On March 18, 2024, the U.S. Department of Health and Human Services Office for Civil Rights (“HHS OCR”) updated its “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” guidance addressing how regulated entities may use tracking technologies on their websites and mobile applications in a manner compliant with the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations (collectively, “HIPAA”).  The guidance, originally published in December 2022, states that HIPAA-regulated entities are not permitted to leverage tracking technologies in ways that would result in an impermissible disclosure of protected health information (“PHI”) or other violation of HIPAA.  The guidance also emphasizes the importance of safeguarding PHI and notes that regulated entities may not share PHI with tracking technology vendors (e.g., third-party advertisers) absent a business associate agreement (“BAA”) with the vendor or pursuant to a patient authorization. 

Last November, the American Hospital Association, Texas Hospital Association, Texas Health Resources, and United Regional Health Care System sued HHS OCR to bar enforcement of the December 2022 guidance, arguing that the guidance impermissibly restricts the use of standard third-party web technologies that capture IP addresses on hospitals’ unauthenticated public webpages.  HHS referred to this updated guidance in a brief it filed in the case on March 21, 2024.  It is not yet clear how the updated guidance will affect this litigation.

We offer below key highlights from HHS OCR’s updates.

  • Unauthenticated Webpages: The updated guidance maintains HHS OCR’s original position that the use of tracking technologies on user-authenticated webpages is permitted only if the regulated entity configures its webpages to use and disclose PHI in compliance with HIPAA and ensures that the electronic protected health information (“ePHI”) collected through its website is protected and secured according to HIPAA.  However, HHS OCR appears to have modified its approach to pages that are not user authenticated, and this modified approach is consistent with HHS’ argument in its brief.  Specifically, per the updated guidance, whether the use of tracking technologies on a webpage that is not user-authenticated implicates HIPAA appears to depend on the webpage visitor’s underlying intentions: if the webpage visitor views the webpage for a reason unrelated to an individual’s past, present, or future health, health care, or payment for health care, then any individually identifiable information collected would not be considered PHI.  To illustrate, the guidance provides an example of a student searching for information regarding the availability of a hospital’s oncology services in connection with a term paper.  According to the guidance, the collection and transmission of the student’s IP address or other individually identifiable information from the hospital to a third party without a BAA or other authorization would not implicate HIPAA because the disclosure would not involve PHI.  However, per the guidance, if an individual were to visit the same webpage as part of the process for seeking a second opinion regarding treatment options for her brain tumor, the same data (i.e., the individual’s IP address, geographic location) would be considered PHI because it relates to the individual’s health care, and disclosure by the hospital of PHI absent a BAA or other authorization would be a HIPAA violation.  The updated guidance does not clarify how a regulated entity may determine a webpage visitor’s underlying intentions.  In its brief, HHS seems to take the position that, if a covered entity cannot determine the visitor’s underlying intentions, the covered entity should err on the side of treating the information as if it is PHI.
  • Mobile Apps: HHS OCR also provides additional clarification with respect to tracking technologies placed on patient-facing mobile apps offered by a regulated entity.  The guidance now provides an example of a patient using a health clinic’s diabetes management mobile app to track health information, such as glucose levels.  Per the guidance, transmission of information pertaining to that patient to a tracking technology vendor would be a disclosure of PHI because the patient’s use of the app is related to a health condition (i.e., diabetes) and is coupled with individually identifiable information (i.e., name, IP address, device ID).
  • BAAs and Customer Data Platforms: In its updated guidance, HHS OCR maintains its position that if a tracking technology vendor meets the definition of a business associate under HIPAA, a regulated entity should establish a BAA with that vendor.  However, the updated guidance clarifies that if that tracking technology vendor will not sign a BAA, a regulated entity could “choose to establish a BAA with another vendor, for example a Customer Data Platform vendor, that will enter into a BAA with the regulated entity to de-identify online tracking information that includes PHI.”  The regulated entity could then subsequently disclose the de-identified information to tracking technology vendors that are unwilling to enter into a BAA or direct its business associate to do so.  
  • Enforcement Priorities: The updated guidance includes a section on HHS OCR’s enforcement priorities.  Specifically, the guidance states that, when investigating the use of online tracking technologies, HHS OCR is particularly interested in ensuring compliance with the HIPAA Security Rule.  HHS re-emphasized this point in its brief.  Per the guidance, HHS OCR’s priority is to ensure regulated entities have identified, assessed, and mitigated the risks to ePHI when using online tracking technologies and have implemented the HIPAA Security Rule requirements to ensure adequate safeguards for ePHI.
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience…

Anna Durand Kraus has a multi-disciplinary practice advising clients on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (HHS) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and health information privacy. Ms. Kraus regularly advises clients on Medicare reimbursement matters, the Medicaid Drug Rebate program, health information privacy issues (including under HIPAA and the HITECH Act), and the challenges and opportunities presented by the Affordable Care Act.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Olivia Vega Olivia Vega

Olivia Vega provides strategic advice to global companies on a broad range of privacy, health care, and technology issues, including in technology transactions, mergers and acquisitions, and regulatory compliance. Within her practice, Olivia counsels clients on navigating the complex web of federal and…

Olivia Vega provides strategic advice to global companies on a broad range of privacy, health care, and technology issues, including in technology transactions, mergers and acquisitions, and regulatory compliance. Within her practice, Olivia counsels clients on navigating the complex web of federal and state privacy and data security laws and regulations, including on topics such as HIPAA, California’s Confidentiality of Medical Information Act, and the California Consumer Privacy Act. In addition, Olivia maintains an active pro bono practice.

Photo of Elizabeth Brim Elizabeth Brim

Elizabeth Brim is an associate in the firm’s Washington, DC office. She is a member of the firm’s Health Care and Data Privacy and Cybersecurity Practice Groups, advising clients on a broad range of regulatory and compliance issues. In addition, Elizabeth maintains an…

Elizabeth Brim is an associate in the firm’s Washington, DC office. She is a member of the firm’s Health Care and Data Privacy and Cybersecurity Practice Groups, advising clients on a broad range of regulatory and compliance issues. In addition, Elizabeth maintains an active pro bono practice.

Photo of Natalie Maas Natalie Maas

Natalie is an associate in the firm’s San Francisco office, where she is a member of the Food, Drug, and Device, and Data Privacy and Cybersecurity Practice Groups. She advises pharmaceutical, biotechnology, medical device, and food companies on a broad range of regulatory…

Natalie is an associate in the firm’s San Francisco office, where she is a member of the Food, Drug, and Device, and Data Privacy and Cybersecurity Practice Groups. She advises pharmaceutical, biotechnology, medical device, and food companies on a broad range of regulatory and compliance issues.

Natalie also maintains an active pro bono practice, with a particular focus on health care and reproductive rights.