On December 1, 2022, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) published a bulletin warning that commonly used website technologies, including cookies, pixels, and session replay, may result in the impermissible disclosure of Protected Health Information (“PHI”) to third parties in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The bulletin advises that “[r]egulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of Protected Health Information (“PHI”) to tracking technology vendors or any other violations of the HIPAA Rules.” The bulletin is issued amidst a wider national and international privacy landscape that is increasingly focused on regulating the collection and use of personal information through web-based technologies and software that may not be readily apparent to the user.
Blog Editors
Recent Updates
- DOJ’s False Claims Act Recoveries Top $2.9 Billion in FY 2024, but Health Care Numbers Dip—What Could FY 2025 Hold for Health Care Enforcement?
- Recent Developments in Health Care Cybersecurity and Oversight: 2024 Wrap Up and 2025 Outlook
- Massachusetts Governor Maura Healey Signs into Law a Sweeping Health Care Market Oversight Bill
- Second Circuit Adopts “At Least One Purpose” Rule for False Claims Act Cases Premised on Anti-Kickback Statute Violations
- Supreme Court of Ohio Decides on a Peer-Review Privilege Issue in Stull v. Summa