OCR updates HIPAA guidance on use of online tracking technologies

The Department of Health and Human Services’ Office for Civil Rights March 18 released updated guidance for HIPAA-covered entities and business associates on using online tracking technologies.

Chad Golder, AHA general counsel and secretary, said, “The fact that the HHS Office for Civil Rights has modified its Bulletin in response to our lawsuit concedes that the original Bulletin was flawed as a matter of law and policy. Unfortunately, the modified Bulletin suffers from the same basic substantive and procedural defects as the original one, and the agency cannot rely on these cosmetic changes to evade judicial review. The modified rule will continue to chill hospitals’ use of commonplace technologies that allow them to effectively reach patients in need. As the AHA has previously noted, these technologies are so essential that federal agencies themselves still use them on their own webpages, including HHS’s own Medicare.gov, as well as Health.mil, and various Veterans Health Administration sites. We look forward to resolving this issue once and for all in court, so that the federal government can no longer tie hospitals’ hands as trusted messengers of reliable health care information.”

The AHA, joined by the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System, sued the agency last November to bar enforcement of a December 2022 rule that restricts the use of standard third-party web technologies that capture IP addresses on portions of hospitals’ public-facing webpages. In January, AHA filed its opening brief in the case. Seventeen state hospital associations and 30 hospitals and health systems have filed friend-of-the-court briefs supporting AHA in the lawsuit.