HHS OCR HIPAA online tracking guidance
HHS OCR guidance explains how HIPAA applies when covered entities and business associates use tracking technologies on websites or mobile apps that collect or disclose protected health information.
Federal · Effective · Implementation Mar 18, 2024
What it is
- What changed
- HHS OCR explains that regulated entities may not use tracking technologies in ways that impermissibly disclose PHI to tracking technology vendors and describes HIPAA compliance obligations for authenticated pages, unauthenticated pages, and mobile apps.
- Why it matters
- Caregivers often interact with portals, intake forms, telehealth sites, and care apps; tracking choices can turn private care context into a compliance and trust problem.
- Who it touches
- Family caregivers, Care providers and plans, People receiving care, Businesses and agencies that must complypatients, family caregivers, covered healthcare providers, health plans, business associates, tracking technology vendors
- What it does
- Plans, studies, registries or guidance
Sources
- HHS OCR guidance on HIPAA and online tracking technologies
- FTC/HHS online tracking technology warning letters
Last reviewed Jul 4, 2026. This is information, not legal advice; check the source for the current text.