A United States District Court (Texas) late last week struck down certain HIPAA guidance issued by the Department of Health and Human Services (HHS), opening the door to greater use of online tracking technologies such as cookies and pixels.
The court ruled that HHS overreached in issuing guidance in the form of a bulletin in December 2022 (and later clarified in March 2024), in which HHS warned covered entities that certain data gathered from tracking technologies (e.g., pixels and cookies) should be treated as “protected health information” (PHI) under HIPAA.
Under these bulletins, HHS said that IP addresses would generally be considered PHI if the individual’s visit to a covered entity’s webpage related to an individual’s past, present, or future health, health care, or payment for health care.
These bulletins effectively restricted the ability of a covered entity or their business associates to track IP addresses outside of HIPAA, since any visit to their webpages may constitute PHI depending on the intent of the visitor.
The court found this guidance to be overbroad as an individual could simply be visiting a covered entity’s webpage for the purposes of conducting research (e.g., a student) or a person acting for family members or friends.
Covered entities should consult with HIPAA counsel to discuss what this ruling means for them, including how to best utilize tracking technologies and analytics on their websites.
Similarly, any entity that previously shied away from working with covered entities due to HIPAA concerns in this area might want to see if they are able to service these clients while still avoiding handling PHI.