On Monday, the U.S. Department of Health and Human Services Office for Civil Rights issued updated guidance on the use of online tracking technologies by covered entities and business associates (here, referred to as “regulated entities”) under the Health Insurance Portability and Accountability Act Privacy Rule. The intent of the guidance is to provide regulated entities with considerations when using tracking technologies on their websites and mobile applications.
The updated guidance came after a group of hospitals and health care groups sued the OCR over its previous guidance on the topic (the plaintiffs claim, among other things, that the rule was issued improperly and that it misinterprets the requirements of the privacy rule). Unfortunately, the updated guidance still leaves some questions unanswered.
Both the previous and updated guidance documents differentiate between user-authenticated and unauthenticated web pages. A user-authenticated webpage requires an individual to enter unique identifiers (usually an email or username in combination with a password) to access content curated or intended for that individual (for example, the individual’s medical file or appointments). An unauthenticated page does not require users to enter unique identifiers and is generally intended for the public (for example, a facility’s homepage or contact page). Both guidance documents also discuss mobile applications, which are largely treated like user-authenticated webpages because users must generally create accounts before the applications can be used.
OCR’s updated guidance reflects its view that tracking technologies used by regulated entities on user-authenticated webpages and mobile applications generally do collect protected health information, referred to as PHI. Where the new guidance differs, however, is on the information collected via tracking technologies on unauthenticated webpages. Now OCR acknowledges that “[t]racking technologies on many unauthenticated webpages do not have access to individuals’ PHI,” and, as a result, the use of these technologies is not governed by the HIPAA Privacy Rule. (Organizations should note that the use of these tools may be governed by other state and federal privacy laws.) OCR nonetheless continues to assert that, in some cases, tracking technologies on unauthenticated webpages may still have access to users’ PHI.
To help regulated entities discern when they are acquiring PHI on unauthenticated pages and when they are not, OCR provides examples to illustrate what it believes qualifies as the collection of PHI on unauthenticated pages and what does not. OCR notes that a visit to a regulated entity’s webpages for job postings or visiting hours does not involve PHI. On the other hand, the collection and sharing of information from users who are scheduling medical appointments or checking symptoms does involve the collection of PHI.
Some of OCR’s examples are less helpful than these. For example, OCR provides examples of users visiting the same webpage for different reasons – one as a student conducting research, and the other as a prospective patient. OCR notes that the student’s visit would not involve the collection of PHI, and would therefore not be subject to the HIPAA privacy rule, while the visit of the prospective patient would. Unfortunately, the new guidance does not acknowledge that regulated entities have no way of discerning between these two different types of visits to the same web page.
OCR has not indicated whether it will issue further updates on this issue. For now, and pending the result of the litigation in this matter, regulated entities have this guidance to inform any current and future configurations of tracking technologies they use.
