What the AHA Tracking Case Says About HIPAA’s Limits

This chapter examines American Hospital Association v. Becerra, a June 20, 2024 federal district-court opinion about tracking technologies on hospital webpages that anyone could visit without logging in. The specific question was whether an IP address or other identifying information linked to a visit to a health-related public webpage could, by itself, become individually identifiable health information under HIPAA. Understanding the answer requires two judgments at once: what the court said about HIPAA’s definition of IIHI, and what the court said about an agency’s power to create a new obligation through guidance.

The case matters to the broader health-data question because it sits on a different side of the boundary from the FTC Health Breach Notification Rule. The FTC rule can reach qualifying non-HIPAA personal health record ecosystems. This case involved HIPAA-covered providers and an HHS interpretation of information gathered from public webpages. Treating the two as one dispute would obscure both the reach of the FTC rule and the limits of the court’s holding.

A public webpage became an agency-power dispute

Hospitals use public webpages to give people information about conditions, services, and providers. Those pages do not require a login or other user verification. Third-party technology vendors may collect a visitor’s IP address and record the page visited so the website can offer location-based or otherwise more tailored information. The practical concern is easy to understand: if an IP address can be associated with a person and the page concerns dialysis, Alzheimer’s disease, or another condition, a recipient might infer something about that person’s health.

The legal question is harder than the inference. A page visit can have many explanations. The visitor might be researching a condition for a class, working for the hospital, helping a family member, or looking for information about someone else. The fact that a page concerns a condition does not necessarily establish that the identified visitor has that condition or is seeking treatment for themselves.

Against that background, HHS issued an Original Bulletin in December 2022 addressing privacy concerns about online tracking technologies. The bulletin included examples in which a technology connected an individual’s IP address with a visit to a public webpage addressing specific health conditions or listing healthcare providers. HHS treated that combination as information that could trigger HIPAA obligations. Hospitals saw the position as a new operational burden because it could require them to change how they used analytics and other tools on public webpages.

Days before HHS’s brief was due in the litigation, the Department issued a Revised Bulletin dated March 18, 2024. The revised document softened some wording and stated that it did not have the force and effect of law and was not meant to bind the public. It also added a subjective-intent qualification: the combination would not be sufficient if the visit was unrelated to the individual’s own health, healthcare, or payment for healthcare.

The revision did not end the dispute.