Judge Rules AHA Can Overturn HHS Online Tracking Bulletin for Exceeding Agency Authority and Being Unlawful

Following Biden’s guidelines to the APA that called on hospitals not to use third-party tracking technologies on public websites to target visitors, a federal judge in Texas has struck down the administration’s declaration. U.S. District Judge from Fort Worth, Mark Pittman, ruled on behalf of the American Hospital Association (AHA), the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System that the HHS had exceeded its authority when issuing its guidelines for 2022.

Regarding the issue, the HHS OCR released a bulletin in December 2022 stating that if pixel trackers, including Google Analytics or Meta Pixel, somehow disclosed their patients’ health data, their usage is unlawful according to HIPAA. Specifically, the OCR stated that employing pixel tracking tools in patient portals could violate the Health Insurance Portability and Accountability Act (HIPAA). Personal information was also shared on these social networking sites without patient consent, leading to HIPAA-covered entities being barred from using them to transfer a patient’s information without signing business associate contracts with the vendors.

The Markup reported that approximately 172 of the largest hospitals across the nation had this Pixel tool implemented on their websites. This policy from the HHS resulted in frequent class-action legal cases and settlements with provider organizations and was intensely disliked in the healthcare sector. The AHA and other plaintiffs sued the government in federal court in November 2023 in an attempt to stop the OCR’s policy from being implemented. No fewer than thirty-three state hospital associations and health systems supported the lawsuit.

In March this year, HHS made a change in the regulations that bars specific website visits from being defined as breaches of PHI disclosures. The AHA also claimed there was still a legal contravention when this new bulletin was issued. The honorable judge affirmed the ruling of the courts and found that the HHS Bulletin issued on March 18, 2024, violated the legal powers of the body in its implementation of HIPAA.

The parties that brought the lawsuit, including the AHA and the Texas Hospital Association, were happy with the ruling. AHA General Counsel Chad Golder said in response to the OCR’s “Online Tracking Bulletin” that the AHA had contended it was unlawful and pernicious to patients and communities for more than a year. He regretted that the matter had to go to court but welcomed the outcome of the case since the court viewed that OCR had overstepped its bounds in terms of interpretation. This ruling helps hospitals and health systems continue using these technologies to deliver accurate health information to the communities.

Judge Pittman indicated in his decision that metadata from searches conducted on a hospital’s public website do not fall under the categories of individually identifiable health information as envisaged under HIPAA. Because HHS, in his view, had overstepped its interpretive authority, he pointed out that if similar interpretations were to be allowed, it would be worrying.

The AHA and other plaintiffs emphasized that the 2022 guidance had interfered with the hospitals’ data-sharing of healthcare information and understanding of website traffic to enhance patients’ access to care and strengthen public health.