HHS files, then drops, its data-tracking lawsuit appeal

In less than 24 hours this week, the U.S. Department of Health and Human Services filed an appeal in American Hospital Association v. Becerra – a lawsuit that sought to bar enforcement of an Office for Civil Rights rule governing use of online tracking tools – and then promptly withdrew it.

The American Hospital Association, which has sought to protect its members’ ability to use the tracking tools, issued a statement Thursday in which Chad Golder, AHA’s general counsel, called the result a “victory.”

WHY IT MATTERS

While HHS had appealed the Fort Worth, Texas federal court’s June ruling, it quickly withdrew the appeal, without saying why.

“The HHS Office for Civil Rights has no comment on litigation,” a spokesperson for the agency said by email on Thursday.

The OCR rule, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” aimed to protect patient privacy by limiting the scope of tracking pixel use. 

But the Texas court blocked the agency’s ability to prohibit hospital websites from using consumer-tracking technology under HIPAA and the Federal Trade Commission’s Health Breach Notification Rule, issued in a December 2022 guidance on use of the tools. 

The American Hospital Association has long argued that HIPAA-covered entities need to use online tracking pixels on websites and mobile apps, and that OCR’s attempt to curtail the use of third-party web technologies that capture IP addresses on public webpages was both “unlawful and unwise.”

THE LARGER TREND

In the original complaint the AHA filed in federal court, the hospital group said enforcement of OCR’s regulations on pixel-tracking tools would disrupt the “balance that HIPAA and its regulations strike between privacy and information-sharing.”

“The HHS rule exceeds the government’s statutory and constitutional authority, fails to satisfy the requirements for agency rulemaking and harms the very people it purports to protect,” the AHA said when it filed the lawsuit in November.

While Advocate Aurora Health paid more than $12.2 million to settle a class-action suit over a pixel-related privacy breach in October 2022, legal advisors contended that there were safe ways for health systems and hospitals to manage pixel tracking as the case played out in court. 

Joined by the Texas Hospital Association, Texas Health Resources and United Regional Health Care System, the hospital group sued HHS. Seventeen state hospital associations and 30 hospitals and health systems filed friend-of-the-court briefs supporting AHA and its coplaintiffs in the lawsuit, according to AHA statement.

ON THE RECORD

“As the AHA repeatedly explained to OCR – both before and after OCR forced the AHA to file its lawsuit – this rule was a gross overreach by the federal government, imposed without any input from healthcare providers or the general public,” Golder said in the statement just hours after HHS filed and then dropped the appeal.

“Now that the Bulletin’s illegal rule has been vacated once and for all, hospitals can safely share reliable, accurate health care information with the communities they serve without the fear of federal civil and criminal penalties.”

Andrea Fox is senior editor of Healthcare IT News.
Email: afox@himss.org
Healthcare IT News is a HIMSS Media publication.