American Hospital Association’s Post

ICYMI: U.S. Department of Health and Human Services (HHS) issued penalties for information blocking, and they went into effect on September 1st. Check out our blog chock full of information on information blocking including examples, answers to frequently asked questions and how you can stay out of information blocking hot water. Check it out here: https://hubs.la/Q024FDcC0 #ontheblog #incaseyoumissedit #informationblocking

🚨 The American Hospital Association (AHA) has filed a lawsuit against the Department of Health and Human Services (HHS) over the new online tracking rules. 📢 The lawsuit argues that the rule disrupts the "balance that HIPAA and its regulations strike between privacy and information-sharing" and is counter to the practices of several federal healthcare websites. The lawsuit named the Director of the Office for Civil Rights (OCR), Melanie Fontes Rainer, and Health and Human Services (HHS) Secretary Xavier Becerra as defendants. The AHA is questioning why federal sites like Medicare.gov and those run by the Veterans Health Administration are allowed to use the same tracking tools the OCR seeks to ban. 🤔 This situation highlights an important issue regarding using third-party technologies in healthcare and its impact on patient service and communication. Read more about it at Healthcare IT News: https://lnkd.in/gyxHN_GP #healthcare #transparency #pricing #policy #lawsuit #aha #hhs #hippa

Feeling EXTREMELY vindicated. Today the court presiding over AHA v. Bacerra - the one where the healthcare industry joined together to fight OCR's #trackingtechnology guidance - issued its order, and not only was it an absolute joy to read, the judge nailed it. "The Court GRANTS the Hospitals’ request for declaratory judgment and DECLARES that the Proscribed Combination [IP address + visit to unauthenticated hospital website], as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL, as it was promulgated in clear excess of HHS’s authority under HIPAA. .....While the Court DENIES the Hospitals’ request for a permanent injunction, it GRANTS their request for vacatur and ORDERS that the Proscribed Combination be VACATED." CC: my BakerHostetler Pixel Queens Stefanie Ferrari, Lynn Sessions, Courtney L. Litchfield, and Roma Gujarathi I love that the court acknowledged that we weren't out there "advocating for [hospitals'] right to disclose" sensitive information, and that "HIPAA compliance is woven deep into hospital operations, with implications for every way in which hospitals interact with patients or patients’ medical information." And that, "[i]f enforced, the Proscribed Combination would have a profound chilling effect on providers’ use of technology vendors to facilitate critical UPWs. While healthcare providers can 'host websites and patient portals without using any third-party analytics . . . it serves nobody to have websites that patients do not know and cannot navigate effectively.'” I will be blogging about how this impacts HIPAA covered entity's decisions on tracking technologies and the remaining legal risks shortly, and am linking my prior blog posts on this issue in the comments. But as someone whose writing on this issue has been called "spicy", I would like to take this opportunity to highlight some of my favorite lines in the decision - #gamerecognizesgame. *In a last-ditch effort to evade review, HHS argues the Revised Bulletin “is not sufficiently concrete to constitute the consummation of the agency’s decisionmaking.” . . . But numerous cases have held that guidance documents can’t escape review merely because they’re poorly written. *As a whole, these signs point to one conclusion: HHS tried to tweak the IIHI definition and got caught. With its hand in the cookie jar, the Department now backtracks. In doing so, it gaslights covered entities by arguing the Bulletins restate what the rule has been all along. *The Department’s third argument fails because it’s wrong. Even if an OCR investigation and enforcement action would be required for legal consequences, that fact does not rob the Revised Bulletin of legal effect... An ordinance banning skateboards in the park doesn’t become law only when a joyriding perp is apprehended. Much to Texans’ chagrin, speed limits are still speed limits long before blue lights flash.

Judge rules in favor of AHA vacating HHS online tracking ‘bulletin’ as unlawful and beyond agency authority Many people may recall the U.S. Department of Health and Human Services (HHS’) guidance on the use of pixels and online tracking technologies on HIPAA-covered entity websites, like hospitals and healthcare orgs (HHS has actually issued at least 3 separate guidance pieces on this topic, in 2022, 2023 and 2024). You may also recall that in November 2023, the American Hospital Association (AHA) filed a lawsuit challenging HHS’ authority to make such a rule, as well as the process HHS followed. Last week, a federal judge in Texas issued an opinion and order vacating the part of HHS/OCR’s guidance restricting a CE’s use of online tracking technologies on unauthenticated public webpages (“UPWs”). Of course, the reality of the matter is that this is still only a lower court decision, and not yet definitive precedent; not to mention that this decision can be appealed, stayed, etc. So while everyone should consult their own legal counsel, it would appear that the option of least risk – at least at the moment - is for covered entities to continue avoiding using tracking technologies and analytic tools on any of their public webpages, to the extent that there is the potential for collection of PHI on those pages. Finally, FWIW, one paragraph in the TX decision that I personally found especially interesting - because it specifically identified situations where even the TX court would agree that a visitor to a UPW would be deemed to be disclosing IIHI (and thus be engaged in a HIPAA-covered disclosure) - was as follows:  "If a covered entity’s UPW greets visitors with a dropdown box requesting their subjective motive for visiting the page, that would be one thing. The Department can and should remind covered entities that the Privacy Rule would apply in those circumstances. But absent such an admittedly bizarre scenario, the Proscribed Combination cannot become IIHI as unambiguously defined." (p. 25). #meta #pixels #HHS #HIPAA #hospitals #PHI #protectedhealthinformation https://lnkd.in/e8GEesMk

Catch up on the latest BCBS Louisiana updates here ⬇

For a safer healthcare environment, choose miSecureMessages to uphold the highest patient privacy standards without interfering with healthcare providers’ clinical communication. #HIPAACompliant #PatientPrivacy #miSecureMessages

I completely understand your frustration with the complexity of getting answers to your medical questions. Answering medical questions can be complex due to diverse care locations, varied specialists, strict privacy rules, communication issues, and interoperability challenges among electronic health records. This process takes time as healthcare professionals coordinate care and ensure accurate information. As a patient advocate, I'm here to dedicate the time needed to navigate these complexities and help you get the answers you deserve. Together, we can work towards simplifying this process for all. If you're frustrated with your healthcare journey, schedule a free consultation using the link in the bio. https://bit.ly/3wKdINc. #EmpoweringPatients #ElevatingProviders #PatientAdvocate #CollaborativeCare #PatientCenteredApproach #HealthcareEmpowerment #PositiveImpact #TeamworkInHealthcare #PatientsFirst #HealthcareAdvocacy

U.S. Department of Health and Human Services (HHS) will begin enforcing health IT information blocking penalties starting September 1st. Under the 21st Century Cures Act final rule published in June, certified health IT developers and entities and health information exchanges and networks can be penalized up to $1 million for interfering with the access, exchange, and use of electronic health information. #healthcare #healthinformation #informationtechnology #informationblocking #hipaa

Q. Don't have your patient's previous medical record? Q. Worried about how to manage your hospital or clinic? Q. Don't know about your upcoming appointments? Q. Worried about your data and privacy?   Healthray is the best answer to all your questions. Visit https://healthray.com/ to know more. #Healthray #AppointmentManagement #HealthcareEfficiency #MedicalSoftware #PatientCare #HealthcareInnovation

Late yesterday, HHS/OCR released revised guidance on tracking technologies. Their original guidance in 2022 sparked confusion and led to a lawsuit filed by the American Hospital Association. While the revised guidance provides some clarity, I believe they still overstep by concluding that potential future patients’ information can constitute PHI. I've outlined the differences between the 2022 Guidance and the Revised Guidance in my latest blog post. A link is in the comments below. #HIPAA