A respectful, evidence-first read of Kaiser Permanente's public surface, what it does exceptionally well, and the one structural seat still open: no machine-verifiable proof that a community-health intervention was actually delivered. Non-medical framing throughout; clinical decisions always route to a clinician.
Kaiser Permanente is doing more of the hard part right than almost any peer. Before a single finding, the record:
includeSubDomains, X-Frame-Options, a Content-Security-Policy with frame-ancestors 'self', nosniff, and real HTTP status handling (true 404 / 410, verified against a control path).A system that already believes "good health requires more than health care" is the right first buyer for a layer that proves the more happened.
No jargon. Every fix below has one job: turn Kaiser's real programs into outcomes you can prove and members can actually reach. Here is what each one is worth.
Today Kaiser can show a member was referred to food or housing help, but not that it ever reached them; a verifiable “delivered” receipt turns a good-faith program into a measured health outcome you can stand behind.
When a member or their phone’s assistant asks for the nearest Kaiser nutrition or housing program, nothing hands them the answer right now, so some quietly give up; being answerable means the people already searching connect instead of slipping away.
Kaiser’s landmark claims live only as prose today, so a rating body or researcher has to take them on faith; expressed as verifiable data they hold up to scrutiny on their own, no re-litigating the story every time someone asks.
Kaiser’s email settings currently watch for spoofing rather than block it; a single settings change keeps a prime phishing target from riding a brand members open without thinking: cheap protection for a hard-won reputation.
Thrive Local and the Community Support Hub answer "who can help this member?": a referral. What no public, machine-verifiable object answers is "was the help actually delivered?" Did the produce box arrive, the walking group run, the home get made heat-safe? Today that truth lives in a partner's case notes, if anyone files them. Why it matters: a $50M Food Is Medicine commitment and a 68M-person community reach are only as strong as the proof that each intervention landed, and that proof is exactly what turns a social-health program into a measurable health outcome. The proof: the programs are real and described in prose; no agent-checkable completion object exists, and (Finding 2) the surface carrying them is invisible to machines.
Across all three primary hosts there is no agent front door: llms.txt, ai.txt, and /.well-known/agent-card.json are absent everywhere (redirects, a 410 Gone SPA shell, or a true 404). Yet healthy.kaiserpermanente.org/robots.txt publishes deeply structured human sitemaps, per-region facilities, departments, physicians, plus a health encyclopedia and a drug encyclopedia. Why it matters: when a member (or their AI assistant) asks "where's the nearest Kaiser facility that runs a diabetes nutrition program, and can I book it?", there is no machine-readable path to the answer: the place data exists, but nothing hands it to an agent. The proof (soft-404/410 control confirms the site serves real statuses):
Kaiser's climate and Healthy Communities work is published as narrative pages and reports. In the rendered HTML, the Healthy Communities page carries a single ld+json (the structured-data blocks search engines and AI agents read) block, a VideoObject (a media embed), not the program or commitment data, and the climate-action page redirects. Why it matters: "first carbon-neutral health system," "net-zero by 2050," and "$50M Food Is Medicine" are landmark claims that an agent, a researcher, or a rating body currently cannot read as data or verify against outcomes, they can only re-read the prose. The proof:
Public DNS shows kp.org publishes DMARC at p=none; sp=none, a valid, monitoring posture, but one that does not instruct receivers to reject spoofed mail. For context, both retail giants we've reviewed publish p=reject. Why it matters: a health system whose members receive appointment, billing, and results notifications is a prime phishing target; moving to quarantine then reject after a monitoring window is a DNS-only change with no code. Framed honestly: this is the one hardening step left on an otherwise strong estate, not a breach, not a vulnerability. The proof:
A member's social need, food insecurity, an unsafe-hot home, no way to reach a walking program, becomes a bounded, non-medical work packet: scope, safety, funding path, proof requirements. It is claimed by a community health worker or trained community member, closed with photo + GPS + signature proof, scored by a deterministic proof-checker, and settled to a permanent receipt on Base. Each receipt appends to a verified community-health outcome record, the living upgrade to a referral that may or may not have landed. Clinical judgment never enters the packet: anything medical routes to a clinician, always.
This maps onto Thrive without a rebrand: Thrive Local finds the need and the resource; the work packet proves the resource reached the member. The health lane is live on our board today with reproducible counts (curl https://vealth.net/labor/stats): community_need_intake 257, ingredient_provenance_delivery 290, healthy_home_assessment 45, heat_illness_prevention_audit 39, community_meal_prep 15, priced for agents at health-packet $0.05 over x402 (a web-native way for AI agents to pay per use, curl https://vealth.net/.well-known/x402).
| Step | What happens | Who touches what |
|---|---|---|
| 1 | Kaiser publishes concept llms.txt + agent-card (drafted in the Agent Kit), makes Thrive Local, the Support Hub, and facility data agent-discoverable | Kaiser web team, static files on Kaiser's domain |
| 2 | A non-medical community-health packet is authored from a real member need (funding via existing community-benefit dollars) | EcoWealth rail; no PHI leaves Kaiser |
| 3 | Delivery is proof-checked (photo+GPS+signature) and settled on Base; receipt appended to the outcome record | EcoWealth's live contract; Kaiser reads receipts |
| 4 | Commitments (carbon, food security) expressed as structured, verifiable data an agent or rating body can read | Kaiser publishes; EcoWealth supplies the schema |
| Claim | Source / re-verify | Observed |
|---|---|---|
No llms.txt/ai.txt/agent-card on any primary host (302/301/410/404; control confirms real statuses) | curl -sI https://www.kp.org/llms.txt · …/about./llms.txt · …/healthy./.well-known/agent-card.json | 2026-07-14 |
Healthy Communities page ld+json = 1 (VideoObject); climate-action page 301 | curl -s .../healthy-communities | grep -c application/ld+json | 2026-07-14 |
DMARC p=none; sp=none on kp.org; peers Walmart/Target p=reject | dig +short TXT _dmarc.kp.org | 2026-07-14 |
| Rich human sitemaps (facilities/departments/physicians/health-enc/drug-enc) exist | curl -s https://healthy.kaiserpermanente.org/robots.txt | 2026-07-14 |
| Carbon-neutral 2020, net-zero 2050, Thrive Local, Community Support Hub, Food Is Medicine $50M | Kaiser press + about.kaiserpermanente.org (cited in evidence.json) | 2026-07-14 |
EWP live: 7,624 postings / $671,012; contract 0x76c17C…A14B; health-packet $0.05 | curl -s https://vealth.net/labor/stats · BaseScan · /.well-known/x402 | 2026-07-14 |
health-packet / $0.10 work-packet) against our live endpoint and get back a real, bounded, non-medical community-health packet, no contract, no meeting, no PHI: curl https://vealth.net/.well-known/x402.