HHS OCR Updates Tracking Technologies Guidance

On March 18, 2024, the U.S. Department of Health and Human Services Office for Civil Rights ("HHS OCR") updated its "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" guidance addressing how regulated entities may use tracking technologies on their websites and mobile applications in a manner compliant with the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations (collectively, "HIPAA"). The guidance, originally published in December 2022, states that HIPAA-regulated entities are not permitted to leverage tracking technologies in ways that would result in an impermissible disclosure of protected health information ("PHI") or other violation of HIPAA. The guidance also emphasizes the importance of safeguarding PHI and notes that regulated entities may not share PHI with tracking technology vendors (e.g., third-party advertisers) absent a business associate agreement ("BAA") with the vendor or pursuant to a patient authorization.

Last November, the American Hospital Association, Texas Hospital Association, Texas Health Resources, and United Regional Health Care System sued HHS OCR to bar enforcement of the December 2022 guidance, arguing that the guidance impermissibly restricts the use of standard third-party web technologies that capture IP addresses on hospitals' unauthenticated public webpages. HHS referred to this updated guidance in a brief it filed in the case on March 21, 2024. It is not yet clear how the updated guidance will affect this litigation.

We offer below key highlights from HHS OCR's updates.

• Unauthenticated Webpages:The updated guidance maintains HHS OCR's original position that the use of tracking technologies on user-authenticated webpages is permitted only if the regulated entity configures its webpages to use and disclose PHI in compliance with HIPAA and ensures that the electronic protected health information ("ePHI") collected through its website is protected and secured according to HIPAA. However, HHS OCR appears to have modified its approach to pages that are not user authenticated, and this modified approach is consistent with HHS' argument in its brief. Specifically, per the updated guidance, whether the use of tracking technologies on a webpage that is not user-authenticated implicates HIPAA appears to depend on the webpage visitor's underlying intentions: if the webpage visitor views the webpage for a reason unrelated to an individual's past, present, or future health, health care, or payment for health care, then any individually identifiable information collected would not be considered PHI. To illustrate, the guidance provides an example of a student searching for information regarding the availability of a hospital's oncology services in connection with a term paper. According to the guidance, the collection and transmission of the student's IP address or other individually identifiable information from the hospital to a third party without a BAA or other authorization would not implicate HIPAA because the disclosure would not involve PHI. However, per the guidance, if an individual were to visit the same webpage as part of the process for seeking a second opinion regarding treatment options for her brain tumor, the same data (i.e., the individual's IP address, geographic location) would be considered PHI because it relates to the individual's health care, and disclosure by the hospital of PHI absent a BAA or other authorization would be a HIPAA violation. The updated guidance does not clarify how a regulated entity may determine a webpage visitor's underlying intentions. In its brief, HHS seems to take the position that, if a covered entity cannot determine the visitor's underlying intentions, the covered entity should err on the side of treating the information as if it is PHI.

• Mobile Apps:HHS OCR also provides additional clarification with respect to tracking technologies placed on patient-facing mobile apps offered by a regulated entity. The guidance now provides an example of a patient using a health clinic's diabetes management mobile app to track health information, such as glucose levels. Per the guidance, transmission of information pertaining to that patient to a tracking technology vendor would be a disclosure of PHI because the patient's use of the app is related to a health condition (i.e., diabetes) and is coupled with individually identifiable information (i.e., name, IP address, device ID).

• BAAs and Customer Data Platforms: In its updated guidance, HHS OCR maintains its position that if a tracking technology vendor meets the definition of a business associate under HIPAA, a regulated entity should establish a BAA with that vendor. However, the updated guidance clarifies that if that tracking technology vendor will not sign a BAA, a regulated entity could "choose to establish a BAA with another vendor, for example a Customer Data Platform vendor, that will enter into a BAA with the regulated entity to de-identify online tracking information that includes PHI." The regulated entity could then subsequently disclose the de-identified information to tracking technology vendors that are unwilling to enter into a BAA or direct its business associate to do so.

• Enforcement Priorities: The updated guidance includes a section on HHS OCR's enforcement priorities. Specifically, the guidance states that, when investigating the use of online tracking technologies, HHS OCR is particularly interested in ensuring compliance with the HIPAA Security Rule. HHS re-emphasized this point in its brief. Per the guidance, HHS OCR's priority is to ensure regulated entities have identified, assessed, and mitigated the risks to ePHI when using online tracking technologies and have implemented the HIPAA Security Rule requirements to ensure adequate safeguards for ePHI.