FTC And HHS Send Letter Warning Of Risks From Online Tracking Technologies

On July 20, 2023, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC) sent a joint letter to approximately 130 hospital systems and telehealth providers to alert them to the "serious privacy and security risks" stemming from the use of online tracking technologies integrated into their websites and mobile apps.

The agencies cautioned that entities could be impermissibly disclosing consumers' sensitive personal health data to third parties through the use of such technologies—in potential violation of the Health Insurance Portability and Accountability Act (HIPAA), the FTC Act and/or the FTC Health Breach Notification Rule. The letter specifically calls out use of the Meta Pixel and Google Analytics, two exceedingly common third-party web tracking technologies that offer targeted advertising and analytics services. Here are some key takeaways: