Lexology June 27, 2024
Last week, a federal district court in Texas issued a decision declaring unlawful and vacating a central component of a guidance document (the Bulletin) from the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) on the use of “online tracking technologies,” such as cookies and pixels on certain webpages. Since its issuance in 2022, the Bulletin had caused healthcare providers to scramble to adjust to the agency’s interpretation that the limited data collected by cookies and similar technologies for advertising and other purposes triggered Health Insurance Portability and Accountability Act (HIPAA) privacy implications. The district court agreed with the plaintiff hospital groups that HHS had exceeded its authority under HIPAA in promulgating an expansive definition of...