Last week, HHS filed a motion asking the Fifth Circuit’s permission to voluntarily dismiss its appeal of a District Court order directing HHS to rescind its guidance restricting hospitals’ ability to track online traffic to their websites. The District Court found in favor of the American Hospital Association’s (AHA) challenge to HHS’ web-tracking guidance.
In 2022, HHS (through the Office for Civil Rights) issued guidance that broadened the definition of what types of information could be considered “individually identifiable health information” under HIPAA that would trigger a covered entity’s obligation to abide by HIPAA when using online tracking technologies. HIPAA defines individually identifiable health information as information that “relates to . . . an individual” and “identifies the individual” or “with respect to which there is a reasonable basis to believe the information can be used to identify the individual.” Protected health information is individually identified health information that is collected or maintained by a covered entity or business associate.
The HHS guidance provided that when an online tracking technology connects the following two elements, such combined information constitutes individually identifiable health information: (1) an IP address with (2) a visit to an unauthenticated public webpage addressing health conditions or healthcare providers. After AHA challenged HHS’ 2022 guidance, HHS revised the guidance page to soften the rule by changing the second element to “a visit to a UPW [unauthenticated public webpage] with the intent to address the visitor’s specific health conditions or healthcare providers.”
The AHA challenged the HHS guidance on the basis that HHS exceeded its authority when it issued the guidance and violated the Administrative Procedure Act. HHS argued that the guidance was not a “final agency action” and HHS should win on the merits because: (1) the guidance was consistent with HIPAA’s definition of individually identifiable health information, (2) the guidance was not “arbitrary and capricious,” and (3) HHS had the authority to issue the guidance. Both parties moved for summary judgment and the District Court granted AHA’s motion in part, finding that the HHS guidance created new substantive legal obligations for covered entities.
The District Court found that it had jurisdiction because the HHS guidance amounted to final agency decision-making that created new legal rights, obligations, and consequences. The court found it persuasive that the guidance created new obligations because most covered entities had not been treating this type of website tracking activity as subject to HIPAA. The court also noted that a visit to a UPW that is specific to a certain health condition does not make that information individually identifiable health information because the visit can be merely “indicative” of a person’s individually identifiable health information. For example, a person could be visiting a website about dialysis, but the individual could be visiting for any number of reasons that are not related to their own health status or treatment such as researching dialysis for a school paper or visiting on behalf of another person on dialysis. The court found that the subjective intent element was unworkable and broadened the definition of individually identifiable health information beyond what was contemplated by HIPAA and, therefore, must be rescinded. The other aspects of the website-tracking guidance were not affected by the decision.
A copy of the District Court’s Order is available here. The full text of HHS’ motion is available here. HHS’ guidance is available here.
