An analysis of the websites of non-federal acute care U.S. hospitals has confirmed that 96% of those websites use tracking technologies that share visitor data with third parties such as Meta, Google, LinkedIn, or Snapchat.

In December 2022, The Department of Health and Human Services issued guidance for HIPAA-regulated entities on the use of website tracking technologies. The guidance made it clear that under HIPAA, these technologies cannot be used if they share protected health information with third parties unless the third parties in question are authorized to receive the data – and a HIPAA-compliant business associate agreement is in place – or if consent to share the data is obtained from patients. In July 2023, OCR and the Federal Trade Commission (FTC) issued around 130 warning letters to hospitals and telehealth companies to remind them of their obligations under HIPAA with respect to website tracking technologies.

OCR issued updated guidance in March 2024 clarifying its position, confirming that OCR accepts that not all information collected through these tools is classed as protected health information, stressing that “regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.”

Prior to OCR issuing guidance, a study conducted by researchers at the University of Pennsylvania in Philadelphia determined that 99% of hospitals in the United States were using tracking technologies on their websites that transferred data to third parties. A follow-up study – published in the JAMA Network – was conducted on 100 hospitals between November 2023 and January 2024 that looked at whether hospitals were transferring visitor data to third parties via these tracking technologies and if they had easy-to-find privacy policies that advised visitors about the use of these tools, how and why data was collected, and the third parties that received that data.

Out of 100 hospital websites, 96 transferred user information to third parties. 71 websites had privacy policies, 69 stated the types of information that was automatically collected, 70 indicated how that data would be used, 66 stated the categories of third parties that would receive the collected information, but only 40 named the specific third parties that would receive the data. While some privacy policies state well-known names of companies that receive the data, Google for instance, the researchers note that hospital websites transfer data to a median of 9 domains, with previous research indicating many unfamiliar companies receive data from hospital websites, including data brokers and companies with little to no consumer-facing presences. The researchers point out that a substantial number of hospital websites are not providing users with adequate information about how their data will be collected and used, either by not including a privacy policy or not disclosing sufficient information to website visitors about how their data will be used.

The post 96% of Hospitals Still Use Website Tracking Technologies That Share Data with Third Parties appeared first on HIPAA Journal.

The electronic health record provider Epic Systems has cut off access to data for a startup called Particle Health after alleging the firm was sharing patient data with third-party companies for reasons not related to treatment. Epic, the largest provider of electronic health records in the United States, alleged that Particle Health was engaging in unauthorized and unethical data sharing that had the potential to violate the HIPAA Privacy Rule. On Thursday last week, Epic notified customers that the connection with Particle Health had been cut off.

Particle Health is a member of the Carequality network, which supports interoperability and facilitates health data exchange. Members of the network act as middlemen that connect different healthcare networks across the United States and the Carequality interoperability framework is used to exchange more than 400 million documents each month. To join the Carequality network, a company must agree to only share patient data for certain purposes, one of which is for treatment. Epic responds to requests for data for treatment purposes and requires the recipient to be providing care to the patient whose records have been requested.

On March 21, 2024, Epic filed a formal dispute with Carequality about Particle Health and its participant organizations and alleged that they may be inaccurately representing the purpose for record requests and suspended Particle Health’s connection the same day. Particle Health explained in an April 9, 2024 blog post that immediate action was taken to address the issue after Epic blocked access to data requests for a subset of its customers and confirmed that it is strongly committed to privacy and security and subjects its customers to a rigorous onboarding process and requires them to adhere to the standards of the Carequality framework. Particle Health explained that Epic did not shut off data access for the company and Carequality has not suspended Particle Health’s ability to participate in data exchange; however, on March 21, 2024, Epic stopped responding to data requests for some of Particle Health’s customers without a clearly stated reason for doing so.

Particle Health also expressed concern that certain individuals at Epic thought that some of its customers might be inaccurately representing the purpose associated with their record retrievals, then extrapolated that to assert that Particle Health might not be fulfilling its obligations as a Carequality implementer. Particle Health said it strongly objects to the latter and is happy to investigate the former, and pointed out that the company has always acted in good faith and followed guidelines and said there is no standard reference to assess the definition of treatment nor the application of the definition of treatment as it pertains to data requests.

“This decision has negatively impacted thousands of patients, and potentially puts 6M+ patient encounters per year at risk,” explained Particle Health founder, Troy Bannister, in a post on LinkedIn. “We believe strongly that this unilateral action is a violation of important rules developed to ensure that this doesn’t happen and is critical to the uninterrupted treatment of patients everywhere.”

Epic said the reason for cutting off access was due to anomalies in patient record exchange patterns, such as requests for large numbers of records in a particular geographic region, and that certain Particle Health customers were not sending back new data from patients, which is a red flag that suggests the data is being shared for reasons other than treatment. After evaluating Particle Health’s new participant connections, including organizations such as Integritort, MDPortals, and Reveleer, Epic determined that data sharing was likely not for treatment purposes and blocked access for a subset of Particle Health’s customers. Epic also said that it heard from another Carequality member that Integritort was attempting to use patient data to identify participants in a potential class action lawsuit. Epic requested that Particle Health provide further information on how its customers qualify for treatment uses.

“We have made significant progress towards resolving this connectivity, with some customers already turned back on,” explained Particle Health in a blog post. “We are continuing working collaboratively with Epic and remain committed to upholding our mission by standing up for our customers and supporting the legitimate use of health data exchanges.”

The post Epic Systems Shuts off Access for Certain Particle Health Customers Over Patient Privacy Concerns appeared first on HIPAA Journal.