On August 29, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) withdrew its appeal of the U.S. District Court for the Northern District of Texas’s (Court) June 20, 2024 decision in American Hospital Association, et al. v. Xavier Becerra, et al.
Until and unless there is additional rulemaking, guidance, or litigation on this subject, the Court’s decision will serve to modify the tracking technologies guidance, assuming the withdrawal is granted. The Court held HHS exceeded its administrative authority and vacated key portions of its tracking technologies guidance bulletin, including specifically that metadata (e.g., IP address) collected from website users via a regulated entity’s unauthenticated website does not constitute individually identifiable health information. For more about the Court’s June 20 decision, the tracking technologies guidance bulletin, or other enforcement in this space, check out our prior alert.
As predicted in our prior alert, following the Court’s decision, on June 26, HHS added language to its guidance noting HHS is evaluating next steps in light of the order. At the time of this publication, HHS has not further modified its tracking technologies guidance bulletin. It remains to be seen whether HHS will further modify vacated portions of the guidance following its decision to withdraw its appeal. As HHS considers its options for next steps, the fall of Chevron deference is likely to complicate viable options.
Entities subject to HIPAA should continue to monitor this issue for developments.
