Website Tracking Tools and HIPAA: Lessons From the Kaiser Notice

Kaiser Permanente notified about 13.4 million members that online technologies on its website and mobile apps may have sent some personal information to third-party vendors, including Google, Microsoft Bing and X. Kaiser said passwords, Social Security numbers and payment information were not involved, and the incident was listed on the Department of Health and Human Services breach portal. You do not have to be a health system for this to matter: a small clinic website can have the same kind of problem.

What went wrong in general terms

Websites and apps routinely include analytics, advertising and tracking code from outside companies. On a page where patients log in, schedule visits or search for care, that code can capture and forward information that should stay private. The organization may not realize it is happening because the code was added by a marketing vendor or a plugin.

What Portland-area practices should check

• Inventory every tracker: analytics tags, advertising pixels, chat widgets and embedded forms on every page patients can reach.
• Look at patient-facing pages first: login, scheduling, symptom or service pages and contact forms.
• Review vendor agreements: a vendor that handles protected health information needs a business associate agreement. Many marketing tools will not sign one, which is a sign they should not be on those pages.
• Document the decision: include website technology in your HIPAA security risk analysis.

Build it into your compliance routine

HIPAA expects an ongoing risk analysis, not a one-time check. Our HIPAA security risk analysis guide for Portland clinics explains what to cover, and our HIPAA IT services page describes how we support clinics as part of managed IT.

Related reading

• HIPAA IT services in Portland
• HIPAA security risk analysis for Portland clinics
• AI and HIPAA for Portland healthcare practices

Talk to a local team

PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.