.st0{fill:#FFFFFF;}

Podcast

HIPAA Online Tracking News – Ep 428 

 October 13, 2023

By  Donna Grindle

Share0
Tweet0
Share0

Web tracking tools that collect or share personally identifiable health information can pose significant implications when it comes to HIPAA privacy and security. Unauthorized tracking can compromise patient confidentiality and privacy, potentially exposing sensitive health data. Today, we are doing a follow up from our previous podcast on web tracking tools and discuss a few recent articles and guidance released by HHS, FTC and OCR.

A 5 star review is all we ask from our listeners.
1x
Apple PodcastsGoogle PodcastPlayer EmbedShare Review Us on Apple PodcastsListen in a New WindowDownloadSoundCloudStitcherSubscribe on AndroidSubscribe via RSSSpotify
Free HIPAA Training
Subscribe to the weekly email update from HMWH

I have read and agreed to your Privacy Policy

In this episode:

HIPAA Online Tracking News – Ep 428

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn about offerings from the Kardon Club

and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

If you see a couple of numbers on the left side you can click that and go directly to that part of the audio. Get the best of both worlds from the show notes to the audio and back!

Thanks to our donors.

HIPAA Briefs

[05:54] How do the HIPAA Rules apply to regulated entities’ use of tracking technologies?

A lot of information can be disclosed using online technologies, via websites or mobile apps usually. This information is usually referred to as individually identifiable health information (IIHI). But if there is enough IIHI captured by the tracking technology, that information can quickly become PHI. HIPAA is very clear about PHI. If it’s PHI and you’re a regulated entity, you have to have a business associate agreement in place to pass that data on to another entity.

Here’s an excerpt from HHS on this topic:

Regulated entities disclose a variety of information to tracking technology vendors through tracking technologies placed on a regulated entity’s website or mobile app, including individually identifiable health information (IIHI) that the individual provides when they use regulated entities’ websites or mobile apps. This information might include an individual’s medical record number, home or email address, or dates of appointments, as well as an individual’s IP address or geographic location, medical device IDs, or any unique identifying code. All such IIHI collected on a regulated entity’s website or mobile app generally is PHI, even if the individual does not have an existing relationship with the regulated entity and even if the IIHI, such as IP address or geographic location, does not include specific treatment or billing information like dates and types of health care services. This is because, when a regulated entity collects the individual’s IIHI through its website or mobile app, the information connects the individual to the regulated entity (i.e., it is indicative that the individual has received or will receive health care services or benefits from the covered entity), and thus relates to the individual’s past, present, or future health or health care or payment for care.
Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates

HIPAA Say What!?!

[09:04]
Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules. For example, disclosures of PHI to tracking technology vendors for marketing purposes, without individuals’ HIPAA-compliant authorizations, would constitute impermissible disclosures.
Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates

405(d) Tip of the Week

[15:05] As a reminder, cybersecurity is a shared responsibility and should be taken as a priority 365 days a year to put patient care first (not just during CSAM). HHS 405(d) free resources are available year round to help.

HIPAA Online Tracking News

[16:55] A few months ago OCR issued guidance about use of online tracking tools like Google Analytics.

Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates | HHS.gov

It specifically says in bold:

Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.

We discussed it in an episode shortly after that:

Spitballing Website Tracking – Ep 390 – Help Me With HIPAA

In May, American Hospital Association (AHA) sent a letter to HHS and OCR asking them to back off on this guidance or amend it.

AHA Letter to OCR on HIPAA Privacy Rule, Online Tracking Guidance

We have been discussing it and keeping an eye on it since then. There has been another round of notices to update you about so you, too, can be in the know.

First, in July, OCR and the FTC published an announcement that it had sent over 130 hospital organizations a letter about use of these technologies.

HHS Office for Civil Rights and the Federal Trade Commission Warn Hospital Systems and Telehealth Providers about Privacy and Security Risks from Online Tracking Technologies

FTC-HHS joint letter gets to the heart of the risks tracking technologies pose to personal health information

An example of the letter is here: Model Letter: Use of Online Tracking Technologies

In March 2023, the FTC put out an article called Lurking Beneath the Surface: Hidden Impacts of Pixel Tracking.

The two of them basically say we are not backing down.

Fast Forward to Sep 2023

[31:38] Just last week another volley was published by AHA:

AHA Responds to Senate RFI on Health Data Privacy

That letter was in response to a totally different RFI from Congress Senate RFI on Health Privacy

As we examine steps to leverage technology to improve patient care, while safeguarding the privacy of this data, we request feedback on the questions below.

In their response to the RFI they ask Congress to act on two things:

The tracking technology rule:

…this rule is flawed as a matter of law and harmful as a matter of policy. As a result of the OCR rule, hospitals and health systems can no longer rely on a broad array of third-party technologies — from Google Analytics to YouTube or other video applications — that help them provide their communities with reliable health care information. Not only does this OCR rule violate HIPAA and its implementing regulations, but it inflicts meaningful harm on patients and public health. Congress should urge OCR to withdraw the rule immediately.
Congress does not need to amend HIPAA as the statute already bars OCR’s new rule. AHA urges Congress to make clear to OCR that the agency should withdraw the rule immediately. AHA recommends that Congress should consider exploring how to better require entities not covered by HIPAA to protect patient privacy, especially those third-party entities that decline to sign BAAs to ensure patient privacy.

Note: AHA made those last bits bold in their letter.

Also, another item that is totally unrelated to that issue but equally important from a healthcare perspective.

….. currently face a patchwork of state and federal privacy requirements, which creates unnecessary regulatory burdens. The AHA has long advocated that HIPAA’s requirements be the uniform, nationwide standard for protecting the privacy and security of all patient information. Because the HIPAA framework is both effective and entrenched, Congress should enact full federal preemption for HIPAA.
[37:38] Their letter explains this issue as follows:

While generally preempting contrary state law, HIPAA does not preempt state law that is “more stringent” than the requirements that it mandates. Specifically, state law is not preempted where: (1) state law is contrary to HIPAA; (2) relates to matters of IIHI; and (3) is more stringent than the HIPAA requirements.

For all the strengths of the existing HIPAA framework, its approach to preemption has proven to be problematic. It creates unnecessary regulatory burdens on hospitals and health systems, forcing them to satisfy a myriad of legal requirements that raise compliance costs and divert limited resources that could be used on patient care. In addition, the existing state and federal patchwork of health information privacy requirements remain a significant barrier to the robust sharing of patient information necessary for coordinated clinical treatment. For instance, the patchwork of differing requirements poses significant challenges for providers’ use of a common electronic health record that is a critical part of the infrastructure necessary for effectively coordinating patient care and maintaining population health.

If Congress were to make any changes to HIPAA, it should address this problem and enact a full preemption provision. HIPAA is more than sufficient to protect patient privacy and, if interpreted correctly, it strikes the appropriate balance between health information privacy and valuable information-sharing. Varying state laws only add costs and create complications for hospitals and health systems. As such, the AHA reiterates its long-standing recommendation that Congress strengthen HIPAA preemption.

HIPAA privacy and security should be considered patient care. I mean it’s our show’s motto, after all. That means that not only do covered entities have to understand that, but they also need to make sure their business associates understand that and follow HIPAA rules. That also means covered entities must evaluate all third parties they work with and what services they are providing for them. Most people probably never think about their website hosting or web development company potentially being a business associate. Technology is changing and with it, services and tools used by businesses are changing… especially when it comes to AI tools.

Go to top

As technology evolves, there is an intricate relationship between the HIPAA rules and the utilization of tracking technologies. Healthcare organizations must carefully implement and manage web tracking tools, ensuring they comply with HIPAA requirements by anonymizing or encrypting any health-related data and maintaining strict access controls. Failure to do so may result in severe legal and financial consequences for breaches of patient privacy and data security under HIPAA.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

HIPAA is not about compliance,

it’s about patient care.TM

Listener Survey

Special thanks to our sponsors Security First IT and Kardon.

Share 0
Tweet 0
Share 0

HelpMeWithHIPAA.com Is A
Collaborative Project

Created & Sponsored By: