As a provider, a question worth asking yourself these days is this: what degree of risk is there that you might have something on your website that could lead to a multi-million-dollar class-action lawsuit and a determination by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) that you violated the Health Insurance Portability and Accountability Act (HIPAA)?
As anyone who has seen the pop-up banners on many websites over the past few years knows, websites often use “cookies,” small packets of data, to track activities on the site. Sometimes, these cookies also share information with third parties.
Social media and online ad companies provide some of the most common cookies and other tracking tools to website owners. “Meta Pixel,” provided by Meta – Facebook’s parent company – and Google Analytics are among the most ubiquitous. But nearly every social media company, such as LinkedIn, Snapchat, TikTok, Twitter-slash-X, offers something.
These cookies are often used to figure out how effective advertising campaigns and websites are at driving people to sites and then prompting them to take certain actions, such as buying a product – or, potentially, making an appointment with a doctor.
In the process, these tools often send information back to a third party, such as Meta or Google.
And here’s where OCR and some plaintiffs think there might be a problem.
In the past year, dozens of class-action lawsuits have been filed against healthcare entities because of their websites’ use of Meta Pixel and other tools. We have four in federal court just here in Minnesota, where I am.
So far, these lawsuits have mostly targeted hospital systems. But they are starting to target smaller entities. For example, one was recently filed against a small clinic in Florida.
The central claim is that healthcare entities cannot share information people provide on their websites. Tracking technologies do that.
So, what’s the risk?
An older, similar case settled for $18.4 million.
One of the newer cases settled about a month ago for more than $12 million.
But on the other hand, federal courts have also dismissed (or mostly dismissed) several cases in the last few months.
Because these lawsuits are so new, it’s hard to say what the risk will ultimately be.
Unfortunately, the risk is not just a lawsuit. OCR issued guidance in December 2022 related to these tools. It took the position that many practices and uses of tracking technologies are barred by HIPAA’s Privacy Rule. It reminded readers that civil penalties may apply if the use violates HIPAA. Fortunately, it also gave some examples of where HIPAA does not apply.
If David Glaser were here, he would remind us that guidance is only guidance. It is not the law.
And one federal judge recently ruled that OCR’s interpretation, and I quote, “goes well beyond the meaning of what the statute can bear.”
So, what can you do to reduce your risk?
Start by evaluating:
Ultimately, it is tough to say what the full risk is. Situations vary, and it may be fact-sensitive. And all this action regarding healthcare cookies is still new and changing.
So, while I’m not sure if it’s because my 3-year-old just discovered the glories of Sesame Street, or because I spend a lot of time thinking about cookies on my clients’ websites, either way, the Cookie Monster’s song “C is for Cookie” has been stuck in my head recently.
Cookie Monster sings, “C is for Cookie, that’s good enough for me.”
Cookie Monster is right:
C is for Cookie, and that might be good enough for Cookie Monster.
But C is also for “Class Action Lawsuit.”
Or a “Complaint” filed with the Office for Civil Rights.
Go get yourself a cookie to eat, and then check in on your website’s cookies.
Many hospitals nationwide are facing significant challenges in benchmarking and quality reporting. While it may seem like these issues stem from complex clinical variations, the
The recent convergence of fiscal austerity and political realignment in Washington, D.C. has placed essential healthcare programs under heightened scrutiny. Chief among them are the
Please log in to your account to comment on this article.
Uncover critical guidance. HIM coding expert, Kay Piper, RHIA, CDIP, CCS, provides an interactive review on important information in each of the AHA’s 2025 ICD-10-CM/PCS Quarterly Coding Clinics in easy-to-access on-demand webcasts, available shortly after each official publication.
Uncover critical guidance. Kay Piper provides an interactive review on coding guidelines and more in the AHA’s fourth quarter 2025 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance. Kay Piper provides an interactive review on coding guidelines and more in the AHA’s third quarter 2025 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance. Kay Piper provides an interactive review on coding guidelines and more in the AHA’s second quarter 2025 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Providers face increasing Medicare audits when using skin substitute grafts, leaving many unprepared for claim denials and financial liabilities. Join veteran healthcare attorney Andrew B. Wachler, Esq., in this essential webcast and master the Medicare audit process, learn best practices for compliant billing and documentation, and mitigate fraud and abuse risks. With actionable insights and a live Q&A session, you’ll gain the tools to defend your practice and ensure compliance in this rapidly evolving landscape.
Dr. Ronald Hirsch dives into the basics of Medicare for clinicians to be successful as utilization review professionals. He’ll break down what Medicare does and doesn’t pay for, what services it provides and how hospitals get paid for providing those services – including both inpatient and outpatient. Learn how claims are prepared and how much patients must pay for their care. By attending our webcast, you will gain a new understanding of these issues and be better equipped to talk to patients, to their medical staff, and to their administrative team.
Hospitals face growing challenges in measuring observation metrics due to inconsistencies in classification, payer policies, and benchmarking practices. Join Tiffany Ferguson, LMSW, CMAC, ACM, and Anuja Mohla, DO, FACP, MBA, ACPA-C, CHCQM-PHYADV as they provide critical insights into refining observation metrics. This webcast will address key issues affecting observation data integrity and offer strategies for improving consistency in reporting. You will learn how to define meaningful metrics, clarify commonly misinterpreted terms, and apply best practices for benchmarking, and gain actionable strategies to enhance observation data reliability, mitigate financial risk, and drive better decision-making.
The 2025 Medicare Physician Fee Schedule brings significant changes to payment rates, coverage, and coding for physician services, impacting practices nationwide. Join Stanley Nachimson, MS., as he provides a comprehensive guide to understanding these updates, offering actionable insights on new Medicare-covered services, revised coding rules, and payment policies effective January 1. Learn how to adapt your practices to maintain compliance, maximize reimbursement, and plan for revenue in 2025. Whether you’re a physician, coder, or financial staff member, this session equips you with the tools to navigate Medicare’s evolving requirements confidently and efficiently.
Copyright © 2025 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Inpatient Admission Order: Master the Who, When, and How Webcast‘ as a token of our heartfelt appreciation! Click here to learn more →
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
