Legal professionals working within the healthcare sector, including providers, business associates, and other entities accountable to the Health Insurance Portability and Accountability Act (HIPAA), are put on high-alert for a potential enforcement action by the Office for Civil Rights (OCR). The OCR, the body responsible for ensuring HIPAA compliance, is underlining the necessity for close scrutiny and understanding of the use and disclosure of protected health information (PHI).
One crucial area under the spotlight is the use of third-party tracking technologies, prevalent on many websites and mobile applications. Legal entities will need to know whether any of their online platforms utilize such technologies and what user data has been disclosed to these third-party companies. More importantly, they will need an overview of how this shared data is being used.
General legal counsel within healthcare organizations should be particularly vigilant, given all these considerations. These developments demonstrate the increasing need for strong data governance, and a thorough understanding of data sharing practices of online platforms.
The enforcement action could potentially impact organizations across the spectrum that are subject to HIPAA rulings concerning the use and disclosure of PHI. Maintaining a strong compliance framework, that adequately protects user privacy and adheres to data use restrictions, will be paramount for such organizations.
Counsel looking for additional information on this developing topic can refer to the comprehensive review by Baker Donelson, found here.