On September 4, 2024, the U.S. Court of Appeals for the Fifth Circuit dismissed the federal government’s appeal in the case brought by the American Hospital Association (AHA) concerning the use of third-party online tracking technologies by health care providers on unauthenticated public-facing webpages.
Such technologies were said by AHA to assist health care providers in their information-sharing efforts with the public by enabling such things as translation, video, and map technologies. The Department of Health and Human Services (HHS) however, had said that their use under the above circumstances could result in the impermissible disclosure of an individual’s protected health information, and therefore violate the HIPAA Privacy Rule.
As previously covered by the Digital Health Law Group, on June 20, 2024, a Final Judgment had been issued vacating the portion of an HHS Bulletin that addressed the use of online tracking technologies that had come to be called the ‘proscribed combination,’ or, the situation occurring when an individual’s IP address is combined with a visit to an Unauthenticated Public Webpage that addresses specific health conditions or health care providers.
The dismissal, which was in response to a motion by the government, leaves intact the district court’s ruling, and it provides clarity for health care organizations on their ability to use common website analytics tools without running afoul of HIPAA. The outcome highlights the challenges in applying traditional health care privacy laws to emerging digital technologies used by providers to engage with patients online.
Categories: DATA PROTECTION & PRIVACY
Leave a Reply