HHS drops appeal in AHA lawsuit over online tracking guidance; federal court ruled HHS exceeded authority under HIPAA in restricting hospitals' use of web technologies

The U.S. Department of Health and Human Services will not appeal its loss in American Hospital Association v. Becerra. The AHA, joined by the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System, last November sued HHS to bar enforcement of a new rule adopted in guidance by the Office for Civil Rights titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” which prevented hospitals and health systems from using standard third-party web technologies that capture IP addresses on key portions of their public-facing webpages. A federal district court in the Northern District of Texas June 20 held that the OCR bulletin’s new rule “was promulgated in clear excess of HHS’s authority under HIPAA.” HHS Aug. 29 officially withdrew its notice of appeal, finalizing the AHA's victory in this case.

In a statement shared with the media, AHA General Counsel Chad Golder said, “The American Hospital Association is pleased that the Office for Civil Rights has decided not to appeal the district court’s decision vacating the new rule adopted in its Online Tracking Technologies Bulletin. As the AHA repeatedly explained to OCR —both before and after OCR forced the AHA to file its lawsuit — this rule was a gross overreach by the federal government, imposed without any input from healthcare providers or the general public. Now that the Bulletin’s illegal rule has been vacated once and for all, hospitals can safely share reliable, accurate health care information with the communities they serve without the fear of federal civil and criminal penalties.”

Seventeen state hospital associations and 30 hospitals and health systems filed friend-of-the-court briefs supporting AHA and its co-plaintiffs in the lawsuit.