Federal Judge Vacates Key Points of HHS OCR HIPAA Online Tracking Technology Guidance

On June 20, 2024, a Texas federal judge ruled that key portions the guidance promulgated by the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) on the use of online tracking technologies (the “Guidance”)¹ was unlawful and exceeded the scope of HHS OCR’s administrative authority.² The Guidance, which we have summarized in prior Alerts, sought to strictly regulate the use of online tracking technologies under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended (“HIPAA”), and has spurred class action litigation, breach notifications and governmental investigations nationwide. The ruling relates solely to the Guidance’s introduction of an expanded definition of individually identifiable health information (“IIHI”), which has posed additional and unexpected compliance obligations on HIPAA-regulated entities.

The Guidance Expanded the Definition of IIHI, Creating Compliance Challenges

In relevant part, the Guidance, initially published in December 2022 and updated in March 2024, asserted that “the mere fact that an online tracking technology connects the IP address of a user’s device (or other identifying information) with a visit to a[n] [unauthenticated] webpage addressing specific health conditions or listing health care providers is . . . a sufficient combination of information to constitute IIHI if the visit to the webpage is . . . related to the individual’s own health.”³ Importantly, the Guidance noted that such information generally constitutes protected health information (“PHI”) “even if the individual does not have an existing relationship with the regulated entity.”⁴ The Guidance therefore prohibited HIPAA-regulated entities’ disclosure of broad categories of IIHI on unauthenticated webpages through the use of online tracking technologies unless a valid business associate agreement was in place with the tracking technology vendor or, in the alternative, a valid patient authorization was secured.

The Guidance’s expanded definition of IIHI thus introduced compliance challenges for HIPAA-regulated entities and created confusion regarding whether information collected on unauthenticated websites in fact constituted IIHI, especially with respect to certain information, which by itself would not meet the traditional definition of PHI under HIPAA. This confusion was compounded by the March 2024 updates, which proposed that the characterization of IIHI was dependent on the website visitor’s subjective intent, inscrutable by the HIPAA-regulated entity.

Further, the Guidance triggered numerous class action lawsuits against HIPAA-regulated entities that had shared information collected via embedded online tracking technologies on both unauthenticated and authenticated webpages. Such classes have sought damages against the entities, arguing that the collection and disclosure of such information in this way was in violation of their obligation to maintain such confidential information. Plaintiffs have asserted that they were unaware that their searches or actions on the websites were being tracked and their information was sent to third parties. While many of these lawsuits remain ongoing, some have resulted in multi-million-dollar settlements.⁵

American Hospital Association et al. Brought Lawsuit Challenging the Legality of the Guidance

In November 2023, the American Hospital Association, along with the Texas Hospital Association, Texas Health Resources and the United Regional Health Care Systems (collectively, “Plaintiffs”) brought suit against the OCR Director and HHS Secretary (collectively, “HHS OCR”) to stop enforcement of the Guidance (the “AHA Lawsuit”). The AHA Lawsuit followed the American Hospital Association’s May 2023 attempt to persuade HHS OCR to suspend or amend the Guidance based on input form HIPAA-regulated entities, which was met with silence by HHS OCR.⁶

In the AHA Lawsuit, Plaintiffs argued that the Guidance was “flawed as a matter of law, deficient as a matter of administrative process, and harmful as a matter of policy.” In particular, Plaintiffs asserted that the Guidance was procedurally defective—as it was issued without a notice-and-comment rulemaking— exceeded HHS OCR’s statutory and constitutional authority and thus fails to satisfy the requirements for agency rulemaking. At the crux of their argument, Plaintiffs asserted that the Guidance unlawfully expanded the definition of IIHI, “go[ing] well beyond the meaning of what [HIPAA] can bear,” as “the connection between a person’s browsing history [on] publicly accessible websites [and] his or her own state of health is too tenuous” to implicate HIPAA.

Numerous hospitals, health systems and state associations showed support for Plaintiffs in the AHA Lawsuit. Such groups also expressed concern that the Guidance was harmful to patients, as it threatened to limit the ability for HIPAA-regulated entities to (i) use website analytics to improve online content and service offerings; (ii) map and use location technologies to ensure visitors’ ability to navigate to a particular location as seamlessly as possible; (iii) embed videos, crucial for educational and informational purpose; (iv) counteract medical misinformation; and (v) communicate with and serve the public.⁷

In defense of the AHA Lawsuit, HHS OCR took the position that, because the Guidance was not a final agency action, it could not be challenged in a court of law.

Federal Judge’s Ruling Vacating the Guidance Sets Powerful Precedent and Vindicates HIPAA-Regulated Entity’s Use of Online Tracking Technologies in Certain Contexts

In a 31-page ruling, Judge Pittman granted Plaintiffs’ motion for declaratory judgment to vacate the Guidance’s classification of IIHI, ruling that expanding the classification of IIHI in this way “was . . . in clear excess of HHS’s authority under HIPAA,” but rejected Plaintiff’s simultaneous request for a permanent injunction. Specifically, Judge Pittman ruled that metadata (e.g., IP address) input by website users into a HIPAA-regulated entity’s unauthenticated, publicly facing webpage does not constitute IIHI. Such information neither relates to an individual’s health condition, health care or payment for health care, nor does it identify or can it be used to reasonably identify that individual. Judge Pittman reasoned that “[t]o hold otherwise would empower HHS and other executive entities to take increasingly expansive liberties with the finite authority granted to them.” Notably, however, the ruling does not vacate the entire Guidance, implying that HHS OCR’s characterization that IIHI includes an IP address in combination with activity on an authenticated webpage remains enforceable.

While the ruling is undoubtedly a huge victory for HIPAA-regulated entities that expend significant time, effort and resources to ensure compliance with HIPAA’s stringent requirement, it is also instrumental in that it sets a precedent with respect to curtailing executive power. In striking down the Guidance, the ruling also seeks to prevent the compounding of “small executive oversteps,” which can “result[ ] in larger transgressions down the road.” Moreover, the ruling essentially invalidates plaintiffs’ claims in any pending and outstanding litigation seeking to recover against HIPAA-regulated entities for the alleged harms resulting from the use of online tracking technologies on unauthenticated webpages.

HIPAA-Regulated Entities Should Remain Diligent about the Type of Information Collected Online

While this regulatory development is promising, a massive amount of litigation is still ongoing across the country related to the topic. As such, HIPAA-regulated entities should remain cautious when determining how and what type of tracking technologies are appropriate to implement.

Ropes & Gray will continue to monitor developments in this area. If you have any questions, please do not hesitate to contact the authors or your usual Ropes & Gray advisor.