The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services released an updated bulletin on March 18, 2024, regarding the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. The bulletin reminds regulated entities of their obligations for HIPAA compliance when using tracking technologies, such as obtaining individual authorizations and business associate agreements with tracking technology vendors.
The updated bulletin also outlines OCR’s enforcement priorities, focusing on ensuring that entities have assessed and mitigated risks to electronic PHI when using online tracking technologies and have implemented the Security Rule requirements of HIPAA to safeguard electronic PHI. The document also identifies three areas where entities may be utilizing tracking technology: user-authenticated pages, unauthenticated pages, and mobile apps, and explains how information gathered in these areas can lead to the disclosure of PHI.
This updated bulletin aims to provide clarity on how regulated entities should use online tracking technologies while complying with HIPAA regulations. It is important for healthcare providers to be aware of the potential risks associated with using tracking technologies and take necessary precautions to protect their patients’ sensitive information from improper disclosure or violation of privacy laws.
+ There are no comments
Add yours