The HHS Office for Civil Rights (OCR) has not announced any enforcement actions against organizations that use tracking technologies known as pixels, offered by Meta and Google.

But that doesn’t mean covered entities should let down their guard against the possibility that this kind of software might be leaking protected health information, putting them at risk of fines or corrective action plans.

In fact, the federal government has doubled the enforcement odds, as last month OCR teamed up with the Federal Trade Commission (FTC), sending a joint letter directly to more than 100 hospitals and health care systems—as well as telehealth companies—warning them about tracking technologies.

Moreover, FTC in July further solidified its burgeoning reputation as a privacy and security enforcer, finalizing a $7.8 million settlement with BetterHelp, an online counseling service it accused of “sharing consumers’ sensitive health data with third parties such as Facebook and Snapchat for advertising after promising to keep such data private.”^[1]

On July 20, the agencies announced they sent a joint letter to “approximately” 130 entities.^[2] The letter is meant to “draw…attention to serious privacy and security risks related to the use of online tracking technologies that may be present on [their] website or mobile application (app) and impermissibly disclosing consumers’ sensitive personal health information to third parties,” they wrote.^[3]

The announcement states that “OCR has confirmed its active investigations nationwide to ensure compliance with HIPAA,” although it did not say these relate to tracking technologies.