As a provider, a question worth asking yourself these days is this: what degree of risk is there that you might have something on your website that could lead to a multi-million-dollar class-action lawsuit and a determination by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) that you violated the Health Insurance Portability and Accountability Act (HIPAA)?

As anyone who has seen the pop-up banners on many websites over the past few years knows, websites often use “cookies,” small packets of data, to track activities on the site. Sometimes, these cookies also share information with third parties.

Social media and online ad companies provide some of the most common cookies and other tracking tools to website owners. “Meta Pixel,” provided by Meta – Facebook’s parent company – and Google Analytics are among the most ubiquitous. But nearly every social media company, such as LinkedIn, Snapchat, TikTok, Twitter-slash-X, offers something.

These cookies are often used to figure out how effective advertising campaigns and websites are at driving people to sites and then prompting them to take certain actions, such as buying a product – or, potentially, making an appointment with a doctor.

In the process, these tools often send information back to a third party, such as Meta or Google.

And here’s where OCR and some plaintiffs think there might be a problem.

In the past year, dozens of class-action lawsuits have been filed against healthcare entities because of their websites’ use of Meta Pixel and other tools. We have four in federal court just here in Minnesota, where I am.

So far, these lawsuits have mostly targeted hospital systems. But they are starting to target smaller entities. For example, one was recently filed against a small clinic in Florida.

... Continue reading the article at RACmonitor →

This article originally published on September 27, 2023 by RACmonitor.