A United States District Court recently ruled in favor of the American Hospital Association (AHA) and other plaintiffs when it vacated part of a bulletin issued by the Department of Health and Human Services (HHS) related to the use of tracking technologies by HIPAA covered entities.
Tracking technologies can capture IP addresses of users accessing a website in combination with data about the user’s browsing activity (for example, that a user clicked on “Oncology Services” on a public facing hospital webpage). In the HHS bulletin challenged by AHA, HHS categorized this combination of data (referred to as the “Proscribed Combination” in the court’s order) as “individually identifiable health information” (IIHI) that is subject to HIPAA requirements if a user accesses the online information for purposes related to their own health care. IIHI is defined by HIPAA as information that (1) relates to an individual’s past, present, or future physical or mental health or condition, provision of health care to the individual, and/or payment for their health care; and (2) identifies the individual or could reasonably be used to identify them. 45 C.F.R. § 160.103.
In ruling against HHS, the District Court observed that an individual’s reason for accessing information on public facing webpages are often not known to health care organizations or their tracking technology vendors. For instance, an individual might access information about the individual’s own health condition, or they might access information solely for the purpose of “writing a term paper” (an example provided in the HHS bulletin). In most cases, it will not be possible for the website owner or their tracking technology vendor to know the difference.
The District Court concluded that HHS exceeded its authority under HIPAA by requiring covered entities to treat the Proscribed Combination as IIHI and vacated that part of the bulletin. The remainder of the bulletin remains in effect. HHS has since updated the bulletin to state that it is “evaluating its next steps in light of [the court’s] order.”
Contact OMW attorneys Maddie Haller, or Casey Moriarty with questions.
