HHS Office for Civil Rights (OCR) Director Melanie Fontes Rainer is putting HIPAA covered entities (CEs) on notice: OCR is looking closely at the web-tracking technologies known as “pixels” and is warning CEs to survey their websites and bring themselves into compliance with the HIPAA Privacy Rule as quickly as possible.
Rainer, presenting at the 2023 HIPAA Summit in what she said was her first public appearance at a HIPAA industry event as OCR director, explained that web-tracking technologies have seen lots of publicity since they first were spotlighted in mid-2022.[1]
“This is an area of enforcement priority and interest for OCR, particularly in light of the public attention we’ve seen” with pixels in reproductive healthcare, substance abuse and behavioral health, “which we think is problematic,” Rainer said. “And so we want to make sure we’re being responsive to what we’re seeing.”
In a question-and-answer session,[2] moderated by attorney Adam Greene, co-chair of the health information and HIPAA practice at Davis Wright Tremaine LLP and the event’s moderator, Rainer was asked if OCR is considering altering or limiting its December guidance on web pixels.[3]
“In particular, the guidance seems to require hospitals to stop using Google Analytics on their public-facing authenticated websites,” Greene said. “Google Analytics is the most widely used web analytics service available and is used by the vast majority of hospitals for purposes that were not thought to implicate HIPAA until the recent guidance was issued. Google Analytics will not sign a BAA [business associate agreement]. What are OCR’s enforcement priorities with respect to the December guidance? Will OCR provide a grace period to allow hospitals to come into compliance?”
Rainer said that the use of online tracking technologies has been getting significant coverage in the news, “and these present significant HIPAA compliance concerns, especially where Google Analytics will not sign a BAA if they have access to electronic protected health information. And so we issued this bulletin to highlight both to covered entities and to individuals the risk of such tracking technologies, and to remind covered entities of their obligations with respect to when they use such technologies.”
The OCR guidance notes that these tracking technologies might exist on a webpage where they can access protected health information (PHI), in which case HIPAA rules apply. “And if the PHI is going to a third party, such as Google Analytics, there needs to be a business associate agreement in place, and you are still on the hook to not involuntarily or voluntarily disclose this data to a third party,” Rainer said.
Still, OCR’s goal is to drive voluntary compliance with the regulations, Rainer said. “So, we consider the facts and the circumstances how to best address potential HIPAA violations, and we also note that a number of our investigations are resolved without a resolution agreement or civil monetary penalty—in other words, we close many investigations based on corrective actions taken by a regulated entity before or during the course of the investigation, or by providing technical assistance.”
