In a joint letter sent to 130 hospital systems and telehealth providers, the Federal Trade Commission (FTC) and the U.S. Department of Health and Human Services (HHS) warned health care providers, both those covered by HIPAA and those not, about their potential to violate the HIPAA Rules, FTC Act and FTC Health Breach Notification Rule (HBNR) when they use technology that tracks users’ activities on their websites and apps. Specifically, the letter highlighted:
-
That tracking technology was likely found on the websites of the hospital systems and telehealth providers contacted,
-
The risks of impermissible disclosures of health information to tracking technology providers, including to Meta/Facebook and Google (the letter named these two companies as examples), and
-
The resulting risk of harm to an individual whose health information has been disclosed.
