In a complaint filed in a Texas federal court, AHA and three other organizations claim that the HHS ruling on online tracking technology is “unlawful, harmful, and counterproductive.”
What happened
Back in 2022, the Office for Civil Rights and the U.S. Department of Health and Human Services released a bulletin highlighting the obligations of HIPAA-covered entities as they relate to the use of online tracking technologies.
According to the guidance, regulated entities are not allowed to use tracking technologies that could result in impermissible disclosures of protected health information. The guidance acknowledged that tracking is frequently utilized by websites and apps, like in the use of pixels, cookies, and more.
The bulletin further stated that any disclosures of PHI must be specifically permitted. Since then, a Health Affairs report revealed 98.6% of hospitals use tracking.
The report led to a renewed debate on whether tracking technology is necessary for hospital efficiency. Soon after, many hospitals faced lawsuits, with many still ongoing.
Read more: 98.6% of hospitals use tracking that puts patient privacy at risk
What’s new
Since then, the AHA has been vocally challenging the guidance. Now, they are joined by the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System in suing the federal government.
They aim to bar the enforcement of the hospital because they believe it prevents health systems and hospitals from sharing information that could improve patient well-being.
The lawsuit also claims that Medicare.gov, the Department of Defense Military Health System, and the Defense Health Agency, as well as other government-run healthcare organizations, continue to use third-party tracking technologies despite being HIPAA-covered entities.
Furthermore, the AHA believes that certain web tools will be ineffective without the use of some limited tracking, including analytics software, video technologies, translation and accessibility services, and digital maps.
What was said
AHA President and CEO Rick Pollack described some tracking technologies as critical and said the new restrictions have “real-world impacts on the public, who are now unable to access vital health information.”
Pollack further added, “Simply put, OCR’s new rule harms the very people it purports to protect… the federal government’s repeated threats to enforce this unlawful rule tie hospitals’ hands as trusted messengers of reliable health information.”
The HHS has yet to comment on the lawsuit, and the case is still developing.
The bottom line
There’s no doubt that the tracking guidance challenges how hospitals currently conduct business, with many being forced to reevaluate significant components of their technology.
As enforcement of the policy continues, we will likely continue to see more lawsuits against hospitals that violate their obligations as outlined by the HHS.
While the case develops, we will learn more about the role tracking technologies play in hospital systems and how, if they must, hospitals can avoid inadvertently disclosing PHI.
Related: HIPAA Compliant Email: The Definitive Guide
Abby Grifno
