Website Tracking Tools and HIPAA: Lessons From the Kaiser Notice
Last updated:
Kaiser Permanente notified about 13.4 million members that online technologies on its website and mobile apps may have sent some personal information to third-party vendors, including Google, Microsoft Bing and X. Kaiser said passwords, Social Security numbers and payment information were not involved, and the incident was listed on the Department of Health and Human Services breach portal. You do not have to be a health system for this to matter: a small clinic website can have the same kind of problem.
What went wrong in general terms
Websites and apps routinely include analytics, advertising and tracking code from outside companies. On a page where patients log in, schedule visits or search for care, that code can capture and forward information that should stay private. The organization may not realize it is happening because the code was added by a marketing vendor or a plugin.
What Portland-area practices should check
- Inventory every tracker: analytics tags, advertising pixels, chat widgets and embedded forms on every page patients can reach.
- Look at patient-facing pages first: login, scheduling, symptom or service pages and contact forms.
- Review vendor agreements: a vendor that handles protected health information needs a business associate agreement. Many marketing tools will not sign one, which is a sign they should not be on those pages.
- Document the decision: include website technology in your HIPAA security risk analysis.
Build it into your compliance routine
HIPAA expects an ongoing risk analysis, not a one-time check. Our HIPAA security risk analysis guide for Portland clinics explains what to cover, and our HIPAA IT services page describes how we support clinics as part of managed IT.
Related reading
- HIPAA IT services in Portland
- HIPAA security risk analysis for Portland clinics
- AI and HIPAA for Portland healthcare practices
Talk to a local team
PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.
Request an IT assessment
Tell us a little about your business and a PDX IT team member will follow up to schedule an assessment. Prefer to talk? Call 971-331-4871.
About the author: Steve Shaff
Steve Shaff is the owner of PDX Information Technology Services, a managed IT provider he founded in 2020. From the Tualatin office he helps businesses across Portland Metro & Southwest Washington with IT support, cybersecurity and compliance. More about Steve ยท Contact PDX IT
Portland employee offboarding IT checklist: lock Microsoft 365, save the mailbox and OneDrive files, change shared passwords and wipe company devices.
Holiday phishing scams are hitting Portland small businesses: fake shipping notices, gift card requests from the boss and delivery texts. How to stop them.
Cybersecurity compliance proof: HIPAA, CMMC, the FTC and cyber insurers now want documented evidence, not promises. See the checklist for 2027.