A U.S. District Court Judge in Texas has ruled in favor of the American Hospital Association, Texas Hospital Association, and other hospital plaintiffs, determining that the Department of Health and Human Services “bulletins” that restrict health care providers from using standard third-party web technologies capturing IP addresses on portions of their public-facing webpages were unlawful final rules. The court vacated the March 2024 Revised Bulletin.
In his decision, Judge Mark Pittman emphasized the broader implications. “This case isn’t really about HIPAA, the Proscribed Combination, or the proper nomenclature for PHI in the Digital Age. Rather, this is a case about power. … While the Proscribed Combination may be trivial to Department of Health and Human Services (HHS), it isn’t for covered entities diligently attempting to comply with HIPAA’s requirements. … The Court GRANTS the Hospitals’ request for declaratory judgment and DECLARES that the Proscribed Combination, as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL, as it was promulgated in clear excess of HHS’s authority under HIPAA.”
The American Hospital Association (AHA), along with the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System, had filed a lawsuit against the federal government in November, aiming to bar enforcement of what they deemed an unlawful rule disguised as guidance. They argued the rule disrupted hospitals' and health systems' ability to share health care information with their communities and analyze website traffic to improve access to care and public health. In response to the lawsuit, HHS Office for Civil Rights (OCR) issued updated guidance in March for HIPAA-covered entities and business associates regarding the use of online tracking technologies. The AHA maintained that the revised bulletin was still unlawful, a position Judge Pittman supported in his ruling.
AHA General Counsel Chad Golder commented on the ruling, stating, “For more than a year, the AHA has been telling the Office for Civil Rights that its ‘Online Tracking Bulletin’ was both unlawful and harmful to patients and communities. We regret that we were forced to sue OCR, but we are pleased that the Court today agreed with the AHA and held that OCR does not have ‘interpretive carte blanche to justify whatever it wants irrespective of violence to HIPAA’s text.’ As a result of today’s decision, hospitals and health systems will again be able to rely on these important technologies to provide their communities with reliable, accurate health care information.”
The decision saw support from 17 state hospital associations and 30 hospitals and health systems, who filed friend-of-the-court briefs in favor of the AHA and its co-plaintiffs in this lawsuit.