The American Hospital Association is making an exception to recently updated rules from the HHS Office for Civil Rights regarding the use of online tracking tools by health systems and Entities are otherwise HIPAA related.
The AHA this month told a federal court that OCR’s latest bulletin restricts covered entities and their business partners from using third-party web technology to capture IP addresses on public websites are too broad and too restrictive – and can “prevent health care providers from communicating important health information.” information to the communities they serve.”
But in Massachusetts this month, a high court is considering whether to allow two class-action lawsuits to proceed under the state’s 1968 Wiretapping Act accusing two hospitals of violating patient privacy. when using pixel tracking tools or not.
WHY IS IT IMPORTANT?
Last month, OCR updated its guidance on the use of online tracking tools, such as those developed by Google and Meta, by HIPAA-protected organizations and business partners – replaces previous guidance from 2022.
In the revised bulletin, OCR clarified that organizations “may engage technology vendors to perform such analysis as part of the regulated entity’s healthcare operations,” reiterating that “ Sharing protected health information with a provider without consent is considered an unauthorized disclosure.”
For example, according to OCR guidance, “disclosing PHI to tracking technology vendors for marketing purposes without the individual’s HIPAA-compliant authorization constitutes an impermissible disclosure ”.
Previous guidance warned that HIPAA-regulated entities collect and transmit certain personally identifiable health information, including IP addresses, using tools such as Google Analytics and Meta Pixel may constitute a violation of HIPAA protected health information.
However, on Friday, the American Hospital Association told the federal court that the revised bulletin “only confirms that the original bulletin was ‘fundamentally and procedurally illegal.” ‘.”
“[T]The mere fact that online tracking technology connects a user’s device IP address (or other identifying information) to visits to websites that address specific health conditions or list health care provider is not a complete combination of information to constitute [individually identifiable health information] The AHA says if the visit to the website is not related to an individual’s past, present or future health, health care or payment for health care.
This isn’t the first time a hospital group has taken issue with HHS’s efforts to limit the health system’s use of tracking tools.
In October 2023, the AHA sent a letter to the Senate Committee on Health, Education, Labor and Pensions arguing that OCR’s regulation on the use of online tracking tools is inconsistent with HIPAA and could harm patients, and asked Congress to urge this agency. to withdraw the rule.
“HIPAA is more than adequate to protect patient privacy, and if interpreted correctly, it strikes the appropriate balance between medical information privacy and sharing,” AHA told the HELP committee. valuable information”.
Then, in November, the AHA filed a lawsuit against HHS for restricting health care providers from using third-party web technology to collect IP addresses on portions of its public websites. surname and other data.
Supporting efforts to block enforcement aimed at limiting the use of pixel tracking tools, 17 state hospital associations and 30 hospital systems have filed amicus briefs, the AHA said. court.
“HHS has consistently required hospitals to better serve these communities, furthering the hospital’s goal of ‘advancing equity,” the state hospital association said in its joint brief filed with the court. health for all, including members of under-resourced and historically underserved communities.” in January.
“But to serve as an effective source of trusted health information and reach a wide audience beyond their current patient base, hospitals must be empowered to use the best tools available today.” there to ensure that their website is providing the right information to the right people, in a way that they can trust and take action on,” they said.
THE TREND IS GREATER
But even as the AHA calls the new amendments an “embarrassing tale of regulatory overreach” and seeks to block federal enforcement of an “illegal and ill-advised new regulation,” State courts are still trying to find the right way to prevent health systems from using activity-tracking technology when it comes to patient privacy.
Reuters, this month, reported that the Massachusetts Supreme Judicial Court may be open to proposed class actions related to online tracking – cases that use a new interpretation of hearing law Sneaking has been around for decades.
Separate class actions, filed by a single plaintiff, allege that two hospitals – Beth Israel Deaconess Medical Center and New England Baptist Hospital – violated the Massachusetts Wiretap Act, drafted in 1968 , by allowing third parties to collect data about website users.
As Reuters reports, Judge Frank Gaziano is open to the idea that old wiretapping laws could apply to internet surveillance, as state courts have expanded their reach to new technologies like cell phones and text messaging in 2013.
“This case involves hospitals allowing technology companies to eavesdrop on highly sensitive communications between healthcare consumers and their medical providers.”
Meanwhile, other Massachusetts health systems have faced their own pixel tracking cases in recent years, including Mass General Brigham, which settled a class action lawsuit with amount of 18.4 million USD in 2022.
ON PROFILE
For its part, the AHA continues to oppose federal regulations that it considers too broad.
“The unprecedented rule that HHS has adopted is inconsistent with its statutory text and intent, is practically unenforceable, and is internally inconsistent,” the AHA said on April 11. It is not surprising that a rule was hastily revised during a period of intense litigation and still lacks serious public feedback.” .
Andrea Fox is a senior editor at Healthcare IT News.
Email: [email protected]
Healthcare IT News is a publication of HIMSS Media.
