As a provider, a question worth asking yourself these days is this: what degree of risk is there that you might have something on your website that could lead to a multi-million-dollar class-action lawsuit and a determination by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) that you violated the Health Insurance Portability and Accountability Act (HIPAA)?
As anyone who has seen the pop-up banners on many websites over the past few years knows, websites often use “cookies,” small packets of data, to track activities on the site. Sometimes, these cookies also share information with third parties.
Social media and online ad companies provide some of the most common cookies and other tracking tools to website owners. “Meta Pixel,” provided by Meta – Facebook’s parent company – and Google Analytics are among the most ubiquitous. But nearly every social media company, such as LinkedIn, Snapchat, TikTok, Twitter-slash-X, offers something.
These cookies are often used to figure out how effective advertising campaigns and websites are at driving people to sites and then prompting them to take certain actions, such as buying a product – or, potentially, making an appointment with a doctor.
In the process, these tools often send information back to a third party, such as Meta or Google.
And here’s where OCR and some plaintiffs think there might be a problem.
In the past year, dozens of class-action lawsuits have been filed against healthcare entities because of their websites’ use of Meta Pixel and other tools. We have four in federal court just here in Minnesota, where I am.
So far, these lawsuits have mostly targeted hospital systems. But they are starting to target smaller entities. For example, one was recently filed against a small clinic in Florida.
The central claim is that healthcare entities cannot share information people provide on their websites. Tracking technologies do that.
So, what’s the risk?
An older, similar case settled for $18.4 million.
One of the newer cases settled about a month ago for more than $12 million.
But on the other hand, federal courts have also dismissed (or mostly dismissed) several cases in the last few months.
Because these lawsuits are so new, it’s hard to say what the risk will ultimately be.
Unfortunately, the risk is not just a lawsuit. OCR issued guidance in December 2022 related to these tools. It took the position that many practices and uses of tracking technologies are barred by HIPAA’s Privacy Rule. It reminded readers that civil penalties may apply if the use violates HIPAA. Fortunately, it also gave some examples of where HIPAA does not apply.
If David Glaser were here, he would remind us that guidance is only guidance. It is not the law.
And one federal judge recently ruled that OCR’s interpretation, and I quote, “goes well beyond the meaning of what the statute can bear.”
So, what can you do to reduce your risk?
Start by evaluating:
Ultimately, it is tough to say what the full risk is. Situations vary, and it may be fact-sensitive. And all this action regarding healthcare cookies is still new and changing.
So, while I’m not sure if it’s because my 3-year-old just discovered the glories of Sesame Street, or because I spend a lot of time thinking about cookies on my clients’ websites, either way, the Cookie Monster’s song “C is for Cookie” has been stuck in my head recently.
Cookie Monster sings, “C is for Cookie, that’s good enough for me.”
Cookie Monster is right:
C is for Cookie, and that might be good enough for Cookie Monster.
But C is also for “Class Action Lawsuit.”
Or a “Complaint” filed with the Office for Civil Rights.
Go get yourself a cookie to eat, and then check in on your website’s cookies.
A few weeks ago, during the weekly Monitor Monday broadcast, healthcare attorney David Glaser, presented a great segment that simplified the two-midnight rule into two
Imagine the frustration you might feel if, after you negotiate a settlement, under which you are paying a departing employee a respectable sum of money,
Please log in to your account to comment on this article.
Join Beth Wolf, MD, CPC, CCDS, for an in-depth webcast on the FY2025 spinal fusion MS-DRG updates. Discover key changes in DRG classification, understand impacts on documentation and CMI, and learn strategies to ensure compliance.
Join Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, as she presents effective strategies to strengthen collaboration between CDI, coding, and quality departments in acute care hospitals. Angela will also share guidance on implementing cross-departmental meetings, using shared KPIs, and engaging leadership to foster a culture of collaboration. Attendees will gain actionable tools to optimize documentation accuracy, elevate quality metrics, and drive a unified approach to healthcare goals, ultimately enhancing both patient outcomes and organizational performance.
Optimize your outpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to outpatient CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. You will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.
Enhancing outpatient clinical documentation is crucial for maintaining accuracy, compliance, and proper reimbursement in today’s complex healthcare environment. This webcast, presented by industry expert Angela Comfort, DBA, RHIA, CDIP, CCS, CCS-P, will provide you with actionable strategies to tackle complex challenges in outpatient documentation. You’ll learn how to craft detailed clinical narratives, utilize advanced EHR features, and implement accurate risk adjustment and HCC coding. The session also covers essential regulatory updates to keep your documentation practices compliant. Join us to gain the tools you need to improve documentation quality, support better patient care, and ensure financial integrity.
Dr. Ronald Hirsch provides critical details on the new Medicare Appeal Process for Status Changes for patients whose status changes during their hospital stay. He also delves into other scenarios of hospital patients receiving custodial care or medically unnecessary services where patient notifications may be needed along with the processes necessary to ensure compliance with state and federal guidance.
Healthcare organizations face complex regulatory requirements under the No Surprises Act and Price Transparency rules. These policies mandate extensive fee disclosures across settings, and confusion is widespread—many hospitals remain unaware they must post every contracted rate. Non-compliance could lead to costly penalties, financial loss, and legal risks. Join David M. Glaser Esq. as he shows you how to navigate these regulations effectively.
Protect your facility from unwanted audits! Join Becky Jacobsen, BSN, RN, MBS, CCS-P, CPC, CPEDC, CBCS, CEMC, and take a deep dive into both the CMS and AMA guidelines for reporting post operative pain blocks. You’ll learn how to determine if the nerve block is separately codable with real life examples for better understanding. Becky will also cover how to evaluate whether documentation supports medical necessity, offer recommendations for stronger documentation practices, and provide guidance on educating providers about documentation requirements. She’ll include a discussion of appropriate modifier and diagnosis coding assignment so that you can be confident that your billing of post operative pain blocks is fully supported and compliant.
During this RACmonitor webcast Dr. Ronald Hirsch spotlights the areas of the OIG’s Work Plan and the findings of their most recent audits that impact utilization review, case management, and audit staff. He also provides his common-sense interpretation of the prevailing regulations related to those target issues. You’ll walk away better equipped with strategies to put in place immediately to reduce your risk of paybacks, increased scrutiny, and criminal penalties.
Copyright © 2024 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
