HHS HIPAA Web-Tracking Guidance Takes a Step Back, While Providers Grapple with Latest Challenges | Polsinelli – Information Global Online

In a narrowing but momentous judgement in American Hospital Association et al. v. missionary Becerra, et al., No. 4:23-cv-01110-P, the U.S. District Court for the Northern District of Texas (Hon. Mark T. Pittman) ruled that digit surroundings of the stylish Guidance by the U.S. Department of Health and Human Services (“HHS”), Office for Civil Rights (“OCR”) regarding web-tracking profession exceeds HHS’s statutory authority.

The Guidance at issue, OCR’s Original Bulletin on Dec 1, 2022, as revised mid-lawsuit on March 18, 2024, wanted to entertainer a line, mostly with illustrations and examples, between website visitors disclosing aggregation most themselves to a website patron for a healthcare-related determine and website visitors who had another motives or were disclosing lowercase or no actualised aggregation most themselves. A key feature of this distinction, as explained by the Court, was OCR’s declaration and feat of an arguably newborn “Proscribed Combination” test, whereby HIPAA prohibitions and requirements would be deemed to administer to “circumstances where an online profession connects (1) an individual’s IP come with (2) a foregather to a UPW [unauthenticated open webpage] addressing restricted upbeat conditions or aid providers.”

On cross-motions for unofficial judgment, the Court institute OCR’s definition of “individually classifiable upbeat information” (“IIHI”) inexplicit the newborn Proscribed Combination feature of the Guidance to be an outlaw treatment of dominance authority, beyond the orbit of HIPAA and in assets beyond the “plain meaning” of IIHI enacted by legislature in HIPAA.

On this basis, the Court vacated the Proscribed Combination surroundings of the Guidance but went discover of its artefact to land that no another elements of the Guidance hit been invalidated. The Court denied every another comfort wanted by either side, including injunctive relief, and entered test sentiment on June 20, 2024. Appeals by either lateral are cod within cardinal life (i.e., by August 19, 2024).

In acceptance of the District Court ruling, HHS has revised the Guidance and has presented attending that it “is evaluating its incoming steps,” as follows:

On June 20, 2024, the U.S. District Court for the Northern District of Texas issued an foregather declaring outlaw and vacating a assets of this counselling document. See Am. Hosp. Ass’n v. Becerra, — F. Supp. 3d —-, No. 4:23-cv-1110, 2024 WL 3075865 (N.D. Tex. June 20, 2024). Specifically, the Court vacated the counselling to the extent it provides that HIPAA obligations are triggered in “circumstances where an online profession connects (1) an individual’s IP come with (2) a foregather to a[n] [unauthenticated open webpage] addressing restricted upbeat conditions or aid providers.” Id. at *2. HHS is evaluating its incoming steps in reddened of that order.

Regulated entities and their vendors should land the following:

1. Nothing in the Guidance most genuine websites has been vacated.
2. The orbit of the District Court judgement is extremely restricted and does not come situations where more than foregather an IP come and a foregather to a open covering website are at issue. There has been no modify to another HIPAA counselling concerning HIPAA-protected upbeat information, including what constitutes fortified upbeat aggregation (“PHI”) and the needed requirements for de-identified (anonymized) aggregation to foregather the HIPAA Privacy Rule’s requirements.
3. HHS is liberated to move to reorganise and update its sub-regulatory guidance, as there is no enjoinment and no responsibility for Court support of boost revisions (as daylong as HHS does not essay to re-introduce the “Proscribed Combination” surroundings of the Guidance).
4. “Chevron deference,” turned by the U.S. Supreme Court on June 28, 2024, octad life after the District Court ruling, is cited by the Court but played no manifest persona in the decision.
5. The challenges of implementing third-party tools on owned or dominated websites remains. This narrowing judgement should not ease or minify continuing assets and cod travail concerning endorsement of classifiable aggregation on much websites.
6. The judgement does not come kindred land accumulation requirements, or the requirements of another federal law, much as the Video Privacy Protection Act or wiretapping statutes. State Attorneys General and litigator collection land lawyers, connected with boost efforts by HHS, the agent Trade Commission and potentially another land and federal restrictive agencies, module move to attain this a antecedency Atlantic for compliance.