Penalty Amount
$49,000,000
Consumers Affected
7,700
California Attorney General Rob Bonta, alongside six county district attorneys, announced a $49 million settlement with Kaiser Foundation Health Plan, Inc. and Kaiser Foundation Hospitals resolving allegations of unlawful disposal of hazardous waste, medical waste, and protected health information at Kaiser’s California facilities. Undercover inspections of 16 Kaiser facilities found hundreds of hazardous and medical waste items, plus over 10,000 paper records containing personal information of more than 7,700 patients in unsecured, publicly accessible dumpsters. The settlement requires Kaiser to pay $49 million total, implement enhanced compliance measures, and retain an independent auditor for five years to conduct regular waste and programmatic compliance audits.
Kaiser will pay a total of $49 million, comprising $37.513 million in civil penalties, $4.832 million in attorneys’ fees and costs, and $4.905 million for supplemental environmental projects. Kaiser must spend $3.5 million at its California facilities on enhanced environmental compliance measures within five years of the final judgment, or pay an additional $1.75 million in civil penalties. Kaiser must retain an independent third-party auditor approved by the Attorney General and district attorneys for five years, who will conduct at least 520 trash compactor audits and 40 programmatic field audits annually to evaluate compliance with waste disposal and PHI protection laws. Kaiser must also modify operating procedures, conduct regular internal trash audits, and implement staff training to improve compliance with waste and PHI disposal requirements.
In-house legal teams at healthcare providers should review vendor agreements with medical, hazardous, and solid waste disposal providers to ensure they mandate compliant disposal of protected health information (PHI) and regulated waste, including secure destruction of paper records and adherence to HIPAA and state waste laws. Business Associate Agreements (BAAs) with vendors handling PHI must be updated to include explicit disposal protocols for PHI, audit rights for the covered entity, and breach notification clauses requiring immediate notice of any improper PHI disposal. Facilities management, janitorial, and trash hauling agreements should be reviewed to prohibit disposal of PHI or regulated waste in unsecured public dumpsters, and to require staff training on proper waste segregation. All vendor agreements should include clauses allowing the entity to conduct regular trash audits to verify compliance, and service agreements with third-party compliance auditors should mandate annual programmatic and waste compactor audits. Additionally, internal policies and vendor contracts should require documented operating procedures for waste handling, storage, and disposal to prevent future violations.
Entity
Kaiser Foundation Health Plan, Inc. and Kaiser Foundation Hospitals (collectively Kaiser)
Industry
HealthcareOfficial Press Release
https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-49-million-settlement-kaiser-illegal-disposal
kaiser complaint.pdf?
https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/kaiser_complaint.pdf?
kaiser stipulation.pdf?
https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/kaiser_stipulation.pdf?
KP Compl Filed 090823
https://oag.ca.gov/system/files/attachments/press-docs/KP%20Compl%20Filed%20090823.pdf
Proposed stipulated judgment
https://oag.ca.gov/system/files/attachments/press-docs/Proposed%20stipulated%20judgment.pdf
California Attorney General Enforcement Page
https://oag.ca.gov/privacy/privacy-enforcement-actions
"settlement with Kaiser Foundation Health Plan, Inc., and Kaiser Foundation Hospitals (collectively “Kaiser”)"
"Kaiser will be liable for a total of $49 million"
"Will pay $47.250 million. That amount includes $37,513,000 in civil penalties; $4,832,000 in attorneys’ fees and costs; and $4,905,000 for supplemental environmental projects."
"Must pay an additional $1.75 million in civil penalties if, within 5 years of the entry of the final judgment, Kaiser has not spent $3.5 million at its California facilities to implement enhanced environmental compliance measures to ensure compliance with relevant provisions of the law that are alleged to have been violated."
"Kaiser’s unlawful disposals are alleged to violate California’s Hazardous Waste Control Law, Medical Waste Management Act, Confidentiality of Medical Information Act, Customer Records Law, and Unfair Competition Law."
"The disposals are also alleged to violate the federal Health Insurance Portability and Accountability Act of 1996, known as HIPAA."
A coalition of 12 state attorneys general, led by Colorado AG Phil Weiser, obtained a temporary restraining order from a federal court in California to halt the proposed $110 billion merger of Warner Bros. Discovery, Inc. by Paramount Skydance Corporation. The lawsuit alleges the merger violates Section 7 of the Clayton Act by substantially lessening competition in film distribution, anticipated blockbuster film distribution, and licensing cable TV channels.
The California Privacy Protection Agency (CalPrivacy) joined a coalition of 18 Attorneys General and state agencies in opposing the proposed SECURE Data Act, a federal privacy bill that would preempt stronger state privacy laws like the CCPA. The coalition argues the bill would weaken consumer privacy protections, limit enforcement remedies, and undermine California's Delete Request and Opt-out Platform (DROP).
A bipartisan coalition of state attorneys general began trial against Meta Platforms, Inc., alleging the company knowingly designed addictive features on Facebook and Instagram that harm children and teens, deceived parents about platform safety, and illegally collected personal information from children under 13 without parental consent in violation of COPPA. The states seek monetary penalties, an injunction to stop unlawful practices, and other relief. The trial is being litigated in the U.S. District Court for the Northern District of California.
$12.8M
California Attorney General Rob Bonta, along with multiple district attorneys and the California Privacy Protection Agency, announced a $12.75 million settlement with General Motors for illegally selling hundreds of thousands of Californians' location and driving data to data brokers Verisk and LexisNexis without notice or consent. The settlement includes the largest CCPA penalty to date, a five-year ban on selling driving data to consumer reporting agencies, and requirements to delete retained data and implement a robust privacy program.
The California Privacy Protection Agency Board voted to support two bills (AB 1542 and SB 1106) and took a 'support if amended' position on a third bill (AB 883). These bills aim to strengthen privacy protections by expanding sensitive data protections, improving deletion rights under the Delete Act, and providing expedited deletion for elected officials and judges.
The California Privacy Protection Agency sent a letter to Congress opposing the SECURE Data Act, a federal bill that would preempt state privacy laws like the CCPA and Delete Act. The letter argues the bill would eliminate rights for 40 million Californians, including the DROP platform and opt-out preference signal requirements, and urges Congress to set a floor rather than a ceiling on privacy protections.