HHS online tracking guidance: where it stands
The bulletin, its revision and the court decision that followed, with a link to each primary source. Current status is marked for verification.
Not legal advice. This update summarizes public documents. Status changes. Check the sources and talk to your counsel before you rely on it.
On this page
Status
Current status: [VERIFY CURRENT STATUS] This page is a summary of public documents, checked on [DATE]. The links below go to the primary sources. If they say something different from this page, they are right and this page is out of date.
The bulletin
In December 2022, the Office for Civil Rights at the U.S. Department of Health and Human Services (HHS) published a bulletin titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates”. It explained how HHS reads the HIPAA Rules when a website or app uses tracking technologies such as pixels and session replay. [VERIFY]
The 2024 revision
In March 2024, HHS revised the bulletin. The revision kept the core position and added examples about public webpages, including when a visit to a page that addresses a specific health condition could involve protected health information. [VERIFY]
The court decision
In June 2024, the U.S. District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra that part of the bulletin went beyond HHS’s authority and vacated it. The vacated part concerned tracking on unauthenticated public webpages, where a technology connects a visitor’s IP address with a visit to a page about a specific health condition or provider. [VERIFY CURRENT STATUS]
The ruling did not change 45 CFR Parts 160 and 164. Tracking on authenticated pages, such as patient portals, was not part of it. [VERIFY]
What it means for your website
The guidance is one source of risk. State privacy laws and wiretap claims are others, and they don’t depend on the bulletin. Many organizations have kept their changes in place: holding scripts until consent and keeping page details out of ad platforms.
Your counsel decides what applies to you. A tracking scan shows what your site actually loads, which is the fact every one of these questions starts from.
Key takeaways
- The bulletin interprets the HIPAA Privacy, Security and Breach Notification Rules in 45 CFR Parts 160 and 164.
- A federal court vacated part of the bulletin in 2024. [VERIFY CURRENT STATUS]
- The underlying rules did not change. Tracking on authenticated pages, such as patient portals, was not part of the ruling.
- Read the current version on hhs.gov and ask your counsel what it means for your site.