Dobbs moved health privacy risk outside the medical record

The week

On June 24, 2022, the Supreme Court decided Dobbs v. Jackson Women’s Health Organization. The ruling overruled Roe v. Wade and Planned Parenthood v. Casey and returned the regulation of abortion to the states. Whatever one’s view of the decision, it changed the legal footing of health care overnight, and it did so differently in each state.

The case concerned a Mississippi law that banned most abortions after fifteen weeks of pregnancy. The Court upheld that law by six votes to three, and overruled Roe by five votes to four, in a majority opinion written by Justice Samuel Alito. The outcome was not a complete surprise. A draft majority opinion had been leaked and published in early May 2022, so health systems, regulators and technology companies had seven weeks of warning. Several states had so-called trigger laws, written to restrict abortion as soon as Roe fell, and some took effect within days or weeks of the decision.

Within days, attention turned to data. People began asking what digital traces might reveal a reproductive health decision: period-tracking apps that record cycles, location data showing visits to clinics, search histories, messages and medical records. Much of that information had been collected for ordinary reasons, such as convenience, advertising or care. Now its sensitivity looked very different.

Hospital websites were already under scrutiny. On June 16, eight days before the decision, The Markup and STAT published an investigation into the Meta Pixel, an advertising tracking tool, on hospital websites. It found the pixel sending data to Facebook when visitors clicked to schedule an appointment on the sites of 33 of the hospitals on Newsweek’s top 100 list. It also found the pixel inside the password-protected patient portals of seven health systems. The data sent included details such as the doctor’s name and specialty and search terms like “pregnancy termination,” tied to the visitor’s IP address.

The federal government responded quickly. On June 29, the HHS Office for Civil Rights (OCR), which enforces federal health privacy law, issued guidance on how the HIPAA Privacy Rule limits disclosures of protected health information, including to law enforcement. HIPAA is the federal law that sets rules for how doctors, hospitals, health plans and their contractors handle patients’ health information. “Protected health information” is the legal term for that information when those organizations hold it.

The guidance walked through the three permissions most relevant to reproductive health: disclosures required by law, disclosures for law enforcement purposes, and disclosures to avert a serious threat to health or safety. Its central message was that each is a permission with conditions, not a mandate. It gave examples of situations in which a provider could, and could not, disclose information about an abortion.

OCR also published separate guidance on protecting health information on personal phones and apps. That second document carried an important message for the public: much of the health data on a phone is not covered by HIPAA at all. It described practical steps, such as reviewing app permissions and turning off location services.

The private sector moved too. On July 1, Google said it would delete location history entries for visits to sensitive places such as abortion clinics. Location history is the record some phones keep of where their owner has been, often switched on years earlier and long forgotten. Some period-tracking app makers also announced new privacy features in the following weeks, in response to user concern.

A presidential executive order on access to reproductive health care, including privacy, followed on July 8. It asked the Federal Trade Commission to consider actions to protect consumers’ privacy when they seek information about reproductive health care. It also asked HHS to consider strengthening protections under HIPAA. On July 11, the FTC published a statement that it would fully enforce the law against illegal use and sharing of highly sensitive data, including location and health information.

For health systems, especially those operating in several states with very different laws, the week raised an urgent practical question. Where, exactly, does information about patients’ reproductive health live, and who controls it? The honest answer turned out to be: in many more places than the medical record, and often outside the health system’s control.

Take a patient in the summer of 2022. She uses a period-tracking app on her phone. She searches online for information about pregnancy options, then visits her hospital’s website and books a gynecology appointment. She logs in to the patient portal to check test results, and has connected a health app to that portal for convenience. Her phone’s location services are on. Each of those steps leaves a trace. Only some of them are protected the way she probably assumes.

Setting aside the merits of the decision, the subject is what it did to the data responsibilities of health systems, many of which operate across states with very different laws. The first instinct of most privacy offices was to look at the medical record. That was sensible, and HIPAA already gave them a framework. But the record was the best protected of the places where reproductive health information lived.

HIPAA protects health information held by covered entities and their business associates. Covered entities are health care providers, health plans and clearinghouses. Business associates are the contractors that handle health information on their behalf, such as billing firms or cloud providers, under a signed agreement. A great deal of revealing data sits elsewhere: in the tracking code on a hospital’s own website, and in apps, devices and data brokers that no health system controls. Three places matter, from most protected to least: the record, the hospital’s digital edge, and consumer data beyond HIPAA.

The article first sets out how those three rings fit together and how data moves between them. It then takes each ring in turn, from the record outward. It closes with what was at stake for health systems and what governing all three looks like.

Three rings of health data

A patient’s health information lives in three concentric rings.

The inner ring is the medical record and everything else the hospital holds about the patient’s care: clinical notes, test results, billing data, appointment history. HIPAA covers this ring tightly. The hospital has privacy officers, release-of-information staff and decades of procedures.

The middle ring is the hospital’s own digital presence: its public website, online scheduling pages, symptom checkers and the patient portal. The hospital owns these, but they are often built with pieces supplied by outside companies. That is where tracking technology comes in.

The outer ring is everything the patient does on her own devices and with consumer services: fitness and fertility apps, search engines, social media, messaging, online purchases and the location data her phone generates. The hospital does not hold any of this. HIPAA usually does not reach it.

Patients rarely see these rings. To them, it is all “my health information.” That gap between what patients assume and what the law actually protects is the heart of the issue.

How data moves between the rings

The rings are not sealed. Data moves outward through routes that health systems built for good reasons.

The first route is the patient’s own choice. Since the 21st Century Cures Act, certified health record systems have had to offer standard application programming interfaces that let patients send their records to apps of their choosing. That right of access is valuable. It also means a record can move, at the patient’s direction, from the inner ring to an app in the outer ring, where HIPAA usually no longer applies.

The second route is clinical exchange. Records flow between providers through health information exchanges and national networks, often across state lines. A note written in a state that protects abortion may be retrieved by a treating provider in a state that restricts it. Once there, it is subject to the receiving organization’s processes and to the legal demands that organization receives.

The third route is the hospital’s own website. A tracking pixel on a scheduling page takes details of a visit in the middle ring and sends them to an advertising platform in the outer ring. Unlike the first two routes, this one usually serves no patient purpose at all.

Seeing the routes clearly helps assign controls. The first is governed by patient education and app transparency. The second by record segmentation and release processes. The third by the hospital’s own technology choices, which makes it the easiest of the three to fix.

The record: a known process under new pressure

Inside the medical record, the HIPAA Privacy Rule set the terms. It permits, but generally does not require, disclosures to law enforcement, and most permissions come with conditions such as a court order, warrant or subpoena. OCR’s June 29 guidance stressed that point: covered entities could decline many requests unless a law required disclosure, and they should disclose only the minimum required.

That distinction between “permits” and “requires” matters a great deal. Many people assume that if a police officer or attorney asks for records, a hospital must hand them over. Often it need not. The rule gives the hospital room to say no, or to provide only what is strictly necessary, unless another law compels more.

The work here was procedural and familiar. Release-of-information staff, the team that handles requests for copies of records, needed a rule that any request touching reproductive health went to a designated reviewer and counsel before release. Multi-state systems needed to know which state’s law governed which request. Access monitoring for sensitive encounters, already common for celebrity patients and employees, could be extended to reproductive care. Access monitoring means automatically flagging when someone inside the organization opens a record they have no obvious reason to view. How federal and state rules combine in each state where a system operates is a question for its lawyers.

How a request might be handled

Suppose a records request arrives at a multi-state system. It is a subpoena from another state, asking for a patient’s records over a period that includes reproductive care. Under a sound process, the release-of-information clerk does not decide alone. The request is flagged automatically because of the type of care involved and routed to a designated privacy reviewer. The reviewer and counsel check whether the document is the kind of legal process that actually compels disclosure, which state’s law applies, and whether HIPAA permits, requires or limits the release. If disclosure is required, they release only the minimum necessary. Each step is logged. The aim is a sensitive decision made deliberately, by people qualified to make it, rather than by whoever happens to open the envelope, without obstructing legitimate legal process.

What the June 29 guidance did and did not change

The guidance clarified the existing rule. It did not create new protections. Where a state law, court order or other enforceable mandate compelled disclosure, HIPAA’s “required by law” permission still allowed it, and the hospital still had to comply. The guidance’s value was in the space between: the many requests that were permitted but not required, where a hospital could decline or narrow what it released.

That gap between clarification and new protection is why HHS later turned to rulemaking. For privacy offices in 2022, the practical effect was to make the existing discretion visible. It also gave release-of-information staff a federal document to point to when escalating a request rather than simply fulfilling it.

Segmenting sensitive information inside the record

Release processes govern what leaves on paper or by formal request. Much of the record now moves electronically, and that needs its own controls. Most major electronic health record systems can flag sensitive encounters, restrict certain notes, and require a “break the glass” step, with a stated reason, before a user outside the care team opens them. Those features help with internal snooping. They are much weaker at controlling what flows out through automated exchange.

Segmenting data for exchange is technically hard. Reproductive health information is scattered across problem lists, medication lists, lab results, procedure codes and free-text notes. Tagging all of it reliably, so that it can be withheld from some exchanges and not others, is beyond what most systems did well in 2022. The information blocking rules under the Cures Act also push the other way. Since April 2021 they have generally prohibited practices that interfere with access, exchange or use of electronic health information, subject to defined exceptions. Organizations should check with counsel about how the privacy-related exceptions apply before withholding data from exchange.

HIPAA itself gives patients two tools here. Patients may request restrictions on uses and disclosures. Providers usually need not agree, with one firm exception: they must agree not to disclose to a health plan information about care the patient paid for in full out of pocket. Patients may also request confidential communications, such as results sent to a different address or phone. Providers must accommodate reasonable requests. Front-desk and portal staff should know both rights and how to record them.

How the record ring differs by organization

A multi-state health system faces the hardest version of the record problem, because one request may involve care in one state, a patient living in a second and a requester in a third. A single-state system has a simpler legal map but may still receive requests from out of state. Ambulatory networks and independent clinics often rely on their record vendor’s default settings and a small staff for release of information, which makes a simple escalation rule more important than sophisticated tooling.

Health plans hold a different slice of the record: claims, prior authorizations and pharmacy data. Their distinctive exposure is the explanation of benefits, the statement mailed to the policyholder after a claim. A dependent on a parent’s or spouse’s plan may have care revealed to the policyholder that way. Plans must accommodate a confidential communications request when the person says disclosure could endanger them, and plan staff need to handle those requests promptly.

Pharmacies are covered entities too. Prescription records for medications used in reproductive care, some of which also have other uses, create their own requests and their own pressure on pharmacists. Telehealth providers that operate across state lines face the multi-state problem with even less physical presence to anchor which law applies.

This zone mattered, but it had owners, procedures and a governing rule. The two that follow had far less of each.

The digital edge: tracking code on the hospital’s own pages

Health system websites, scheduling pages and patient portals often carried third-party tracking technologies: analytics scripts, advertising pixels, session replay tools and embedded chat widgets. A few definitions help. An analytics script is a snippet of code that counts visitors and records what they click. An advertising pixel is a tiny, invisible element supplied by an advertising platform that reports each visit back to that platform, so it can measure ads and build audiences. Session replay tools record a visitor’s mouse movements and typing so designers can watch how people use a page. Chat widgets are the pop-up help boxes, often run by outside companies.

Marketing teams added them to measure campaigns and improve conversion, often without privacy review. On a page for booking a gynecology appointment or reading about pregnancy options, those tools could send the visitor’s IP address, device identifiers and page details to outside companies. An IP address is the numeric address of the internet connection a visitor is using. Device identifiers are codes that distinguish one phone or computer from another. Put together with the page’s address and title, they can show that a particular device looked at a particular kind of care.

Investigative reporting in mid-2022 showed that many hospital websites and some patient portals were sending such data to advertising platforms. After Dobbs, the stakes of that data flow changed. Information about a visit to a pregnancy options page, linked to an identifiable device, was now potentially sensitive in a legal sense as well as a personal one.

How a pixel actually sends the data

The mechanism is simple, which is why it spread so widely. A marketing team pastes a few lines of code from an advertising platform into the site’s template. When a visitor loads a page, the code fetches a script from the platform and runs it in the visitor’s browser. That script reports events back: the page address, often the page title, and actions such as button clicks.

Several details make the report identifying. The browser sends the visitor’s IP address with every request. If the visitor is logged in to the platform’s own service in the same browser, cookies can link the event to that account. Some configurations also capture form fields, such as a name or email, and send them hashed. Hashing scrambles a value in a consistent way, so the platform can match it against the hashed emails it already holds. The investigation found exactly this on at least one hospital booking form.

None of the parties needs to intend harm for this to happen. The pixel was designed to measure ads. A page titled “Schedule a pregnancy options consultation” turns that measurement into a sensitive disclosure.

The portal is a different case

Pages behind the portal login raise the starkest problem. Anything a patient does there relates to her care with that provider, so information sent from those pages is protected health information in almost any reading of HIPAA. A tracking tool there needs a business associate agreement with the vendor, or it needs to go.

Three kinds of tool deserve particular attention behind the login. Session replay tools can capture what a patient types, including messages to her clinician. Chat widgets run by outside companies keep transcripts on the vendor’s systems. Third-party scheduling platforms see the appointment type and the patient’s identity together. Each can be legitimate with the right agreement and configuration. None should be there by default.

Trade-offs the marketing team will raise

Removing pixels has costs. Digital marketing teams lose campaign attribution, the ability to say which ad produced which appointment. Advertising platforms optimize targeting using pixel data, so campaigns may become less efficient. For a health system competing for elective service lines, that is a real business loss, and the conversation goes better when privacy staff acknowledge it.

The alternatives have limits too. Server-side tagging moves the data through the hospital’s own servers first, but it protects patients only if those servers strip identifiers before forwarding anything. Configured carelessly, a server-side setup can send the same data by a less visible route. Consent banners do not solve the HIPAA problem, because clicking “accept” on a cookie notice is not a HIPAA authorization. And most large advertising platforms would not sign business associate agreements, which left them unable to receive protected health information under HIPAA at all.

A sound response did not need to wait for regulators. It started with an inventory of every third-party script on public and authenticated pages, built by scanning the sites and by asking marketing and digital teams what they had installed. Authenticated pages are those a visitor reaches after logging in, such as the patient portal. Each tool then needed a review: what data it sent, to whom, under what contract, and whether a business associate agreement was required or even possible. Tools that could not be governed came off sensitive service-line pages and all authenticated pages.

Where measurement was still needed, server-side analytics that kept data under the hospital’s control replaced client-side pixels. The difference is where the data goes first. A client-side pixel runs in the visitor’s browser and sends data straight to the outside company. Server-side analytics send data to the hospital’s own systems first, where it can be filtered before anything is shared.

Governance had to change too. A rule that no tracking technology goes live without privacy and security review, enforced through the web content management system, keeps the inventory from refilling. The content management system is the software staff use to publish web pages. Building the review step into it means the rule is applied by the tool, not left to memory.

Consider a health system operating in three states. Its digital team scans the public website and patient portal and finds more than thirty outside scripts, some installed years earlier for campaigns long since finished. Several advertising pixels sit on pages for obstetrics, gynecology and family planning, and one analytics tool runs inside the portal. The privacy office reviews each tool. Advertising pixels come off every sensitive service-line page and the entire portal. The analytics tool inside the portal is replaced with a server-side setup the hospital controls. A new rule in the content management system blocks publication of any page containing an unapproved script. Marketing still gets campaign reports, built from data that never leaves the hospital in identifiable form.

Beyond HIPAA: the data patients assumed was protected

The least protected data was data health systems never held. Period-tracking and fertility apps, location data sold by brokers, search histories, purchase records and messaging content could reveal reproductive health decisions without touching a medical record. Data brokers are companies that collect personal information from many sources, such as apps and online activity, and sell or license it to others.

Many patients assumed this information was covered like their chart. Usually it was not covered by HIPAA at all. The Federal Trade Commission’s authority over unfair and deceptive practices applied, and a few states had relevant laws, but there was no general federal rule.

Health systems could not govern this data, but they shaped how patients met it. Some updated patient education to explain app privacy settings and location controls. Some reviewed which consumer apps their clinicians recommended and which apps connected to the patient portal through data access interfaces. These interfaces, often called APIs, are standard connections that let a patient direct the portal to share her records with an app of her choosing. Data that leaves the portal for a consumer app usually leaves HIPAA’s protection too. Some examined their own patient-facing apps for location tracking and data sharing they did not need.

That last step points to the one control that works in every legal scenario: collect less. Data never collected cannot be subpoenaed, sold or breached. A health system that turns off location collection in its app, shortens retention of web analytics and strips identifiers from marketing data has reduced risk regardless of how state laws evolve.

How the location trail is built

Location data reaches the market through ordinary apps. Many free apps embed software development kits from advertising or analytics firms. Those kits can collect the phone’s location whenever the app has permission, along with an advertising identifier unique to the device. The kit maker may sell or license the data, sometimes through several intermediaries, to data brokers.

A buyer can then draw a boundary around a building, such as a clinic, and list the devices seen inside it. Following those devices to where they spend nights can suggest a home address. The data is often described as anonymous because it carries no name. The device identifier and the pattern of movement can make that description hard to sustain.

Health systems cannot stop this market. They can make sure their own apps do not feed it, by reviewing the software kits embedded in them and turning off location collection that serves no clinical purpose.

Which law reaches what

Being precise about the outer ring helps health systems avoid both over-promising and over-reacting. The FTC Act’s prohibition on unfair and deceptive practices applies to most consumer apps and data brokers, which is why a privacy policy that misdescribes data sharing can become an enforcement case. The FTC’s Health Breach Notification Rule applies to vendors of personal health records that HIPAA does not cover. In September 2021, the FTC had said it reads that rule to cover many health apps.

State law was thin in 2022. California’s privacy law, as amended by voter initiative, treated health information as sensitive personal information from 2023, with limits on its use. Most states had no comparable consumer privacy law at the time.

The hospital’s own consumer app needs a separate check. An app a covered entity offers to its patients, handling their health information on its behalf, is generally within HIPAA. Its location features, analytics libraries and advertising software development kits therefore deserve the same review as the website, and often get less.

What useful patient education looks like

Good patient education on this topic is short, specific and honest. It explains, in a few sentences, that the hospital’s records are covered by federal privacy law and that the hospital has rules for responding to legal requests. It then explains, just as clearly, that apps on a patient’s own phone, search engines, and location services are generally outside that law. It adds that data a patient chooses to send from the portal to an app may no longer be protected in the same way. It points to practical steps: how to review an app’s privacy settings, how to turn off location history, how to check which apps are connected to the portal. It avoids legal advice and avoids reassurance the hospital cannot back up. A one-page handout and a matching web page are often enough.

Clinicians matter here too. When a physician recommends a consumer app for tracking symptoms or cycles, patients reasonably assume the hospital has vetted it. A short approved list, reviewed by privacy staff, keeps those recommendations consistent with what the organization can stand behind.

Front-line staff belong in this zone as well. Patients ask nurses, schedulers and call center agents about privacy first. Short, accurate guidance on what the health system protects, and what it cannot control, lets staff answer calmly without promising more than the organization can deliver.

Trust, lawsuits and a marketing collision

This is no niche privacy topic. It touches the core of a health system’s relationship with its patients.

• Trust. Patients who fear their information may be exposed may delay care or withhold details from clinicians. That is a clinical risk as well as a reputational one.
• Legal exposure. Tracking code that sends sensitive page visits to outside companies can draw regulatory attention and lawsuits, independent of any change in abortion law.
• Multi-state complexity. Systems that operate across state lines face different rules for the same request, depending on where the patient, the care and the requester are.
• Marketing and privacy alignment. Digital marketing teams are measured on reach and conversion; privacy teams on risk. Without a shared rule, the two collide on the hospital’s own website.
• Staff confidence. Front-line employees need clear, honest answers to give patients. Vague reassurance that later proves wrong damages trust more than candor.

Why the pixel exposure did not depend on Dobbs

The legal risk from tracking code had a separate basis. Class actions over hospital website tracking predated the decision, typically brought under state wiretap, consumer protection and medical confidentiality laws. Plaintiffs argued that sending page activity to an advertising platform without consent was an interception or an unauthorized disclosure. Dobbs raised the stakes of the data, but a health system that removed its pixels was reducing litigation exposure that existed in every state.

That matters for how the work is sold internally. Framed only as an abortion-related precaution, pixel removal can become politically contentious inside an organization. Framed as basic HIPAA hygiene and litigation risk reduction, it is easier to agree on, and equally true.

Sequencing for a stretched privacy team

Few privacy offices could do everything at once. A sensible order started with the two changes that took days, not months. First, a rule routing every legal request touching reproductive health to a designated reviewer and counsel. Second, removal of advertising pixels from sensitive service-line pages and from everything behind the portal login.

The next three months could cover the full script inventory, the publishing gate in the content management system and a review of the health system’s own apps. Patient education, the approved app list and retention settings for analytics could follow within the year. That order put the fastest risk reduction first and left the slower, consensus-building work for when the urgent exposures were closed.

The strongest objection to this framing

A privacy officer could fairly push back. Legal process targets records, and the record is where a health system has legal duties and direct control. Consumer data is beyond its reach. Spending scarce privacy capacity on patient education and app reviews, the argument goes, dilutes attention from the one ring where the organization can be compelled to act.

Part of that is right. The record deserves the most rigorous process, and the article’s first ring gives it that. But the objection misreads where control lies. The digital edge is entirely within the health system’s control, and in 2022 it was the ring leaking most freely, through tools that served no clinical purpose. Fixing it required no new law and little budget.

The objection does carry weight in one area. Health systems cannot fix the consumer data market, and should not try. Their role in the outer ring is narrow: tell patients the truth, recommend apps carefully, and keep their own apps lean. Anything more ambitious is likely to fail and to promise more than the organization can deliver.

Governing the record, the edge and the app

Signs of a well-governed health system

• A designated reviewer and counsel see every legal request touching reproductive health before release.
• A current inventory of every third-party script on the website, scheduling pages and portal, with an owner and a review for each.
• No advertising pixels on sensitive service-line pages or anywhere behind the portal login.
• A publishing rule, enforced by the content management system, that blocks unreviewed tracking tools.
• Patient education that explains what HIPAA covers and what it does not.
• Patient-facing apps that collect only the data they need and keep it only as long as necessary.
• A short script for front-line staff on privacy questions.

Where systems slipped

• Looking only at the record. The best-governed zone gets the most attention, while the website shares data unnoticed.
• Assuming marketing tools are harmless. A pixel installed for one campaign can stay on a sensitive page for years.
• Over-promising to patients. Telling patients “your data is protected” when it has left the portal for a consumer app sets up a breach of trust.
• Collecting by default. Location tracking and long analytics retention create risk with little benefit.
• Treating it as one-time cleanup. Without a publishing gate, new trackers arrive with the next campaign.

Owners, evidence and measures

Each ring needs a named owner. The privacy officer, working with counsel and health information management, owns legal requests against the record. The digital or marketing leader owns the website and app, with the privacy office holding a veto over tracking tools. Patient experience and clinical leadership own education and app recommendations. A quarterly review that brings the three together keeps the rings from drifting apart.

The evidence an auditor or regulator would ask for is concrete. A log of legal requests touching sensitive care, showing who reviewed each and what was released. A dated inventory of third-party scripts, with the review decision for each. The publishing rule in the content management system and its exception log. The list of business associate agreements for web and analytics vendors. The current patient education materials and approved app list.

Contracts with web, analytics and scheduling vendors deserve a pass of their own. Useful terms bar the vendor from using the hospital’s data for its own purposes, such as building advertising profiles. They set deletion on termination, require notice of any change in data sharing, and name the business associate agreement where one applies.

A few measures show whether the program is working. The number of third-party scripts on sensitive service-line pages and behind the portal login, which should be zero for ungoverned tools. Days since the last full site scan. The share of sensitive legal requests routed to the designated reviewer. The retention period for web analytics data, set deliberately rather than left at a vendor default.

Requests, trackers and apps the privacy office should know about

1. Who reviews a legal request for records that touch reproductive health, and does counsel see it before anything is released?
2. How many outside scripts run on our website, scheduling pages and patient portal? When was that list last checked?
3. Are any advertising or analytics tools sending data from sensitive service-line pages or from behind the portal login?
4. Which consumer apps connect to our patient portal, and do patients understand that data sent to them may leave HIPAA’s protection?
5. If a reporter scanned our website tomorrow, what would they find?

Answers to the first question tend to be reassuring. Answers to the last two are where most health systems found their work.

With hindsight

The policy response unfolded unevenly, and most of it landed in the two outer zones, the hospital’s digital edge and the consumer data beyond HIPAA, rather than in the medical record.

The FTC moved first on location data. In August 2022 it sued Kochava, a data broker, alleging that its location data could be used to track people to sensitive places, including reproductive health clinics. In early 2024 it reached orders with two other location data companies, X-Mode Social and InMarket, restricting their use and sale of sensitive location data. It also brought its first enforcement actions under the Health Breach Notification Rule, starting with GoodRx in February 2023, and in 2024 amended that rule to make clearer that it covers health apps.

In December 2022, OCR issued a bulletin on tracking technologies on regulated entities’ websites and apps. In July 2023, OCR and the FTC jointly wrote to about 130 hospital systems and telehealth providers warning about tracking technologies on their sites. OCR updated the bulletin in March 2024.

A federal court in Texas vacated part of the bulletin in June 2024, in a suit brought by the American Hospital Association. The vacated part concerned public, unauthenticated web pages, where the bulletin had treated an IP address combined with a visit to a page about a health condition as protected health information. The court held that HHS had exceeded its authority on that point.

Class actions over pixels on hospital sites and FTC enforcement against consumer health apps continued. Health systems also reported pixel-related disclosures to HHS as breaches. Advocate Aurora Health reported in October 2022 that up to 3 million patients may have been affected. In 2024, Kaiser Permanente notified about 13.4 million people that tracking code on its websites and apps may have shared information with outside companies. For health systems, the practical message did not change with the court ruling: tracking code on health pages remained a source of legal and reputational risk.

Washington’s My Health My Data Act, passed in 2023, extended protections to consumer health data outside HIPAA, and other states followed. Most of its provisions took effect in March 2024, and it gave consumers a private right of action. Nevada and Connecticut passed related laws the same year. That began to close the gap in the outer ring, though state by state rather than nationally.

Inside the record, HHS finalized a HIPAA rule in April 2024 adding protections for reproductive health information. It barred certain uses and disclosures aimed at investigating or penalizing lawful reproductive care, and required an attestation from some requesters. A federal court in Texas vacated most of it in June 2025. The inner ring, which had seemed the most settled in 2022, turned out to be contested as well.

State legislatures moved in both directions. Several states passed shield laws limiting the release of reproductive health records in response to out-of-state legal process. Others moved to restrict abortion further. A multi-state health system could face both kinds of law at once.

By 2026 the legal map is still contested and state-specific. Rules have been issued, challenged, narrowed and in some cases struck down. For a health system trying to plan, that churn makes legal requirements a moving target.

What held up was the shape of the exposure. The most consequential enforcement and litigation since 2022 has concerned the digital edge and consumer data, not disclosures from the chart. What proved less durable was the expectation that federal HIPAA rules would be the main instrument of protection.

The durable controls are operational: govern tracking code on every page, keep a disciplined process for legal requests, and collect less. They do not depend on how any particular court rules. Each reduces risk under every version of the law that has appeared since 2022. The same test serves privacy investments generally. When the rules are unsettled, favor the steps that help regardless of how they settle, and make sure the organization can say plainly to patients what it protects and what it cannot.