Summary of article from Health Law Attorney Blog:
In a recent decision, the United States District Court for the Northern District of Texas partially granted summary judgment to the plaintiffs, striking down the HHS rule that expanded the definition of “Individually Identifiable Health Information” (IIHI) to include the combination of an individual’s IP address and their visits to healthcare providers’ websites. The Court ruled that HHS exceeded its statutory authority under HIPAA and imposed new legal obligations without proper rulemaking procedures. This decision relieves healthcare providers from the significant compliance burdens associated with the now-invalidated rule. Providers should review their use of tracking technologies to ensure compliance with the ruling and stay informed about any new guidance from HHS. This case underscores the necessity for clear, consistent regulatory guidance aligned with statutory definitions and procedural norms.