On July 20, 2023, the Department of Health and Human Services’ Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) sent a letter to approximately 130 health systems and telehealth providers emphasizing the privacy and security risks associated with the use of online tracking technologies (i.e. Meta/Facebook pixel and Google Analytics) for the collection and processing of consumer health data.  The action is intended to remind health care providers of their obligation under Health Insurance Portability and Accountability Act (HIPAA) and the FTC Act to protect health data from unauthorized disclosure under the law. OCR originally highlighted these concerns in a bulletin it issued in December 2022 that reminded healthcare entities of their responsibilities to protect health data from unauthorized disclosure under the law. A summary of that bulletin can be found here. 

...