Federal District Court Casts Doubt On HHS HIPAA Tracking Technology Guidance

The U.S. District Court for the Northern District of Texas ruled that HHS's December 1, 2022, guidance applying HIPAA to online tracking technologies is unlawful with respect to its treatment of certain combinations of website data as protected health information (PHI). After this original guidance was challenged in court, HHS issued revised guidance on March 18, 2024. The revisions, however, left regulated entities with the seemingly impossible task of distinguishing between what is and what is not a disclosure of PHI subject to HIPAA based on a website visitor's intent. In its opinion, the court focuses on the "Proscribed Combination" of (1) connecting an individual's IP address with (2) a visit to a health care provider's unauthenticated public webpage (i.e., no login or user verification required) addressing specific health conditions or listing health care providers. Upon review of both the original and revised guidance, the court ruled that a portion of the