A federal judge ruled on June 20 that the HHS Office for Civil Rights (OCR) had unlawfully exceeded “HIPAA’s unambiguous text” by prohibiting covered entities (CEs) and business associates (BAs) from using web-tracking technologies on their public web pages.[1]
U.S. District Court Judge Mark Pittman granted a motion for summary judgment from the American Hospital Association (AHA) to vacate part of OCR’s most recent guidance on the tracking technologies known as pixels. The ruling only affects public-facing web pages, where users do not need to log in to view content.
Pittman declined to permanently enjoin HHS from enforcing its web-tracking technology privacy rules against CEs and BAs, saying that vacatur was the preferred remedy. In its petition for summary judgment, AHA had sought a permanent injunction against enforcement of the rules on public-facing websites.
Still, the judge—a former Texas Court of Appeals judge who was appointed by former President Donald Trump in 2019 to the District Court for the Northern District of Texas—strongly sided with AHA and its co-plaintiffs, which include Texas Hospital Association, Texas Health Resources and United Regional Health Care System, regarding web-tracking technology on public-facing web pages.
“It’s easy for eyes to glaze over at a thirty-page opinion discussing the administrative esoterica accordant with HIPAA compliance,” Pittman wrote. “But this case isn’t really about HIPAA, the Proscribed Combination [AHA’s term for OCR’s ban on web trackers that link an individual’s IP address to a public web page addressing specific health concerns or specific providers], or the proper nomenclature for PHI [protected health information] in the Digital Age. Rather, this is a case about power. More precisely, it’s a case about our nation’s limits on executive power.”
Pittman continued: “In the grand scheme, the Revised Bulletin is one small guidance document among countless others issued by HHS and other executive entities. But a wise Man once said that ‘one who is faithful in a very little is also faithful in much, and one who is dishonest in a very little is also dishonest in much.’ Luke 16:10 (EVS). While the Proscribed Combination may be trivial to HHS, it isn’t for covered entities diligently attempting to comply with HIPAA’s requirements.”
The court’s ruling does not address OCR’s policy for user-authenticated web pages, where a user has logged in and thus can be identified. It also does not touch on any potential HIPAA privacy issues in mobile apps.
