As noted back in December 2022, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) has issued dramatic guidance (often called the Bulletin) that targets the use of so-called Internet “tracking technologies” on the public websites of HIPAA-covered entities. Fueled by this guidance, healthcare providers have faced a dual threat of regulatory inquiries and widespread class-action litigation.
A recently filed lawsuit is challenging this regulatory guidance, arguing that the Bulletin exceeds the OCR’s regulatory authority and violates administrative law because it is arbitrary and capricious and was issued without proper notice and comment. See Am. Hosp. Assn. et al. v. Becerra et al., No. 4:23-cv-01110 (N.D. Tex. filed Nov. 2, 2023).
On Jan. 12, a team of BakerHostetler attorneys, including Lynn Sessions, Paul Karlsgodt, David Carney, Tamara Baggett, Kyle Cutts, Michelle Gomez, Stefanie Ferrari, and Andrew Thompson, filed an amicus brief on behalf of 30 hospitals, health systems and healthcare providers, supporting the plaintiffs’ position and urging the court to set aside the Bulletin.
In the brief, the BakerHostetler team explains that the guidance concerning “tracking technologies” sweeps broadly to include ubiquitous Internet analytics tools that are used on almost every major website – including federal government websites. Rather than “track” any individual user, these tools allow website operators to understand who is visiting their site and what users as a whole are doing while on the site. This enables website designers to create more engaging and useful websites, and it allows hospitals in particular to target their outreach efforts in the community.
The BakerHostetler team used the amicus brief to show that hospital websites serve critical roles in the community that are undermined by the new guidance. As the federal government has recognized, healthcare misinformation exploded through the COVID-19 pandemic, and use of artificial intelligence threatens to worsen the problem. Health system websites are a key resource in the fight against misinformation, and they host reliable and up-to-date medical information that is used not just by patients but also by the general public. But the Bulletin prohibits hospitals from using analytics tools that are allowed on all other websites that also share public healthcare information, thus privileging potentially less-reliable sources and impeding hospitals’ efforts to educate their communities – not to mention raising serious First Amendment concerns. Additionally, most hospital websites host online portals where patients can view and manage their health information, thereby assisting the federal government in a decades-long effort to modernize health records. The Bulletin hampers online outreach and website optimization efforts, which are critical to ensuring that patients can effectively find and use these platforms.
The brief urges the court to strike down the guidance because the federal government failed to acknowledge these concerns – much less balance them against the purported rationales for issuing the guidance – or give hospitals and the public the opportunity to comment on these important considerations.
We will continue to monitor the federal guidance on web technologies and advocate for our clients across the full range of data privacy inquiries and disputes.
[View source.]
