The American Hospital Association announced Nov. 2 that it filed a lawsuit against the Office for Civil Rights related to the agency's guidance "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates."
The December 2022 guidance provides OCR's view on tracking technologies and protected health information. Specifically, per the guidance, HIPAA covered entities and business associates are prohibited from using tracking technologies, such as Google Analytics, on its user-authenticated websites (e.g., patient portals) and, in certain circumstances, on its unauthenticated websites (e.g., public website).
AHA believes the restrictions overstep the necessary balance of protecting patients' health information with ensuring the flow of information necessary to improve public health. AHA's suit alleges that OCR exceeded its authority in issuing the guidance and that the agency "unlawfully issued [the guidance] without providing any reasoning supporting its novel legal assertions, without acknowledging the government's own use of implicated third-party technologies, and without following required notice-and-comment rulemaking processes."
You can read more about the AHA's lawsuit in its press release.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.