaii, MARYLAND, Oregon, VIRGINIA, Washington, and the DISTRICT OF COLUMBIA — meaning this settlement directly covers the exact Mid-Atlantic region this tracker focuses on. Claims deadline was March 12, 2026; a final approval hearing was held May 7, 2026, and on July 14, 2026 Judge Edward M. Chen (N.D. Cal., No. 23-cv-02865-EMC) granted final approval, awarding class counsel $13 million in fees (they had sought 33% of the $47.5 million gross fund).

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.