OCR Warns Covered Entities and Business Associates of Its Broad View of HIPAA’s Applicability to Cookies, Pixels, and Other Tracking Technologies
On December 1, 2022 the Office of Civil Rights (“OCR”) at the U.S. Department of Health and Human Services issued a nonbinding guidance Bulletin on the use of online tracking technologies by covered entities and business associates (collectively, “regulated entities”) under the Health Insurance Portability and Accountability Act (“HIPAA”). The position taken by OCR in the Bulletin is further evidence of a continuing U.S. regulatory trend towards tighter regulation of online tracking technologies. Although the Bulletin does not have the full force and effect of law, it does demonstrate OCR’s perspective. And the broad view taken by OCR in this bulletin is highly likely to result in an increase in OCR complaints, OCR enforcement actions, and class action filings based on regulated entities’ use of online tracking technologies.
In this article, we (1) briefly describe the underlying online tracking technologies that have drawn regulatory attention; (2) explain the application of HIPAA to these technologies as outlined by OCR; (3) describe the obligations that result from that application; and (4) provide recommendations on addressing these risks in light of this new guidance.
Tracking Technologies of Interest to OCR
In this Bulletin, OCR focused on information captured through commonly used tracking technologies, such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts and, in the mobile context, embedded tracking codes within apps that capture information provided by users and users’ mobile device-related information, such as a unique device ID or advertising ID. According to OCR, these tracking technologies are generally developed and provided by third parties (e.g., tracking technology vendors) that receive information directly from these technologies and continue to capture information about users after they leave the website that embedded the tracking technology.
Applicability of HIPAA to Tracking Technologies
OCR addressed the wide range of information collected through online tracking technologies on websites and mobile applications, including an individual’s medical record number, home or email address, date of appointments, IP address or geographic location, medical device IDs, and other unique identifying codes. OCR stated that such information collected on a regulated entity’s website or mobile app generally is protected health information (“PHI”) because it is “indicative that the individual has received or will receive health care services or benefits from the covered entity.” Significantly, OCR asserted this is true even absent an existing relationship between the individual and the covered entity and absent the collection of specific treatment or billing information, such as dates and types of health care services.
Online Tracking Technology for Websites
User-Authenticated Webpages. In the Bulletin, OCR asserted that tracking technologies on user-
authenticated webpages generally have access to PHI, such as IP address, medical record
number, home or email address, appointment dates, and may also have access to individual
diagnoses and treatment information, prescription information, and billing information.
Unauthenticated Webpages. Although OCR stated that tracking technologies on unauthenticated
webpages generally will not provide tracking technologies with access to PHI, OCR asserts that, in
some instances, tracking technologies on unauthenticated webpages may have access to PHI.
OCR asserted that, in such cases, HIPAA Rules will apply. The specific examples OCR provided of
unauthenticated webpages in which HIPAA Rules may apply included:
-Login pages of patient portal;
-Registration webpages for patient portal;
-Appointment availability webpages;
-Doctor search webpages; and
-Informational webpages on specific symptoms or health conditions, such as pregnancy or
miscarriage.
Online Tracking Technology for Mobile Applications
Apps Developed or Offered by Regulated Entities
OCR stated that mobile app vendors, tracking technology vendors and other third parties to whom information is disclosed from mobile applications developed or offered by regulated entities will receive access to PHI (1) because of the nature of the information collected through such apps (e.g., health information, billing information, tracking of health-related variables); and (2) because the downloading and use of the mobile app is indicative that the individual has or will receive health care services or benefits. Per OCR, regulated entities that develop or offer mobile applications must comply with the HIPAA rules for the PHI the mobile app uses and discloses.
Apps Developed or Offered by Third Parties
OCR specified that the HIPAA Rules do not protect the privacy and security of information that users voluntarily download or enter into mobile apps that are not developed or offered by or on behalf of regulated entities.
HIPAA Obligations for Regulated Entities Using Tracking Technologies
In the Bulletin, OCR stated that regulated entities are required to comply with HIPAA Rules when using tracking technologies that permit access to PHI by:
- Ensuring Disclosures of PHI to Tracking Technology Vendors are Permitted, Required, or
Authorized, and Are Limited to the Minimum Necessary (Unless an Exception Applies). OCR
asserted that regulated entities must ensure all disclosures of PHI to tracking technology vendors
are specifically permitted by the Privacy Rule. OCR further stated that, unless an exception
applies, PHI disclosed must be limited to the “minimum necessary.” OCR stated that merely
informing individuals through a privacy notice of disclosures of PHI to tracking technology
vendors will not make that disclosure permissible. To make such disclosures, OCR asserts that
regulated entities must:
– Enter into a Business Associate Agreement (“BAA”) with All Tracking Technology Vendors and
confirm an Applicable Permission for the Disclosure. Per OCR, prior to disclosing PHI to a
tracking technology vendor, regulated entities must have a signed BAA in place and there
must be an applicable Privacy Rule permission for the disclosure. See 45 C.F.R. 164.502(a). It is
highly likely that some key tracking technology vendors will refuse to enter a BAA. See, e.g.,
Google Analytics: Best Practices to Avoid Sending PII: HIPAA Disclaimer (“you may not use
Google Analytics for any purpose or in any manner involving Protected Health Information”).
– Obtain the Individual’s HIPAA-Compliant Authorization before the Disclosure if There is No
Applicable Privacy Rule Permission or if the Vendor is Not a Business Associate. OCR also
asserted that if there is not an applicable Privacy Rule permission or if the vendor does not
meet the definition of a “business associate”, HIPAA-compliant authorizations will be required
prior to the disclosure of PHI. OCR specifically advised that website banners asking users to
accept or reject the use of tracking technologies will not constitute a valid HIPAA
authorization.
- Entering into BAAs with Tracking Technology Vendors that Meet the Definition of Business
Associate. OCR further asserted that if a tracking technology vendor meets the definition of a
“business associate” under HIPAA, the regulated entity must ensure that a HIPAA-compliant BAA
is in place with the vendor. OCR advised that if a regulated entity does not want to create a
business associate relationship with a vendor or if the vendor refuses to enter a BAA, then
individual HIPAA-compliant authorizations will be required before any disclosures of PHI. - Addressing Tracking Technology in Risk Analysis and Risk Management Processes. OCR
emphasized the obligation for regulated entities to account for the use of online and mobile app
tracking technologies in their risk analysis and risk management processes. See 45 C.F.R. 164.308. - Implementing Administrative, Physical, and Technical Safeguards. OCR also highlighted the
requirement for regulated entities to implement appropriate administrative, physical, and
technical safeguards to protect PHI and ePHI in the context of tracking technologies. See 45
C.F.R. 306-316. - Providing Breach Notification. Finally, OCR asserted that regulated entities are required to provide
appropriate breach notification to affected individuals, the regulator, and the media of
impermissible disclosures of PHI to a tracking technology vendor that compromise the security or
privacy of PHI when there is no Privacy Rule requirement or permission to disclose and there is no
BAA in place with the vendor. In such circumstances, OCR asserted that there is a presumption of
breach of unsecured PHI unless the regulated entity can demonstrate there is low probability that
PHI has been compromised. See 45 C.F.R. 164.402(2)
Recommended Action Items
In light of the regulatory and litigation risk arising from this Bulletin, we recommend that companies consider taking the following actions to reduce their risk of being the subject of complaints to OCR, OCR investigations, and/or class action litigation:
- Identify and evaluate current use of online tracking technologies in websites and mobile apps.
Determine whether information disclosed through such online tracking technologies is likely to be
deemed PHI based on the context of the collection. - Analyze current practices against OCR guidance in the Bulletin, and conduct a risk analysis (taking
into account both regulatory and litigation risks) in furtherance of determining whether to
discontinue, in whole or in part, use of online tracking technologies, particularly for authorized
webpages and mobile apps.
If decision is made to continue, in whole or in part, the use of online tracking technologies
involving the disclosure of PHI, we recommend considering the following actions:
– Analyze opportunities to reconfigure such technologies to limit PHI disclosures through
tracking technologies on unauthenticated webpages.
– Enter into compliant BAAs with online tracking technology companies and mobile app
companies, including but not limited to BAAs with entities meeting the “business associate”
definition.
– Obtain HIPAA-compliant authorizations before individuals are set up to use authenticated
webpages or mobile apps.
– Implement required administrative, physical, and technical safeguards required by the Security
Rule, in accordance with OCR guidance in the Bulletin.
– Confirm that ongoing HIPAA security risk assessments and management accounts for online
tracking technology disclosures.
– Inform employees involved in selecting, entering into agreements with, and obtaining services
from online tracking technology providers and/or mobile app providers, as well as employees
with privacy and security-focused vendor oversight responsibilities, of HIPAA compliance risks
and obligations arising from online tracking technologies.
- Evaluate obligations to provide breach notifications to individuals, regulators, and media in
accordance with OCR guidance in the Bulletin.
Regulated entities should prioritize evaluating and updating their online tracking technology practices, as necessary, to address regulatory expectations for the use of such technologies set forth in OCR’s Bulletin. Taking prompt action will reduce the risk of entities becoming the target of complaints to OCR, an enforcement action, and/or class action litigation.
Co-authors: Eleazar Rundus, Associate Attorney at Fey LLC. Will Davis, Associate Attorney at Fey LLC.
The post Cookies May be Bad for Your Health appeared first on HIPAA Journal.