AHA urges OCR to finalize HIPAA privacy proposal, suspend online tracking guidance  

The Department of Health and Human Services’ Office for Civil Rights should finalize its proposed “commonsense” amendments to the HIPAA Privacy Rule to support reproductive health care privacy, but immediately suspend or amend its December 2022 online tracking guidance, which “aggravates the risk of health misinformation by treating a mere IP address as a unique identifier under HIPAA,” AHA told the agency in comments submitted May 22. 
 
“In particular, the guidance errs by concluding that IP addresses constitute [protected health information] whenever they are shared with a third party, regardless of the context surrounding when someone visits a regulated entity’s website,” AHA wrote. “Under the guidance, an IP address is protected even if consumers are not actually seeking medical care. The same HIPAA protections apply if a consumer is searching for a physician or medical service, seeking general health information (e.g., information about vaccines, flu season, or symptoms of an unknown illness), or merely looking for information about visiting hours, facility locations, cafeteria menus or any of the multitude of reasons one might go to a hospital’s website.”