08/21/2024 | News release | Distributed by Public on 08/21/2024 09:05
The ruling in American Hospital Association (AHA) v. Becerrais favorable to HIPAA-covered health care providers and health plans (covered entities) and their business associates (collectively, regulated entities) to the extent it limits when a HIPAA violation occurs from a regulated entity's use of a cookie, web beacon, or other tracking technology on its website. Nevertheless, it underscores the increasing privacy concerns about technologies that provide insight about website users and the need for regulated entities to carefully evaluate their use of such technologies.
The AHA case stemmed from a guidance bulletin that OCR released on December 1, 2022, outlining the HIPAA compliance risks from regulated entities' use of scripts or codes embedded in websites or applications that gather and analyze user data. The bulletin explained that these tracking technologies may collect information, such as an individual's IP address, that connects an individual to a covered entity, thereby indicating that "the individual has received or will receive health care services or benefits from the covered entity." Moreover, with respect to tracking technologies developed by third parties (for example, Google Analytics or Meta Pixel), such information may be shared with the third-party developer, which may continue tracking an individual after the individual leaves the covered entity's website.
In these respects, OCR concluded, tracking technologies might involve disclosure of IIHI. HIPAA defines this term as information that (1) "relates to" an individual's past, present, or future health, health care, or payment for care and (2) "identifies the individual" or provides "a reasonable basis to believe that the information can be used to identify the individual." When transmitted or maintained by a regulated entity, IIHI is deemed "protected health information" (PHI), subject to HIPAA's privacy, security, and breach notification requirements.
In a letter dated May 22, 2023, AHA urged OCR to reconsider its guidance. The bulletin erred, AHA argued, by concluding that an IP address is PHI whenever it is shared with a third party, regardless of the context of a user's visit to a regulated entity's website. For example, a user of a hospital website may be a relative or friend of a hospital patient, but an IP address does not make such a distinction. If OCR maintained that an IP address, by itself, is a unique identifier under HIPAA, AHA warned that its hospital and health system members "will be forced to restrict the use of certain technologies that help improve community access to health information," potentially losing millions of dollars of investments in existing websites, apps, and portals under threat of OCR enforcement actions and class-action lawsuits.
Despite AHA's plea, OCR maintained its interpretive position. As we discussed in a prior alert, the Federal Trade Commission (FTC) and OCR sent a joint letter dated July 20, 2023, to approximately 130 hospital systems and telehealth providers advising them of the legal risks associated with the use of tracking technologies. The letter referred HIPAA regulated entities to OCR's bulletin, warning that "HIPAA regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to third parties or any other violations of the HIPAA Rules."
Several months later, AHA and other plaintiffs sued the director of OCR and other government parties in federal district court in Texas. The plaintiffs claimed that OCR lacks the authority under HIPAA to expand the definition of IIHI to include the combination of an individual's IP address and visits to unauthenticated public webpages (i.e., webpages that do not require user credentials to access) that address specific health conditions or health care providers (referred to as the "Proscribed Combination"). They also alleged that OCR's tracking technology guidance was arbitrary and capricious and did not follow proper notice-and-comment rulemaking procedures.
As the litigation progressed, OCR revisited its guidance, issuing a modified bulletin on March 18. The modified guidance now explains, with additional illustrations, that "the mere fact that an online tracking technology connects the IP address of a user's device (or other identifying information) with a visit to a webpage addressing specific health conditions or listing health care providers is not a sufficient combination of information to constitute IIHI if the visit to the webpage is not related to an individual's past, present, or future health, health care, or payment for health care."
On cross-motions for summary judgment, the court confronted the central question of whether the Proscribed Combination is IIHI. To analyze this question, the court evaluated the definitional components of IIHI:
In sum, the court held that "the closest the Proscribed Combination gets to IIHI is a speculative inference extrapolated from (but unsubstantiated by) collected metadata." Because HIPAA governs PHI, a necessary element of which is IIHI, OCR thus exceeded its legal authority to regulate the Proscribed Combination as provided in the bulletin. The court accordingly vacated the Proscribed Combination and did not consider the plaintiffs' other claims.
As of the date of this alert, the defendants have not appealed the court's order. A notation added to OCR's bulletin states that "HHS is evaluating its next steps in light of that order."
The court's decision narrows the scope of website information subject to regulation under HIPAA. To that extent, it may lessen regulated entities' HIPAA compliance burden. Although the court's decision is limited to a single district in Texas, the ruling will likely impact OCR's enforcement posture on the Proscribed Combination beyond that district. As stakeholders monitor OCR's next moves, regulated entities should consider doing the following:
If you have any questions about HIPAA compliance and regulatory issues, please contact Gayland O. Hethcoat II, Moyosore O. Koya, or the ArentFox Schiff attorney who usually handles your matters.