Last year, the American Hospital Association (AHA) sued the U.S. Department of Health and Human Services (HHS) in the U.S. District Court of the Northern District of Texas, requesting that HHS be barred from enforcing a new rule adopted by the Office for Civil Rights entitled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.” The guidance prevented health care entities from deploying third-party web technologies that capture IP addresses.
The federal district court ruled in favor of the AHA, holding that the new rule was “promulgated in clear excess of HHS’s authority under HIPAA.” HHS appealed on August 19, 2024, but shortly thereafter rescinded it. Ten days after filing its notice of appeal, HHS withdrew it. The effect of this withdrawal is that the district court order remains in place, and the Office of Civil Rights is prohibited from enforcing the rule. Despite this development, hospitals and health care systems continue to get mired in litigation surrounding the use of pixel technology and continue to grapple with the use of online tracking technology.