In a landmark legal decision, a federal judge recently ruled to strike down regulations that restricted healthcare providers’ use of third-party tracking in healthcare, a move that has stirred controversy within the healthcare and behavioral health industries. This ruling marks a pivotal moment in the ongoing debate over patient privacy, data-sharing practices, and the role of technology in modern healthcare. As healthcare providers regain the ability to use third-party tracking technologies more freely, it raises significant questions about the balance between improving healthcare services and protecting patient confidentiality.
The Legal Challenge: AHA vs. OCR
The ruling stems from a lawsuit filed by the American Hospital Association (AHA) and three other healthcare provider groups against the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). In November 2023, the AHA and its allies filed the suit in response to the HHS’s “Online Tracking Bulletin,” which was introduced in December 2022 to address growing concerns over the privacy implications of third-party tracking in healthcare. This bulletin, in its original form, imposed strict limitations on healthcare providers, particularly in the behavioral health sector, by prohibiting the use of tracking technologies that could potentially lead to the disclosure of protected health information (PHI) to external third parties.
The AHA, along with other plaintiffs, argued that the OCR’s guidance went too far, arguing that it not only hindered the ability of healthcare providers to serve patients effectively but also posed harm to patients and communities by overextending privacy protections. The plaintiffs also expressed concerns that the guidance was too vague and restrictive, stifling innovation in healthcare delivery and technology use.
Chad Golder, AHA’s general counsel and secretary, emphasized that the AHA had repeatedly raised concerns with OCR about the “Online Tracking Bulletin,” arguing that it was both unlawful and harmful. He added, “We regret that we were forced to sue OCR, but we are pleased that the Court agreed with the AHA and held that OCR does not have ‘interpretive carte blanche to justify whatever it wants irrespective of violence to HIPAA’s text.’”
The OCR, as expected, declined to comment on the ruling.
The Court’s Ruling: A Win for Providers
In a favorable ruling for the plaintiffs, the judge broadly agreed with the arguments presented by the AHA and other groups. The court found that the HHS’s guidance, specifically the restrictions on the use of third-party tracking in healthcare, exceeded the agency’s authority and failed to properly interpret the intent of existing privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA).
However, the judge did not issue a permanent injunction to prevent enforcement of the bulletin. While the plaintiffs sought to have the guidance vacated and permanently enjoined, the court determined that they did not demonstrate that an injunction was the only remedy that could address their injury. Instead, the judge issued a decision that effectively rolled back the strict regulations but allowed the HHS to potentially revise the guidance in a manner that more appropriately aligns with legal standards.
The HHS Bulletin: Background and Revisions
The HHS bulletin in question was introduced in December 2022 as part of an effort to address privacy concerns regarding the use of online tracking technologies by healthcare providers. The bulletin originally prohibited the use of third-party tracking in healthcare that could result in the unauthorized disclosure of PHI, which includes sensitive information about a patient’s health, treatment, and medical history.
However, in response to feedback and legal challenges, the bulletin was later revised to include softer language that permitted certain uses of tracking technologies as long as they adhered to privacy standards. Despite these revisions, the original restrictions remained in place, limiting how providers could leverage data for marketing, analytics, and patient outreach. This tension between the need for patient privacy and the desire to use data for improved healthcare services became the focal point of the lawsuit.
Before being struck down, the bulletin had garnered significant opposition from many healthcare provider groups, who argued that it was overly broad and hindered their ability to use essential technologies. These technologies include tracking tools that help healthcare providers understand how patients engage with their websites, communicate with health systems, and receive care-related information.
The Implications for Healthcare Providers: A Return to Data Flexibility
With the judge’s decision to strike down key provisions of the bulletin, healthcare providers now find themselves in a position to resume using third-party tracking in healthcare with fewer restrictions. For hospitals, health systems, and other providers, this ruling represents a significant shift back toward greater flexibility in their digital outreach and engagement strategies. The AHA lauded the decision, stating that it would enable hospitals to use important technologies that enhance their ability to deliver accurate, timely health information to patients and communities.
Chad Golder of the AHA expressed that this decision was crucial in enabling healthcare providers to use digital tools for patient engagement. He stated, “As a result of this decision, hospitals and health systems will again be able to rely on these important technologies to provide their communities with reliable, accurate health care information.”
However, while the ruling grants healthcare providers more latitude in using tracking technologies, it does not absolve them of their responsibility to protect patient privacy. The court’s decision is not a blanket endorsement of unrestricted data-sharing but rather a reassertion of healthcare providers’ ability to leverage these technologies within a regulatory framework that ensures patient information remains secure.
The Growing Use of Third-Party Tracking Technologies in Healthcare
The use of third-party tracking technologies in healthcare has been a growing trend, especially as more health systems and providers move toward digital platforms for patient engagement, treatment, and outreach. A study published in Health Affairs found that nearly 99% of hospital websites use third-party tracking technologies. These technologies can include tools such as cookies, web beacons, and other tracking mechanisms that gather information about how patients interact with websites and digital content.
While these tracking tools can provide valuable insights into patient behaviors, website engagement, and treatment needs, they have raised significant privacy concerns. The study’s authors noted that this practice could lead to “dignitary harms” when sensitive health information is shared with third-party companies, such as social media platforms, advertisers, and tech companies, who may then use this information for marketing and other commercial purposes.
This concern has been particularly pronounced in the behavioral health sector, where patient information is often more sensitive due to the nature of mental health and addiction treatment. Behavioral health providers, in particular, have been caught in legal battles over their use of tracking technologies, which has led to several high-profile settlements and fines.
Legal Precedents: The Behavioral Health Sector
The behavioral health industry has faced heightened scrutiny due to the use of third-party tracking in healthcare by companies such as Teladoc Health’s BetterHelp and virtual alcohol use disorder treatment provider Monument. In 2023, BetterHelp settled a case with the Federal Trade Commission (FTC) for $7.8 million after allegations surfaced that the company shared sensitive patient data with third-party companies, including social media platforms and advertisers.
Similarly, Monument faced a $2.5 million fine from the FTC in 2023 for sharing patient data with tech giants like Amazon, Google, and Reddit without adequate patient consent. These legal cases highlight the risks associated with the unauthorized sharing of health data and underscore the need for stronger privacy protections.
Moreover, mental health startup Cerebral admitted to using tracking technologies that shared sensitive patient information, including demographic data, mental health assessments, and treatment plans. In response, Cerebral was fined $15 million by the FTC in a settlement that underscored the importance of maintaining strict patient confidentiality when using digital tools in healthcare.
Looking Ahead: A Delicate Balance Between Innovation and Privacy
As healthcare providers are granted more flexibility in using third-party tracking in healthcare, they must be vigilant in balancing the benefits of data-driven decision-making with the need to protect patient privacy. The ruling provides a path forward for healthcare organizations to improve patient engagement and deliver more personalized care, but it also highlights the continuing importance of safeguarding sensitive health data.
Providers will need to ensure that they are using these technologies responsibly and in compliance with HIPAA regulations. Additionally, patients should be informed about how their data is being used, who has access to it, and what steps are being taken to protect their privacy.
The future of healthcare technology will likely continue to evolve, with data-sharing and privacy concerns remaining central to the discussion. As legal frameworks adjust to keep pace with innovation, it is crucial for healthcare organizations to navigate these challenges thoughtfully, ensuring that patient trust is maintained while still benefiting from the efficiencies that technology can offer.
Conclusion
The federal judge’s ruling to strike down key restrictions on third-party tracking technologies represents a significant victory for healthcare providers, allowing them to use these tools to improve patient engagement and service delivery. However, the ruling also serves as a reminder that privacy concerns in healthcare remain a top priority. As the industry continues to adapt to technological advancements, finding the right balance between innovation and patient protection will be essential to fostering trust and ensuring that healthcare systems remain secure, ethical, and effective.
