Kaiser Permanente kaiserpermanente.org Kaiser Permanente data breach (2019): what happened and what to do
In August 2019 a Kaiser Permanente employee in Oakland, California, fell for an email phishing scheme. It exposed health information of 990 people, including names, birthdates, diagnoses and health insurance details.
View all 13,115 breaches- Breach date
- 12 Aug 2019
- Made public
- 26 Sept 2019
- Affected
- 990
- Last updated
What happened
In August 2019, an employee at Kaiser Permanente in Oakland, California, was the victim of an email phishing scheme. Phishing is a fake message designed to trick someone into handing over a login or opening something harmful. The employee's account gave an outsider a way to see electronic protected health information (ePHI) for 990 people.
Kaiser Permanente reported the incident to the U.S. Department of Health and Human Services (HHS), which lists it on its public breach portal. The breach is also tracked in California's attorney general breach list. The company notified the affected individuals and the media, as HIPAA requires for breaches of this kind.
What was exposed
HHS's case description says the information included names, birthdates, gender, diagnoses, health insurance information, clinical information and other treatment information. It does not mention Social Security numbers, payment cards or passwords.
That mix matters more than the headcount suggests. A name plus a birthdate is the starting point for most identity fraud. A diagnosis or treatment detail gives a scammer something to build a believable call or letter around, such as a fake billing notice from a clinic. Health insurance details can be used to file claims in your name, which is called medical identity theft, and it can take months to untangle from your records.
How it happened
The cause was a single employee's email account, not a break-in to Kaiser Permanente's systems at scale. That's a common pattern in health care: one convincing message to one busy person, and the attacker inherits whatever that mailbox could reach. If the email held patient information, so does the exposure.
What Kaiser Permanente did
According to HHS, Kaiser Permanente put additional administrative, technical and security safeguards in place to better protect electronic protected health information. HHS's Office for Civil Rights (OCR) gave the company technical assistance on the HIPAA Security Rule, the federal standard for how health data must be protected.
If you got a letter
If Kaiser Permanente sent you a notice about this incident, you were one of the 990 people. Treat the letter as real, but don't reply to any email or text that claims to be about it. Use the phone number or website printed in the letter instead.
Nothing in HHS's description says the data was published or sold. The practical risk is targeted scams and insurance misuse, so the steps below focus on those.
Why health data is different
A stolen password can be changed in a minute. A diagnosis, a birthdate and a list of treatments can't. Health information stays useful to a scammer for years, which is why HIPAA requires notification even for a breach of 990 people. It also means the scam attempts tied to it can arrive long after the incident, so keep the habit of verifying any health-related call or message through a number you already trust.
What to do if you were in it
- 1
Read your explanation of benefits
Every insurance statement should list only care you received. Call your insurer about any claim you don't recognize, and ask for a copy of your claims history once a year.
- 2
Expect phishing that mentions your care
Scammers who know a diagnosis or a provider's name will use it. Don't act on a call, text or email about a bill or test result. Hang up and call the number on your insurance card or the provider's own website.
- 3
Freeze your credit at all three bureaus
A freeze stops anyone from opening new credit in your name. It's free and takes about 10 minutes each at Equifax, Experian and TransUnion. You can lift it temporarily when you apply for credit yourself.
- 4
Ask your provider for a record of disclosures
Under HIPAA you can ask a provider for an accounting of who your information was disclosed to. It's the quickest way to see if anything in your file looks wrong.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data turns up, but it can't remove data that's already in a breach, so the alerts tell you what to change.
Frequently asked
Was I affected by the Kaiser Permanente breach?
HHS lists 990 people. Kaiser Permanente notified each of them directly, so a letter from the company about a phishing incident is the sign. If you haven't received one, you're most likely not among them.
What information was exposed?
Names, birthdates, gender, diagnoses, health insurance information, clinical information and other treatment information, according to HHS's description of the case.
Was my Social Security number exposed?
HHS's description doesn't list Social Security numbers. Check the notice you received for the exact items in your case.
Do I need to change my password?
The description doesn't mention member passwords. Changing your Kaiser Permanente password and turning on two-factor authentication is still a cheap precaution.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
