The healthcare industry is increasingly leveraging digital tools to improve patient access, offer services like appointment scheduling, and even provide information via chatbots. However, as healthcare providers adopt these tools, they may unknowingly expose themselves to significant legal and regulatory risks through third-party data sharing on unauthenticated websites.
Many healthcare websites use third-party tools to track user activity to improve website performance, analytics, and targeted advertising. While this seems harmless, on public and unauthenticated sites (where users are not logged in), there’s more at stake. According to Iliana Peters, an attorney at Polsinelli and former acting deputy director for the U.S. Department of Health and Human Services (HHS) Office for Civil Rights, this practice can lead to legal liabilities.
"Healthcare entities still face a significant burden," says Peters. "They [don’t] realize the scope of data that is collected by these third-party entities."
See also: HIPAA Compliant Email: The Definitive Guide
The most immediate risk for healthcare providers is the growing wave of class-action litigation. Peters reports that attorneys target healthcare websites, using publicly available cookie trackers to detect potential violations. "We are seeing hundreds of thousands of lawsuits associated with these activities," she says.
Plaintiff attorneys scour healthcare sites, analyzing privacy policies and terms of use to see if they meet legal requirements. If not, they send demand letters that often request significant payouts. "It’s really the Wild West right now," Peters adds, describing how attorneys are taking advantage of the gray areas in current regulations.
In addition to lawsuits, the Office for Civil Rights (OCR) has opened more than 100 cases related to these activities under HIPAA. States and even the Federal Trade Commission (FTC) have also launched lawsuits, adding further layers of legal complexity.
Read also:
For healthcare organizations, this situation is both costly and confusing. On one hand, providers are committed to improving patient care and access through digital tools. On the other hand, the use of third-party tracking technologies puts them at risk of violating privacy regulations, which could lead to substantial financial penalties or damage their reputation.
The rise of digital tools in healthcare has brought convenience alongside risks. Providers can learn key lessons from the recent scrutiny over third-party data sharing on unauthenticated websites:
The legal landscape remains uncertain, but healthcare providers can take steps to mitigate risks:
See also: What is the key to HIPAA compliance?
Third-party data sharing refers to the practice of healthcare websites using tools or services from external companies that collect and share data, often for purposes like analytics or marketing.
Third-party tools can collect sensitive patient information without the provider’s full awareness, leading to potential violations of privacy laws like HIPAA and state regulations, exposing providers to lawsuits or penalties.
Patients can protect their data by reading the privacy policies of healthcare websites, limiting the sharing of personal information, and using privacy settings to block third-party trackers where possible.