Gera-IT - your reliable technological partner’s Post

A significant (but so far pretty quiet) privacy ruling came down in USDC in Texas last week, when a judge granted summary judgment for the American Hospital Association and struck down a U.S. Department of Health and Human Services (HHS) guideline that ostensibly prohibited healthcare providers from using tracking technologies and analytics on their websites. The court suggested that tracking data doesn't necessarily become Individually Identifiable Health Information ("IIHI" - a subset of Protected Health Information (PHI) under HIPAA) just because the reason someone interacts on an Unauthenticated Public Website ("UPW") might be for a medical condition or healthcare provider. Will this be the beginning of additional discussions of tracking technologies and the transmission of personal information under other state laws? Click through the article to the opinion if you are interested! #HIPAA #AHA #OCR #HHS #ProscribedCombination #privacy #tracking #trackingtechnologies #analytics #googleanalytics #iketanilaw #federalcourts #USDCTXND #IIHI #PHI #UPW #cookies #beacons #pixels #browserdata #personalinformation

Judge rules in favor of AHA vacating HHS online tracking ‘bulletin’ as unlawful and beyond agency authority Many people may recall the U.S. Department of Health and Human Services (HHS’) guidance on the use of pixels and online tracking technologies on HIPAA-covered entity websites, like hospitals and healthcare orgs (HHS has actually issued at least 3 separate guidance pieces on this topic, in 2022, 2023 and 2024). You may also recall that in November 2023, the American Hospital Association (AHA) filed a lawsuit challenging HHS’ authority to make such a rule, as well as the process HHS followed. Last week, a federal judge in Texas issued an opinion and order vacating the part of HHS/OCR’s guidance restricting a CE’s use of online tracking technologies on unauthenticated public webpages (“UPWs”). Of course, the reality of the matter is that this is still only a lower court decision, and not yet definitive precedent; not to mention that this decision can be appealed, stayed, etc. So while everyone should consult their own legal counsel, it would appear that the option of least risk – at least at the moment - is for covered entities to continue avoiding using tracking technologies and analytic tools on any of their public webpages, to the extent that there is the potential for collection of PHI on those pages. Finally, FWIW, one paragraph in the TX decision that I personally found especially interesting - because it specifically identified situations where even the TX court would agree that a visitor to a UPW would be deemed to be disclosing IIHI (and thus be engaged in a HIPAA-covered disclosure) - was as follows:  "If a covered entity’s UPW greets visitors with a dropdown box requesting their subjective motive for visiting the page, that would be one thing. The Department can and should remind covered entities that the Privacy Rule would apply in those circumstances. But absent such an admittedly bizarre scenario, the Proscribed Combination cannot become IIHI as unambiguously defined." (p. 25). #meta #pixels #HHS #HIPAA #hospitals #PHI #protectedhealthinformation https://lnkd.in/e8GEesMk

Attention #NewJersey healthcare companies. 🚨 Are you prepared for #Bill332? We've compiled the essential information you need to know about compliance in our latest blog. #compliance #patientprivacy https://lnkd.in/gt5imBEa

In the last few months of 2023, there has been a flurry of legal activity pertaining to the use, disclosure, and protection of health information. Here is a summary of the latest legal initiatives impacting New York providers. Garfunkel Wild, P.C.'s Stacey Gulick discusses the impact in detail here: #garfunkelwild #hipaa #phi

For any Healthcare organizations in New Jersey, let Penrod help you navigate the complicated legislation around Healthcare marketing. #healthcare #marketing #martech #legislation #consulting

Feeling EXTREMELY vindicated. Today the court presiding over AHA v. Bacerra - the one where the healthcare industry joined together to fight OCR's #trackingtechnology guidance - issued its order, and not only was it an absolute joy to read, the judge nailed it. "The Court GRANTS the Hospitals’ request for declaratory judgment and DECLARES that the Proscribed Combination [IP address + visit to unauthenticated hospital website], as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL, as it was promulgated in clear excess of HHS’s authority under HIPAA. .....While the Court DENIES the Hospitals’ request for a permanent injunction, it GRANTS their request for vacatur and ORDERS that the Proscribed Combination be VACATED." CC: my BakerHostetler Pixel Queens Stefanie Ferrari, Lynn Sessions, Courtney L. Litchfield, and Roma Gujarathi I love that the court acknowledged that we weren't out there "advocating for [hospitals'] right to disclose" sensitive information, and that "HIPAA compliance is woven deep into hospital operations, with implications for every way in which hospitals interact with patients or patients’ medical information." And that, "[i]f enforced, the Proscribed Combination would have a profound chilling effect on providers’ use of technology vendors to facilitate critical UPWs. While healthcare providers can 'host websites and patient portals without using any third-party analytics . . . it serves nobody to have websites that patients do not know and cannot navigate effectively.'” I will be blogging about how this impacts HIPAA covered entity's decisions on tracking technologies and the remaining legal risks shortly, and am linking my prior blog posts on this issue in the comments. But as someone whose writing on this issue has been called "spicy", I would like to take this opportunity to highlight some of my favorite lines in the decision - #gamerecognizesgame. *In a last-ditch effort to evade review, HHS argues the Revised Bulletin “is not sufficiently concrete to constitute the consummation of the agency’s decisionmaking.” . . . But numerous cases have held that guidance documents can’t escape review merely because they’re poorly written. *As a whole, these signs point to one conclusion: HHS tried to tweak the IIHI definition and got caught. With its hand in the cookie jar, the Department now backtracks. In doing so, it gaslights covered entities by arguing the Bulletins restate what the rule has been all along. *The Department’s third argument fails because it’s wrong. Even if an OCR investigation and enforcement action would be required for legal consequences, that fact does not rob the Revised Bulletin of legal effect... An ordinance banning skateboards in the park doesn’t become law only when a joyriding perp is apprehended. Much to Texans’ chagrin, speed limits are still speed limits long before blue lights flash.

Healthcare specialization matters. If you are in need of Identity Resolution services and are in Health - this is why you should choose Throtle:

The U.S. District Court recently ruled that HIPAA-covered entities can use third-party tracking tools on unauthenticated web pages, overturning previous OCR guidance. Healthcare providers will now be able to use tracking tools on UPWs more freely as long as they’re still complying with HIPAA. We recommend that covered entities continue adhering to best practices in tracking technology use and HIPAA compliance, as the HHS may appeal the decision or seek new rulemaking to address the court’s concerns in the coming weeks and months. Read more on the implications of this decision from our own Jess LeDonne: https://ow.ly/tXUn50STn3M #healthcare #humanservices #consulting #hipaa

Big news in the healthcare marketing world. A United States District Court Judge in Texas ruled in favor of the AHA, Texas Hospital Association, and hospital plaintiffs, declaring that HHS's "bulletins" restricting the use of third-party web technologies to capture IP addresses were unlawful. This decision vacates the March 2024 Revised Bulletin. This ruling restores hospitals' ability to use these technologies to share health information with their communities and analyze website traffic, enhancing access to care and public health. This is a big win for healthcare marketers passionate about helping people get the care they need when they need it. #healthcaremarketing #healthcarestrategy

📢 New on the HealthMark blog 📢 Provider disincentives for information blocking became final just last week, and we’re here to break it all down for you. This was a significant moment in information blocking history, as providers have never faced disincentives before now. Check out our latest blog for what you need to know, including a brief history of this final rule, a breakdown of disincentives and how to best protect your organization now that this rule is final. Read the blog post: https://lnkd.in/gvx4TVFb