HHS appeals data tracking lawsuit, then drops it
In less than 24 hours this week, the U.S. Department of Health and Human Services filed an appeal in American Hospital Association v. Becerra — a lawsuit seeking to block enforcement of an Office for Civil Rights rule on the use of online tracking tools — and then promptly withdrew it.
The American Hospital Association, which wants to protect its members’ ability to use the tracking tools, issued a statement Thursday in which AHA general counsel Chad Golder called the outcome a “victory.”
WHY IT IS IMPORTANT
Although HHS had appealed the ruling in June to the federal court in Fort Worth, Texas, the appeal was withdrawnwithout saying why.
“The HHS Office for Civil Rights has no comment on the lawsuit,” an agency spokesperson said in an email Thursday.
The OCR rule, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associatesintended to protect patient privacy by limiting the scope of the use of tracking pixels.
But the Texas court has blocked the agency’s authority to ban hospital websites from using consumer tracking technology, under HIPAA and the Federal Trade Commission’s Health Breach Notification Rule, which it issued in December 2022 guidance governing the use of the tools.
The American Hospital Association has long argued that HIPAA-compliant organizations must use online tracking pixels on websites and mobile apps. It also argues that OCR’s attempt to restrict the use of third-party web technologies that capture IP addresses on public web pages is “unlawful and ill-advised.”
THE BIGGER TREND
In the original complaint the AHA filed in federal court, the hospital group argued that enforcing the OCR rules on pixel tracking tools would upset the “balance that HIPAA and its related rules create between privacy and information sharing.”
“The HHS regulations exceed the government’s statutory and constitutional authority, fail to meet the agency’s regulatory requirements, and harm the very people they purport to protect,” the AHA said when it filed the lawsuit in November.
Although attorney Aurora Health paid more than $12.2 million in October 2022 to settle a class action lawsuit over a privacy violation related to pixels, legal counsel said there were safe ways for health systems and hospitals to manage pixel tracking while the case proceeded in court.
Along with the Texas Hospital Association, Texas Health Resources and United Regional Health Care System, the hospital group filed a lawsuit against HHS. Seventeen state hospital associations and 30 hospitals and health systems filed friend-of-the-court briefs in support of AHA and its co-plaintiffs in the lawsuit, according to AHA Statement.
ON THE RECORD
“As the AHA repeatedly explained to OCR — both before and after OCR forced the AHA to file a lawsuit — this rule was a gross overreach of the federal government’s authority, imposed without any input from health care providers or the general public,” Golder said in the statement, just hours after HHS filed and subsequently withdrew the appeal.
“Now that the Bulletin’s illegal rule has been permanently lifted, hospitals can safely share reliable, accurate health care information with the communities they serve without fear of federal civil and criminal penalties.”
Andrea Fox is Editor-in-Chief of Healthcare IT News.
Email address: afox@himss.org
Healthcare IT News is a publication of HIMSS Media.