On August 19, 2024, the US Department of Health and Human Services Office for Civil Rights (OCR) filed a notice of appeal of the US District Court for the Northern District of Texas’s June 20, 2024, decision in American Hospital Association (AHA), et al. v. Xavier Becerra, et al. The district court held that OCR exceeded its authority in certain respects in a bulletin (the Bulletin) concerning HIPAA’s application to cookies and other online tracking technologies on HIPAA-regulated entities’ unauthenticated webpages (i.e., webpages that are publicly available and do not require users to log in before they are able to access the webpage). OCR last updated the live, online version of the Bulletin on June 26, 2024, to state that OCR “is evaluating its next steps in light of [the Northern District of Texas’s] order.” For more information about the decision, see our On the Subject.

A notice of appeal does not specify the arguments to be made on appeal. OCR likely will file an opening brief in the US Court of Appeals for the Fifth Circuit within the next few months that will identify and set forth its arguments about why the June 20 district court decision should be overturned. Those arguments are likely to fall within the scope of what OCR argued to the district court, including that:

• The court lacked jurisdiction over AHA’s claims because the Bulletin was not a final agency action and the Administrative Procedure Act (APA) grants federal courts jurisdiction only over final agency actions; and
• AHA’s claims fail on the merits because:
  • The Bulletin’s reminder that the HIPAA Privacy Rule and Security Rule apply to protected health information collected by online tracking technologies on unauthenticated webpages is consistent with the statutory definition of “individually identifiable health information”;
  • The Bulletin was not the result of arbitrary or capricious decision-making; and
  • The Bulletin did not require notice-and-comment rulemaking procedures because the APA expressly exempts “interpretative rules, general statements of policy, or results or agency organization, procedure, or practice” from such procedures.

The Fifth Circuit is unlikely to resolve the appeal until sometime in 2025. In the meantime, the district court’s June 20 ruling will remain in place unless OCR seeks and secures a stay of that ruling pending resolution of the appeal. To date, OCR has not sought such a stay.

Individuals and organizations interested in the outcome of this appeal will have the opportunity to submit amicus curiae (“friend of the court”) briefs to the court of appeals, likely in late 2024 or early 2025.