Received May 14, 2024 (via email)
NOTICE OF DATA BREACH
Dear BARBARA,
On behalf of Kaiser Permanente, I am writing to inform you about a privacy matter that may have affected you.
What Happened?
On October 25, 2023, Kaiser Permanente determined that certain online technologies (commonly known as cookies or pixels) installed on our websites and mobile applications may have transmitted personal information to our third-party vendors Google, Microsoft Bing, and X (Twitter) when members and patients accessed our websites or mobile applications. These technologies are sometimes used by organizations to understand how consumers interact with websites and mobile applications. We apologize that this incident occurred.
What Information was Involved?
The information that may have been involved was limited to: IP address, name, information that could indicate you were signed into a Kaiser Permanente account or service, information showing how you interacted with and navigated through our website or mobile applications, and search terms used in the health encyclopedia. Detailed information concerning Kaiser Permanente account credentials (username and password), Social Security numbers, financial account information and credit card numbers were not included in the information involved.
What We Are Doing:
We conducted a voluntary internal investigation into the use of these online technologies, and subsequently removed these online technologies from our websites and mobile applications. In addition, Kaiser Permanente has implemented additional measures with the guidance of experts to safeguard against recurrence of this type of incident.
What You Can Do:
Kaiser Permanente is not aware of any misuse of your information. Your Kaiser Permanente account credentials (username and password), Social Security number, financial account information, and credit card number were not involved in this incident. Regardless, it is always advisable to remain vigilant against attempts at identity theft or fraud, which includes reviewing online and financial accounts, credit reports, and Explanations of Benefits for suspicious activity. This is a best practice for all individuals.
There is no evidence that your information has been misused. If you are concerned about identity theft and would like more information on ways to protect yourself, visit the Federal Trade Commission’s Identity Theft website at https://www.identitytheft.gov.
For More Information:
We assure you that safeguarding your information is one of our highest priorities. If you have any questions or concerns about this notice, please call 866-528-9259, Monday through Friday, between the hours of 7:00 a.m. to 7:00 p.m. Central Standard Time, excluding holidays.
Sincerely,
_________________
Kaiser Foundation Health Plan, Inc.
Ethics and Compliance
One Kaiser Plaza, 19th Floor, Oakland, CA 94612
_________________
Allow me to walk through this email:
• It took Kaiser approximately 7 months to notify me. Is this how long it takes to get their floor full of lawyers to agree on how not to get sued by a patient who might also be a lawyer? Clearly, my online security was not top of mind.
• Third-party vendors of Bing, Google, etc. are quite honorable companies to trust with patient information. Not that they would sell it off!
• I’m sure Google and the gang were very careful not to capture anything Kaiser said not to. What planet is Kaiser living on – oh, yes – planet money.
• So, let’s say, a patient goes online and searches in Kaiser’s health encyclopedia for constipation, sexual dysfunction, or bedwetting. This is now the property of Google, etc. to do with as they choose – send you ads, monitor your interests, or have a good laugh as they comb through Kaiser’s websites?
• The guidance of experts – that floor full of lawyers? Or the same people who thought giving patient info over to the “gang” was a good idea in the first place?
• And what can I do? Why should I have to do anything? Some kind of trust – unfortunately, yet another one – has been tossed onto the heap. It’s bad enough when Kaiser calls five times to get me to come in for my 10-minute wellness exam (which is also all about the money).
• Have you ever been to the Federal Trade Commission’s Identity Theft Website? Got a couple of hours?
• How much did Kaiser get paid to share my name, IP address, and health questions (if that’s all)?
• Sincerely? I don’t blame my pen-pal, I wouldn’t want my name on this letter either.
Not only am I member of Kaiser (not many choices where I live) but several decades ago I worked in their Oakland Tower for one horrifying season in their national accounts division. It was annual renewal time – what an experience that was. So, I say with some amount of authority, there really is a floor full of lawyers. And when I and others say “profits over patients” this is what we mean!
This is from Kaiser’s current website. I leave you to decide…
Underpinning Kaiser Permanente’s electronic health record systems are internal policies and protocols that reflect a robust, consistent, transparent data privacy approach. We use a comprehensive approach to data security to enable strong privacy protections. We advocate for policies that support the secure use of patient information for the intended purpose of delivering high-quality health care.
8 of 10 Americans think the risks of companies collecting data about them outweigh the benefits
Half of adults are extremely or very concerned about their health care data security
81% of the top depression and smoking cessation apps sent data to Google for Facebook
Photo by Tech Daily on Unsplash