OCR Files Notice of Appeal in Online Tracking Technologies Case


On August 19, 2024, the US Department of Health and Human Services Office for Civil Rights (OCR) filed a notice of appeal of the US District Court for the Northern District of Texas’s June 20, 2024, decision in American Hospital Association (AHA), et al. v. Xavier Becerra, et al. The district court held that OCR exceeded its authority in certain respects in a bulletin (the Bulletin) concerning HIPAA’s application to cookies and other online tracking technologies on HIPAA-regulated entities’ unauthenticated webpages (i.e., webpages that are publicly available and do not require users to log in before they are able to access the webpage). OCR last updated the live, online version of the Bulletin on June 26, 2024, to state that OCR “is evaluating its next steps in light of [the Northern District of Texas’s] order.” For more information about the decision, see our On the Subject.

A notice of appeal does not specify the arguments to be made on appeal. OCR likely will file an opening brief in the US Court of Appeals for the Fifth Circuit within the next few months that will identify and set forth its arguments about why the June 20 district court decision should be overturned. Those arguments are likely to fall within the scope of what OCR argued to the district court, including that:

The Fifth Circuit is unlikely to resolve the appeal until sometime in 2025. In the meantime, the district court’s June 20 ruling will remain in place unless OCR seeks and secures a stay of that ruling pending resolution of the appeal. To date, OCR has not sought such a stay.

Individuals and organizations interested in the outcome of this appeal will have the opportunity to submit amicus curiae (“friend of the court”) briefs to the court of appeals, likely in late 2024 or early 2025.


© 2025 McDermott Will & Emery
National Law Review, Volume XIV, Number 243