Analytics drives decision making. Website tracking technology collects user information and provides data to healthcare companies to improve patient engagement and marketing effectiveness, optimize scheduling and communications, and make websites and mobile applications more user-friendly. However, these tools may also collect sensitive information about you, such as your health status, treatment interests, relationships with health care providers, and care needs.
The increased focus on consumer privacy has led to increased scrutiny of these tools and the organizations that use them. AI-powered analytics tools are becoming more commonplace while the healthcare industry re-evaluates the use of pixels, cookies, session replay tools, and other website tracking technologies. These AI-powered tools have the potential to collect, combine, and make inferences about large amounts of health-related information without human oversight, increasing the risk of regulatory enforcement and litigation.
Before using AI-powered tracking technology, organizations need to understand what the tools collect, what can be inferred from that data, who will receive the data, and how AI-enabled vendors will use the data once it is collected.
TRACKING TECHNOLOGIES AND DATA COLLECTED
“Tracking Technology” includes code, scripts, or images. They are embedded in the websites, emails, and mobile applications that patients use to interact with their healthcare providers. They collect information that organizations can store and analyze. Cookies, pixels, web beacons, session replay tools, and third-party analytics and advertising tools are common types of tracking technologies.
Tracking technology is powerful. Provides information about:
- User behavior. It tracks clicks, searches, login status, pages viewed, time spent on each page, and even the sections of the page viewed by the user.
- User Preferences. When users specify their location, language, payment information, and account information, tracking technologies can track their preferences even if the tools themselves do not store the information.
- website traffic. These tools store your IP address, device identifier, geolocation, website referring source and the website visited after leaving the operator’s website.
- conversion. You can track whether a user makes a reservation, submits a form, or requests information after viewing your ad.
- Raw data. These tools capture form entries and responses to chat tools and embedded widgets.
The use of tracking technologies has come under scrutiny because the information collected may include personal information, protected health information (PHI), or consumer health data. Additionally, your organization may be held liable for the disclosure of this information if it is transferred to a third party.
Risks are not limited to the raw data collected. Regulators and plaintiffs may also scrutinize what can be inferred from the content of web pages visited, searches performed, forms filled out, or actions taken by users.
Current legal and regulatory issues: HIPAA, FTC, and state privacy laws
OCR guidance on using tracking technology
Beginning in 2022, the U.S. Department of Health and Human Services Office of Civil Rights (OCR) maintained When certain information is disclosed through tracking technology, it constitutes a disclosure of PHI and is required to comply with HIPAA.
Legal challenges in 2024 Confirmed Although this guidance did not apply to tracking IP addresses on certain unauthenticated web pages, much of the guidance remains in place. Healthcare organizations must continue to comply with OCR’s guidance when authenticated web pages, some non-authenticated web pages, patient portals, mobile applications, and tracking technologies collect, store, or transmit to third parties data that qualifies as PHI.
OCR is coordinating enforcement of the guidance with the Federal Trade Commission (FTC), including sending joint enforcement letters.
FTC Prudential Breach Notification Rule
Even healthcare companies that are not HIPAA regulated face increased regulatory attention under HIPAA. FTC Prudential Breach Notification Rule. This rule explicitly targets healthcare apps and connected devices that are not covered by HIPAA.
According to the FTC, “breach” doesn’t just include cybersecurity incidents. Even if a disclosure is authorized by the organization, the FTC may consider it a violation if it is not authorized by the consumer or is inconsistent with a notice provided to the consumer. The FTC also noted that the use of tracking technology may violate health breach notification rules.
State data protection laws
State privacy laws further increase the risk. Currently, 23 states have comprehensive data protection laws in place, and 19 states are already in effect. Although many states exempt HIPAA-regulated entities, non-HIPAA-regulated entities may face lawsuits from state attorneys general if they fail to provide adequate notice, obtain required consent, or opt out of targeted advertising or the sale of personal data.
Wiretapping/wiretapping lawsuit
Private lawsuits have proliferated in recent years based on state and federal wiretapping laws that provide a private right of action. While most claims are for violations of the California Invasion of Privacy Act (CIPA), claims for violations under similar state laws such as Florida and Pennsylvania and the federal Electronic Communications Privacy Act have also been filed, along with common law causes of action.
The plaintiffs successfully argued that activating the tracking technology amounted to unlawful “interception” of communications between website operators and users. These claims have survived, in some cases through motions to dismiss, and are often filed as potential class actions.
The number of these acts led the California State Legislature to draft a bill to curb this type of private activity on websites. The bill is expected to be voted on by the end of August.
AI-powered analysis increases risk
AI-powered tools can magnify these risks. AI-powered tools are built to consume, connect to, and learn from larger and more diverse datasets than traditional tracking technologies.
They may also draw sensitive inferences from data points that may appear less sensitive when viewed in isolation. And as new tools come to market, it may be possible to capture or use PHI in ways not yet anticipated. For healthcare organizations and digital health companies, this can increase legal risks and often impacts not only what data is collected, but also what that data reveals or reasonably suggests about an individual.
AI-enabled tools can also make mapping data flows and monitoring vendors more difficult. The ability to infer PHI from fewer clicks or interactions with a website could change the point at which impermissible disclosure occurs. The use of AI-powered tracking tools for automated decision-making may require additional disclosures, consent, and audit trails. Organizations need to understand how each AI-enabled tool and vendor uses the data collected. You should also evaluate whether the tool can infer health status, treatment interest, condition-specific browsing behavior, or other sensitive attributes. The use of AI-powered tools has the potential to increase regulatory oversight in digital ecosystems, so healthcare organizations may need to update their vendor contract terms, trading partner agreements, data protection assessments, and governance controls before implementing these tools.
Important points for medical institutions
The regulatory and litigation environment regarding tracking technology in healthcare continues to evolve. AI-powered analytics may further increase the need for disciplined governance. Now is the time to understand your data flows and the third-party partners that manage those data flows. To manage the risks associated with the use of tracking technology, healthcare organizations should:
- Create an inventory of all tracking technologies, analytics tools, chat tools, pixels, cookies, session replay tools, advertising technologies, and AI-enabled digital tools.
- Map what data is collected, where it is sent, who receives it, and whether the data constitutes PHI, consumer health data, sensitive personal information, or other regulated data.
- Ensure that your privacy notices, cookie banners, consent mechanisms, and opt-out tools accurately describe your actual data practices.
- Avoid launching non-essential tracking technologies before obtaining the necessary consent and documenting the consent.
- Review vendor agreements, including business collaboration agreements, for data use, model training, product improvement, subcontracting, security, breach notification, audit rights, and data retention obligations.
- Re-evaluate tracking technologies before introducing AI-powered personalization, chatbots, automated decision-making, or new digital health products.
Healthcare companies should also consider annual reviews of their digital ecosystems to identify risks before they become regulatory, litigation, or incident response issues.
AI-powered analytics should not be treated as just a website tool. Before implementing or expanding these technologies, organizations need to understand the data being collected, the inferences drawn from that data, and the contracts, consents, and governance controls required to manage risk.
