HHS appeals hospital website tracking ruling
HHS has said the revised March bulletin was consistent with HIPAA's definition of individually identifiable health information.
Photo: SimpleImages/Getty Images
The U.S. Department of Health and Human Services has appealed a court ruling, handed down in June, that blocked the agency's ability to prohibit hospital websites from using consumer-tracking technology.
The American Hospital Association, the Texas Hospital Association, Texas Health Resources and United Regional Health Care System won their lawsuit against HHS earlier this summer.
Judge Mark Pittman of the U.S. District Court for the Northern District of Texas ruled in favor of the AHA and other plaintiffs, agreeing that HHS' rules restricting such use is unlawful. Pittman vacated the rule HHS had issued in a March Revised Bulletin.
The bulletin, "was promulgated in clear excess of HHS's authority under HIPAA," Pittman said. "But this case isn't really about HIPAA (the Health Insurance Portability and Accountability Act) ... Rather, this is a case about power. More precisely, it's a case about our nation's limits on executive power."
WHAT'S THE IMPACT?
For its part, HHS has said the revised March bulletin was consistent with HIPAA's definition of individually identifiable health information, or IIHI.
The Office of Civil Rights had received a surge of complaints from citizens concerned that unauthenticated public web pages, or UPWs, might disclose their individually identifiable health information. UPWs are those pages that do not require a log-in.
A provider can use a third-party technology vendor for its UPW. Many vendors use a page visitor's IP address to create a better user experience, such as using user location to populate a menu of nearby providers or to suggest clinics with lower wait times.
"Every click of the mouse or swipe of the phone thus increases the relevance of information the UPW provides," the court said.
HHS issued guidance to privacy concerns starting in December 2022, adding information to the IIHI definition.
After the providers sued, HHS issued the revised bulletin that indicated information can become IIHI if the individual's reason for visiting the site is related to their personal healthcare. The AHA contended the revised bulletin was still unlawful.
Pittman agreed. The revised bulletin does not change the legal question, he said. The bulletins improperly created substantive legal obligations for covered entities, he ruled.
THE LARGER TREND
The AHA, joined by the Texas Hospital Association, Texas Health Resources and United Regional Health Care System, sued the federal government last November to bar enforcement of the rule, which the plaintiffs said upended hospitals' and health systems' ability to share healthcare information with the communities they serve, and analyze their own website traffic to enhance access to care and public health.
Seventeen state hospital associations and 30 hospitals and health systems filed friend-of-the-court briefs supporting AHA and its coplaintiffs in the lawsuit.
Jeff Lagasse is editor of Healthcare Finance News.
Email: jlagasse@himss.org
Healthcare Finance News is a HIMSS Media publication.
