Skip to Main Content

April 06, 2023   

OCR Guidance on Online Tracking Technologies

This Briefing is brought to you by AHLA’s Health Information and Technology Practice Group.
  • April 06, 2023
  • Carolyn V. Metnick , Sheppard Mullin Richter & Hampton LLP
  • Ashley O. Ogedegbe , McDermott Will & Emery LLP

On December 1, 2022, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) issued a bulletin on the use of online tracking technologies by covered entities and business associates subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA). The bulletin underscores that HIPAA regulated entities are not permitted to leverage tracking technologies in a manner that would result in an impermissible disclosure or any other violation of HIPAA. But most notably, OCR adopts an expansive interpretation of the definition of protected health information (PHI) under HIPAA that will impact how regulated entities interact with users accessing their webpages and mobile applications.


You must be logged in to access this content.