The health system is settling a class action lawsuit after finding that data-tracking technology used on its websites and apps could have shared data with companies like Microsoft and Google.<\/p>\n
Kaiser Permanente<\/a> is paying a hefty price for gathering patient access data on its websites and apps.<\/p>\n The Oakland-based health system will pay at least $46 million and as much as $47.5 million to settle a class action lawsuit filed by several patients who said their information was caught up in KP\u2019s consumer-tracking programs, which can share data with Microsoft, Google, X (Twitter) and Adobe.<\/p>\n The practice is common with consumer-facing companies who want to know who\u2019s accessing their sites and why, and it\u2019s becoming more sophisticated as the technology evolves to enable companies to personalize those access points based on a user\u2019s preferences. According to a 2023 study published in Health Affairs<\/a>, almost every health system surveyed \u2013 99% — uses data tracking tools.<\/p>\n In healthcare, however, those user preferences may include personal health information, putting patient privacy at risk and leaving hospitals liable to legal action under HIPAA<\/a>.<\/p>\n The Health Insurance Portability and Accountability Act (HIPAA) doesn\u2019t specifically permit data transfers like this, so healthcare organizations either need to secure patient consent or a business associate agreement with the third-party vendors that receive that data. \u00a0<\/p>\n KP isn\u2019t the first health system to face charges over this. In 2023, New York Presbyterian Hospital settled a complaint<\/a> filed by the New York Attorney General and paid a $300,000 fine for exposing patient data through its use of data tracking technologies.<\/p>\n Federal regulators tried to get a handle on this a few years ago. In 2022, the Health and Human Services Department\u2019s (HHS) Office of Civil Rights issued guidance that would have prohibited organizations covered by HIPAA<\/a> from using \u201ctracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of HIPAA Rules.\u201d<\/p>\n The American Hospital Association and several other groups\u00a0filed suit against HHS in late 2023<\/a>, charging that the federal agency exceeded its statutory authority in preventing healthcare providers from collecting the IP addresses of people visiting public-facing websites. Last year, a federal district court in the Northern District of Texas ruled that the federal order \u201cwas\u00a0promulgated in clear excess of HHS\u2019s authority under HIPAA,\u201d\u00a0and HHS opted to drop the proposed rule.<\/p>\n As it stands now, healthcare organizations can use data tracking technology \u2013 but not on any sites that require a log-in, such as a patient portal or app.<\/p>\n