Lexology March 20, 2024
The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) updated its guidance concerning compliance obligations for HIPAA covered entities and business associates using online tracking technologies. While revisions purport to provide some clarity on use of technologies on unauthenticated webpages, business associate relationships with vendors, and OCR’s enforcement priorities, the bigger tracker questions remain unchanged.
OCR recently updated guidance directed at HIPAA-regulated entities that use online tracking technologies, reminding those entities that use of such technology must comply with their obligations under the HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules), providing clarification about enforcement priorities, adding examples of uses of these technologies, and narrowing some of the previously broad language about...