LS&HC Horizons 2023 - Flipbook - Page 24
Hogan Lovells | 2023 Life Sciences and Health Care Horizons | Privacy and Cybersecurity
Web analytics gets more complicated for health organizations
Health organizations may no longer use thirdparty tracking tools (Trackers) on portions
of their websites and mobile apps. Use of
Trackers by those organizations has come
under scrutiny, and resulted in litigation,
in connection with allegations that
such uses involve impermissible disclosures
of sensitive information.
For example, through recent guidance, the U.S.
Department of Health and Human Services
(HHS) Office for Civil Rights (OCR) concluded
that Trackers on Health Insurance Portability
and Accountability Act (HIPAA)-regulated
areas of health organizations’ online properties
may be used only in accordance with HIPAA.
OCR says whether an online property contains
HIPAA-regulated personal health information
(PHI) depends on the website or app – and
even the page within that online property.
The guidance provides that:
• Individually identifiable health information
(as defined by HIPAA) collected through
Trackers is likely PHI.
• Trackers inside a user authenticated account
likely collect PHI.
• Trackers on other pages still may implicate
HIPAA, for example if placed on a log-in
or registration webpage, or webpage that
addresses specific symptoms or conditions.
Plaintiffs’ firms and regulators have argued
that state and federal consumer protection and
privacy laws may apply even where HIPAA
does not, and use of Trackers by non-regulated
entities (e.g., telehealth providers) also has
drawn media attention. No company offering
and collecting information about health
information seems immune from this scrutiny.
Now is the time for all health and supporting
technology companies to assess use of Trackers
in their website and mobile operations. We
have counseled numerous companies through
this process to allow them to take advantage
of the benefits that Trackers provide, while
mitigating legal risks.
Scott T. Loughlin
Partner, Washington, D.C.
Donald DePass
Counsel, Washington, D.C.
Allison Holt Ryan
Partner, Washington, D.C.
24
