Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 19 DECEMBER 2022

HHS Bulletin: Covered Entities' Disclosure Of PHI Collected Via Online Tracking Technologies Falls Under HIPAA

Proskauer Rose LLP
Proskauer Rose LLP
Contributor
Proskauer Rose LLP

Proskauer Rose LLP

Firm Overview Proskauer is an elite global law firm with more than 900 lawyers across key financial...

View firm profile
Explore more from Proskauer Rose LLP

On December 1, 2022, the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) issued a Bulletin to highlight the obligations

United StatesPrivacy
Ryan Blaney
Ryan Blaney
Danielle Brooks
Danielle Brooks
Jonathan Mollod
Jonathan Mollod
Author LinkedIn connections

On December 1, 2022, the Office for Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) issued a Bulletin to highlight the obligations of HIPAA-covered entities and business associates when using "online tracking technologies," or what OCR describes as "script or code on a website or mobile app used to gather information about users as they interact with the website or mobile app," which is then analyzed by website owners, app operators or third parties to create user profiles or garner insights into users' online activities.

These might include cookies, web beacons, pixels, session replay software and fingerprinting scripts that track and profile users' web activities, whether on web portals behind an authentication wall or on unauthenticated webpages or mobile apps, and, in some cases, disclose the collected user data to technology vendors for marketing purposes without HIPAA-compliant authorization. As the OCR stated: "Regulated

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.
United StatesPrivacy
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

SEC Advances “Responsible Retailization” Through A Potential Accredited Investor Exam And Potential Regulated Fund Reforms

On September 30, 2026, the Securities and Exchange Commission (SEC) issued two rule proposals and five notices aimed at expanding investors’ access to private markets. The package would add ways to qualify as an accredited investor, including passing a new exam administered by the Financial Industry Regulatory Authority (FINRA), broaden performance-based compensation and modernize regulated funds, including interval funds and business development companies (BDCs).
United StatesFinance and Banking
Proskauer Rose LLP
Proskauer Rose LLP
Article

CFTC Moves To Reinforce Federal Authority Over Event Contracts As New Jersey Seeks Supreme Court Review

The CFTC has proposed classifying event contracts as swaps while excluding traditional casino-style gambling products, directly responding to ongoing federal-state disputes over prediction markets and sports betting jurisdiction. These regulatory actions seek to clarify the agency's authority over event contracts amid conflicting appellate court decisions and pending Supreme Court review.
United StatesFinance and Banking
Proskauer Rose LLP
Proskauer Rose LLP
Article

DOL Pulls The Plug On Plan To Move FLSA Interpretations Out Of The CFR

The U.S. Department of Labor's Wage and Hour Division has withdrawn its controversial proposal to remove nine parts of longstanding Fair Labor Standards Act interpretive guidance from the Code of Federal Regulations. What does this reversal mean for employers who have relied on these decades-old interpretations, and how does the Supreme Court's Loper Bright decision reshape the legal weight of agency guidance going forward?
United StatesEmployment and HR
Proskauer Rose LLP
Proskauer Rose LLP
Article

Parliament’s Position On SFDR 2.0

The European Parliament's Committee on Economic and Monetary Affairs has adopted its position on the Sustainable Finance Disclosure Regulation reform, establishing key divergences with the European Commission and Council on professional investor exemptions and fossil fuel investment criteria. With trilogue negotiations set to begin in October 2026, private markets managers face critical decisions about how to position their funds under the new three-category framework expected to take effect in early 2029.
United KingdomCorporate/Commercial Law
Proskauer Rose LLP
Proskauer Rose LLP
Article

New York Employers May Soon Face New Separation Agreement Procedural Requirements

New York State Legislature has passed a bill that would require employers to provide employees with a minimum 21-day review period and 7-day revocation window for separation agreements involving the release of claims. The proposed "No Severance Ultimatums Act" extends procedural protections similar to those under federal age discrimination law to all covered severance agreements, regardless of employee age, and awaits Governor Hochul's signature.
United StatesEmployment and HR
Proskauer Rose LLP
Proskauer Rose LLP
Article

New York State Mandates Employee Access To Personnel Records

New York has enacted legislation granting private and public sector employees unprecedented access to their personnel records, including the right to review, dispute, and potentially correct negative information that could impact their employment status. The law, which takes effect in November 2026, establishes strict timelines for employer notification and record access while providing enforcement mechanisms through the State Attorney General.
United StatesEmployment and HR
Proskauer Rose LLP
Proskauer Rose LLP