Healthcare Privacy and Cybersecurity Lawyer, Partner, Chicago Leader - Digital Assets & Data Management Practice Group at BakerHostetler
Feeling EXTREMELY vindicated. Today the court presiding over AHA v. Bacerra - the one where the healthcare industry joined together to fight OCR's #trackingtechnology guidance - issued its order, and not only was it an absolute joy to read, the judge nailed it. "The Court GRANTS the Hospitals’ request for declaratory judgment and DECLARES that the Proscribed Combination [IP address + visit to unauthenticated hospital website], as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL, as it was promulgated in clear excess of HHS’s authority under HIPAA. .....While the Court DENIES the Hospitals’ request for a permanent injunction, it GRANTS their request for vacatur and ORDERS that the Proscribed Combination be VACATED." CC: my BakerHostetler Pixel Queens Stefanie Ferrari, Lynn Sessions, Courtney L. Litchfield, and Roma Gujarathi I love that the court acknowledged that we weren't out there "advocating for [hospitals'] right to disclose" sensitive information, and that "HIPAA compliance is woven deep into hospital operations, with implications for every way in which hospitals interact with patients or patients’ medical information." And that, "[i]f enforced, the Proscribed Combination would have a profound chilling effect on providers’ use of technology vendors to facilitate critical UPWs. While healthcare providers can 'host websites and patient portals without using any third-party analytics . . . it serves nobody to have websites that patients do not know and cannot navigate effectively.'” I will be blogging about how this impacts HIPAA covered entity's decisions on tracking technologies and the remaining legal risks shortly, and am linking my prior blog posts on this issue in the comments. But as someone whose writing on this issue has been called "spicy", I would like to take this opportunity to highlight some of my favorite lines in the decision - #gamerecognizesgame. *In a last-ditch effort to evade review, HHS argues the Revised Bulletin “is not sufficiently concrete to constitute the consummation of the agency’s decisionmaking.” . . . But numerous cases have held that guidance documents can’t escape review merely because they’re poorly written. *As a whole, these signs point to one conclusion: HHS tried to tweak the IIHI definition and got caught. With its hand in the cookie jar, the Department now backtracks. In doing so, it gaslights covered entities by arguing the Bulletins restate what the rule has been all along. *The Department’s third argument fails because it’s wrong. Even if an OCR investigation and enforcement action would be required for legal consequences, that fact does not rob the Revised Bulletin of legal effect... An ordinance banning skateboards in the park doesn’t become law only when a joyriding perp is apprehended. Much to Texans’ chagrin, speed limits are still speed limits long before blue lights flash.
Here is our blog post on the decision, which goes deep into the nuances of applicability that are important to ensure marketing doesn't go wild re-implementing pixels: https://www.bakerdatacounsel.com/blogs/northern-district-of-texas-flashes-the-blue-lights-on-ocrs-pixel-guidance/
The judge had me from the first sentence: "Congress passed the Health Insurance Portability and Accountability Act (“HIPAA”) in 1996 because health information needed more protections and the world needed more acronyms." Well played.
Great victory today for our healthcare clients! Bravo to the two brave hospitals that led this challenge, the AHA for their advocacy here and the 30 hospitals who put their names on our amicus brief earlier this year in support! It’s a good day!
Well done Baker team! And those quotes are almost as spicy as your blogs 🔥
This one was a head-scratcher from day one as far as I was concerned (and agree that the "revised" guidance did not help). Congratulations to you and your team on the important win.
You are indeed spicy. In the best possible way! Thanks for unpacking this important decision so quickly.
Amazing.
This is huge! Has there been any indication of intent to appeal or issue revised guidance?
Healthcare Privacy and Cybersecurity Lawyer, Partner, Chicago Leader - Digital Assets & Data Management Practice Group at BakerHostetler
2moBlog post on original guidance: https://www.bakerdatacounsel.com/blogs/ocr-guidance-on-use-of-tracking-technologies-warrants-review-of-website-tech/