The American Hospital Association’s (AHA) lawsuit against the HHS Office for Civil Rights (OCR) over OCR’s ban on the use of website tracking technologies, even if successful, likely won’t give hospitals and other health care organizations a free pass on using pixels to track website visitors, attorneys say.

That’s because additional federal and state policymakers beyond OCR are concerned that these tracking technologies—which the AHA maintained are used for public health purposes—could run afoul of laws and regulations beyond HIPAA, WilmerHale attorneys Kirk Nahra, Ali Jessani and Roma Gujarathi said in a Nov. 21 blog post reacting to the AHA lawsuit.^[1]

“Healthcare entities that rely on tracking technologies should pay attention to AHA’s lawsuit but also account for these other regulatory requirements that may apply to them,” Nahra, Jessani and Gujarathi said.

The AHA, in conjunction with the Texas Hospital Association, Texas Health Resources and the United Regional Health Care System, sued OCR on Nov. 2 in U.S. District Court for the Northern District of Texas, Fort Worth division, to block enforcement of OCR’s December 2022 bulletin on pixels, which stated that OCR considers much of the information gathered by pixels to be protected health information (PHI).^[2]

Pixels from technology companies such as Alphabet Inc. (the parent company of Google) and Meta (the parent company of Facebook and Instagram) operate in the background on websites that have installed them, gathering details about medical conditions and other topics that website visitors may be researching on the site. The tracking devices also collect information about patients’ prescriptions and doctors’ appointments, delivering that data to third-party companies such as Facebook and Google. Investigations have found that Meta Pixel and other pixels are installed on many or even most hospitals’ websites.^[3]

In December 2022, OCR clarified that covered entities (CEs) and business associates (BAs) are not permitted to use the technologies “in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.”^[4]

However, the AHA has steadfastly opposed restrictions on the use of pixels, maintaining that web trackers are important public health tools that allow health care entities to share health care information with the communities they serve and analyze their own websites to enhance accessibility.