Kaiser settles class-action web tracking lawsuit for $46M

Kaiser Permanente agreed to pay $46 million to resolve a class action lawsuit surrounding its use of web tracking technology. Complainants alleged that Kaiser's use of tracking tech within its websites, mobile apps and patient portals led to the improper disclosure of personal information to third-party companies.

Lawsuits related to the use of third-party tracking technology have increased in healthcare in recent years.

This specific incident impacted Kaiser's insurance division, Kaiser Foundation Health Plan. Kaiser reported the 13.4-million-record breach to HHS in April 2024. At the time, the health plan stated that the breach may have transmitted data to third-party vendors, such as Google, Microsoft and X.

The impacted data included member names, IP addresses and information that revealed how members interacted with Kaiser's sites. Kaiser removed the tracking tools from its website and applications.

The incident was the second-largest breach reported to HHS in 2024, behind the Change Healthcare data breach.

Several complaints were filed against Kaiser in the aftermath of the breach and were later consolidated into one class action complaint.

The consolidated class action complaint alleged that Kaiser violated several state privacy laws and was negligent. Kaiser denied all the claims but proceeded with the settlement to avoid continued litigation.

Kaiser agreed to a $46 million preliminary settlement, which may be increased to up to $47.5 million, contingent upon the terms of a confidential supplemental agreement.  Final approval of the settlement will be granted following a fairness hearing on April 30, 2026.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.