Business associate agreements (BAAs) contribute to transparency and accountability in data management practices by establishing clear contractual obligations regarding data protection. Oversight allows specific mechanisms used by third parties, like online tracking technologies, to be controlled if they pose a risk to patient data.
In December 2022, the Office for Civil Rights (OCR) issued updated guidance specifically addressing the implications of online tracking technologies under HIPAA. The guidance clarified that HIPAA covered entities need to make sure any tracking technology used does not result in impermissible disclosures of PHI to third parties.
For example, if a tracking technology collects identifiable data such as IP addresses or email addresses linked to health information, it could violate HIPAA. The guidance provided that consent must be obtained from individuals before their information is transmitted to third parties, and a BAA must be in place with any vendor handling the data.
In June 2024, a federal court ruled that the OCR's guidance was unlawful, stating it overstepped legal authority by broadly interpreting what constitutes individually identifiable health information. The ruling showed the tension between regulatory oversight and the practicalities of using digital tools in healthcare marketing and operations.
The court's decision suggested that certain types of metadata collected through online tracking may not necessarily meet the definition of PHI under HIPAA when specific conditions are met. As a result, healthcare organizations may find themselves with more leeway to use tools like Google Analytics without violating HIPAA.
Tracking technologies can gather different data points, like IP addresses, browsing behavior, and login information, that when combined with health related data, can constitute protected health information (PHI). This creates one of the main challenges with online tracking in business associates; there is an adverse risk of a data breach if this information is not carefully controlled and protected. Once sent to third-party servers without adequate security measures or proper agreements it increases the chances of the risk.
The ambiguity surrounding which data points are considered PHI can also lead to confusion and mismanagement of sensitive information. For example, while a recent ruling suggested that IP addresses might not always be classified as PHI under certain circumstances, this does not eliminate the need for caution when using tracking technologies.
Online tracking technology refers to tools and methods used to collect, analyze, and store data about users' interactions with websites or mobile applications. This includes technologies like cookies, pixels, and scripts that monitor user behavior.
Online tracking works by embedding code on web pages or apps that collect data when users interact with them.
Cookies can enhance user experience by remembering preferences but may also pose risks if they collect PHI without proper safeguards and consent from users.