AHA says OCR's online tracking tool rules need to go

The American Hospital Association says new regs from the HHS Office for Civil Rights clash with HIPAA, contradict interoperability efforts and are "flawed as a matter of law and harmful as a matter of policy."

By Andrea Fox October 03, 2023

10:28 AM

AHA says OCR's rules limit the ability of hospitals to assess how their patients use their websites and access important health-related information.

In a letter to the Senate Committee on Health, Education, Labor and Pensions, the American Hospital Association said the U.S. Health and Human Services Office of Civil Rights rule regarding the use of online tracking tools is at odds with existing HIPAA rules and could cause meaningful harm to patients and public health.

"Congress should urge OCR to withdraw the rule immediately,"  AHA said  in its response to a request for information on data privacy and HIPAA.

WHY IT MATTERS

On behalf of AHA and its members – 5,000 healthcare organization members, 270,000 affiliated physicians, 2 million nurses and other caregivers and 43,000 healthcare leaders – the organization told the HELP Committee that it believes the current HIPAA rules are an effective framework for sharing patients’ protected health information "without creating significant impediments to the robust use and disclosure of information necessary to support high-quality care."

For these reasons, the AHA "does not believe that Congress should make any major revisions to HIPAA at this time," the organization said by letter on September 28.

AHA, however, noted two specific issues that "would benefit from congressional attention" – OCR's December rule regarding the use of online tracking tools and the various state privacy regulations that pile on HIPAA.

In its September RFI, the HELP Committee  asked stakeholders for feedback  on a number of questions about health data and accountability, including whether accountable entities should have a duty of loyalty to patients and how it could be imposed so as to minimize burdens on those entities.

"Should requirements of such a duty be based on the sensitivity of collected data?"

While saying it believes that no changes to HIPAA are needed at this time, AHA asked Congress to urge OCR to withdraw its December rule barring healthcare organizations from using online tracking tools to collect information about how users interact with regulated entities’ websites.

The association said  the rule  has resulted in consequences that contravene OCR's efforts to encourage hospitals to share non-private healthcare information with the public.

"This rule is flawed as a matter of law and harmful as a matter of policy," the AHA asserted.

Hospitals and health systems are caught between OCR's "unlawful rule" governing the use of online tracking tools and third-party vendors and are not able to provide "the most reliable health information available," AHA said.

"Without consulting healthcare providers, third-party technology vendors or the public at large, the agency issued a sub-regulatory guidance document that has had profound effects on hospitals, health systems and the communities they serve."

In the new rule, "OCR took the position that when an online technology connects an individual’s IP address with a visit to a public webpage that addresses specific health conditions or healthcare providers, that combination of information is subject to restrictions on use and disclosure under HIPAA," AHA explained.

"Thus, website visitors’ IP addresses are protected even if they are not actually seeking medical care."

In OCR’s "misguided view," the same HIPAA protections apply if visitors search for any medical information, such as general health information, information for a relative, academic research and more – and that violates HIPAA, AHA argued.

HIPAA and its implementing regulations "strike a balance," protecting patient privacy while permitting "important uses of information," according to AHA.

AHA said OCR's online tracking tools policy means that hospitals and health systems can no longer rely on third-party technologies like Google Analytics, YouTube and other video applications.

Without analytics, organizations cannot judge which areas of a website patients are having trouble navigating, the level of community concern for particular medical concerns and more.

"These tools allow hospitals to more effectively allocate resources and help community members to more easily find the healthcare information that they are seeking," AHA said.

Without third-party maps and location services, hospitals are pressed to provide better information about where healthcare services are available, the organization cited as an example. They'll be forced to restrict the use of tools like embedded bus schedules or driving directions to and from a patient's location.

Limiting video technologies also minimizes the range of health information health systems can share with the communities they serve, said AHA.

"Hospitals and health systems cannot risk the serious consequences that flow from OCR’s unlawful rule, including HIPAA enforcement actions, class action lawsuits or the loss of significant investments in existing websites," AHA said in its request.

Meanwhile, third parties can decline to sign business associate agreements that would commit them to protecting private patient information, AHA noted.

"If the OCR’s new rule is permitted to stand, hospitals and health systems will be forced to restrict the use of valuable third-party technologies like these."

In addition, AHA has long advocated that HIPAA’s requirements be the uniform nationwide standard for protecting the privacy and security of all patient information. Because the HIPAA framework is both effective and entrenched, Congress should enact full federal preemption for HIPAA, the hospital organization said.

"The patchwork of differing requirements poses significant challenges for providers’ use of a common electronic health record that is a critical part of the infrastructure necessary for effectively coordinating patient care and maintaining population health," said AHA.

"For all the strengths of the existing HIPAA framework, its approach to preemption has proven to be problematic," the group claimed in the HELP Committee letter.

"In addition, the existing state and federal patchwork of health information privacy requirements remains a significant barrier to the robust sharing of patient information necessary for coordinated clinical treatment," said AHA. "If Congress were to make any changes to HIPAA, it should address this problem and enact a full preemption provision."

THE LARGER TREND

In July, OCR and the Federal Trade Commission  sent a warning letter to hospitals about online tracking pixels  reminding healthcare organizations about their responsibilities for third-party disclosures of protected health information under HIPAA, the FTC Act and the FTC Health Breach Notification Rule.

"Even if you are not covered by HIPAA, you still have an obligation to protect against impermissible disclosures of personal health information under the FTC Act and the FTC Health Breach Notification Rule," HHS said in the  bulletin .

Many health systems are involved in class action lawsuits over alleged breaches of PHI. Earlier this year, several Louisiana hospitals were accused of sharing medical conditions, prescriptions, doctors' names and previous appointments with Facebook when patients scheduled appointments online or through patient portal apps.

AHA noted in its RFI response letter to the Congressional Committee those warning letters included a press release that supported threats of consequences for violating the December rule.

"OCR stated that it is 'concerned' that hospitals’ use of these technologies results in 'impermissible disclosures of health information — an issue that OCR 'will use all of its resources to address,'" AHA said, noting that last month OCR publicly released the names of all hospitals and health systems that received its warning letter.

ON THE RECORD

"Courts have already concluded that the interpretation of individually identifiable health information offered by HHS in its guidance "goes well beyond the meaning of what the statute can bear," AHA said in its letter to the Senate.

"HIPAA is more than sufficient to protect patient privacy and, if interpreted correctly, it strikes the appropriate balance between health information privacy and valuable information-sharing," the group added. "Varying state laws only add costs and create complications for hospitals and health systems."

Andrea Fox is senior editor of Healthcare IT News.

Email:  afox@himss.org

Healthcare IT News is a HIMSS Media publication.

That's one way to talk about other human beings.

As writer Elizabeth Weil notes in a new profile of OpenAI CEO Sam Altman in New York Magazine, the powerful AI executive has a disconcerting penchant for using the term "median human," a phrase that seemingly equates to a robotic tech bro version of "Average Joe."

Altman's hope is that artificial general intelligence (AGI) will have roughly the same intelligence as a "median human that you could hire as a co-worker."

It's a disconcerting assertion, considering that it really sounds like Altman is looking to replace the work of normal people with a not-yet-realized AGI.

And according to Insider, it's not even the first time he's said as much. In a 2022 interview on the Lex Fridman podcast, Altman explained that this theoretical AI would be able to "do anything that you'd be happy with a remote coworker doing just behind a computer, which includes learning how to go be a doctor, learning how to go be a very competent coder."

In other words, if you happen to live a "median" life, you could soon be out of a job — or, at least, that's one way to interpret his comments. Cheers to our AI future.

As Insider and New York Mag both note, Altman isn't the only person in the world of AI who uses the unsettling terminology. The phrase is present across an incredible number of AI blogs, and was even featured in a CNBC article titled "How to talk about AI like an insider."

"Eventually, when we develop an AGI in earnest," reads a blog post from an AI startup dubbed Snippet, which seems to fall very much in line with Altman's median theory, "it would display the capabilities of the median human, but retain the potential to become an expert in the field, something we now consider reserved for the narrow AI."

To use the word "median" specifically also feels like a distinct — and telling — choice. It's a squishy term that could leave plenty up to interpretation. How Altman, or anyone else, could possibly go about determining a holistic definition for this statistical average is unclear. Regardless, such a quantification of the human experience feels in many ways dehumanizing and incomplete.

"Comparing AI to even the idea of median or average humans is a bit offensive," Brent Mittelstadt, director of research at the Oxford Internet Institute, told Insider. "I see the comparison as being concerning and see the terminology as being concerning too."

Adding that there's yet to be a "concrete measurable comparison of human intelligence" within AI research, Mittelstadt also noted that the concept of a median person seems like "an intentionally vague concept as compared to having a very specific grounded meaning."

Besides, the concept of performance and the much-less-tangible notion of human intelligence are two very different things — and as Middlestadt told Insider, equating them doesn't quite add up.

"That is a hugely problematic leap to make," said the Oxford researcher, "because all of a sudden you're assigning agency, comprehension, cognition, or reasoning to these mechanistic models."

Middlestadt isn't alone in his critique.

"One thing that current AI architectures and models have shown is that they can achieve basically typical human-level performance. That's not problematic in itself," Henry Shevlin, an AI ethicist and professor at the University of Cambridge, told Insider. "I feel when we get into things like intelligence people are more touchy, and there are some good reasons for that."

It's an arguably depressing porthole glimpse into the thoughts of Altman, who exerts a tremendous amount of influence over the industry. He's often talked about saving the world, arguing that we can use AI to solve climate change, bring about Universal Basic Income, create clean energy, and so on. He has also declared that OpenAI's mission is to ensure that AGI, if it were to ever exist, will "[benefit] all of humanity."

But of course, we all have very different ideas and opinions of what saving the world or ensuring that everybody benefits equally from AI  looks like. And in this case, that reality is defined by someone who sees much of humanity as quantifiable "median" figures, ready to be replaced with AI.

Fingers crossed we all pass the test.

More on OpenAI saving the world: Experts Slam OpenAI's "Meaningless" New Promises About AGI

AHA says OCR's online tracking tool rules need to go

The American Hospital Association says new regs from the HHS Office for Civil Rights clash with HIPAA, contradict interoperability efforts and are "flawed as a matter of law and harmful as a matter of policy."

By Andrea Fox October 03, 2023

10:28 AM

AHA says OCR's rules limit the ability of hospitals to assess how their patients use their websites and access important health-related information.

In a letter to the Senate Committee on Health, Education, Labor and Pensions, the American Hospital Association said the U.S. Health and Human Services Office of Civil Rights rule regarding the use of online tracking tools is at odds with existing HIPAA rules and could cause meaningful harm to patients and public health.

"Congress should urge OCR to withdraw the rule immediately,"  AHA said  in its response to a request for information on data privacy and HIPAA.

WHY IT MATTERS

On behalf of AHA and its members – 5,000 healthcare organization members, 270,000 affiliated physicians, 2 million nurses and other caregivers and 43,000 healthcare leaders – the organization told the HELP Committee that it believes the current HIPAA rules are an effective framework for sharing patients’ protected health information "without creating significant impediments to the robust use and disclosure of information necessary to support high-quality care."

For these reasons, the AHA "does not believe that Congress should make any major revisions to HIPAA at this time," the organization said by letter on September 28.

AHA, however, noted two specific issues that "would benefit from congressional attention" – OCR's December rule regarding the use of online tracking tools and the various state privacy regulations that pile on HIPAA.

In its September RFI, the HELP Committee  asked stakeholders for feedback  on a number of questions about health data and accountability, including whether accountable entities should have a duty of loyalty to patients and how it could be imposed so as to minimize burdens on those entities.

"Should requirements of such a duty be based on the sensitivity of collected data?"

While saying it believes that no changes to HIPAA are needed at this time, AHA asked Congress to urge OCR to withdraw its December rule barring healthcare organizations from using online tracking tools to collect information about how users interact with regulated entities’ websites.

The association said  the rule  has resulted in consequences that contravene OCR's efforts to encourage hospitals to share non-private healthcare information with the public.

"This rule is flawed as a matter of law and harmful as a matter of policy," the AHA asserted.

Hospitals and health systems are caught between OCR's "unlawful rule" governing the use of online tracking tools and third-party vendors and are not able to provide "the most reliable health information available," AHA said.

"Without consulting healthcare providers, third-party technology vendors or the public at large, the agency issued a sub-regulatory guidance document that has had profound effects on hospitals, health systems and the communities they serve."

In the new rule, "OCR took the position that when an online technology connects an individual’s IP address with a visit to a public webpage that addresses specific health conditions or healthcare providers, that combination of information is subject to restrictions on use and disclosure under HIPAA," AHA explained.

"Thus, website visitors’ IP addresses are protected even if they are not actually seeking medical care."

In OCR’s "misguided view," the same HIPAA protections apply if visitors search for any medical information, such as general health information, information for a relative, academic research and more – and that violates HIPAA, AHA argued.

HIPAA and its implementing regulations "strike a balance," protecting patient privacy while permitting "important uses of information," according to AHA.

AHA said OCR's online tracking tools policy means that hospitals and health systems can no longer rely on third-party technologies like Google Analytics, YouTube and other video applications.

Without analytics, organizations cannot judge which areas of a website patients are having trouble navigating, the level of community concern for particular medical concerns and more.

"These tools allow hospitals to more effectively allocate resources and help community members to more easily find the healthcare information that they are seeking," AHA said.

Without third-party maps and location services, hospitals are pressed to provide better information about where healthcare services are available, the organization cited as an example. They'll be forced to restrict the use of tools like embedded bus schedules or driving directions to and from a patient's location.

Limiting video technologies also minimizes the range of health information health systems can share with the communities they serve, said AHA.

"Hospitals and health systems cannot risk the serious consequences that flow from OCR’s unlawful rule, including HIPAA enforcement actions, class action lawsuits or the loss of significant investments in existing websites," AHA said in its request.

Meanwhile, third parties can decline to sign business associate agreements that would commit them to protecting private patient information, AHA noted.

"If the OCR’s new rule is permitted to stand, hospitals and health systems will be forced to restrict the use of valuable third-party technologies like these."

In addition, AHA has long advocated that HIPAA’s requirements be the uniform nationwide standard for protecting the privacy and security of all patient information. Because the HIPAA framework is both effective and entrenched, Congress should enact full federal preemption for HIPAA, the hospital organization said.

"The patchwork of differing requirements poses significant challenges for providers’ use of a common electronic health record that is a critical part of the infrastructure necessary for effectively coordinating patient care and maintaining population health," said AHA.

"For all the strengths of the existing HIPAA framework, its approach to preemption has proven to be problematic," the group claimed in the HELP Committee letter.

"In addition, the existing state and federal patchwork of health information privacy requirements remains a significant barrier to the robust sharing of patient information necessary for coordinated clinical treatment," said AHA. "If Congress were to make any changes to HIPAA, it should address this problem and enact a full preemption provision."

THE LARGER TREND

In July, OCR and the Federal Trade Commission  sent a warning letter to hospitals about online tracking pixels  reminding healthcare organizations about their responsibilities for third-party disclosures of protected health information under HIPAA, the FTC Act and the FTC Health Breach Notification Rule.

"Even if you are not covered by HIPAA, you still have an obligation to protect against impermissible disclosures of personal health information under the FTC Act and the FTC Health Breach Notification Rule," HHS said in the  bulletin .

Many health systems are involved in class action lawsuits over alleged breaches of PHI. Earlier this year, several Louisiana hospitals were accused of sharing medical conditions, prescriptions, doctors' names and previous appointments with Facebook when patients scheduled appointments online or through patient portal apps.

AHA noted in its RFI response letter to the Congressional Committee those warning letters included a press release that supported threats of consequences for violating the December rule.

"OCR stated that it is 'concerned' that hospitals’ use of these technologies results in 'impermissible disclosures of health information — an issue that OCR 'will use all of its resources to address,'" AHA said, noting that last month OCR publicly released the names of all hospitals and health systems that received its warning letter.

ON THE RECORD

"Courts have already concluded that the interpretation of individually identifiable health information offered by HHS in its guidance "goes well beyond the meaning of what the statute can bear," AHA said in its letter to the Senate.

"HIPAA is more than sufficient to protect patient privacy and, if interpreted correctly, it strikes the appropriate balance between health information privacy and valuable information-sharing," the group added. "Varying state laws only add costs and create complications for hospitals and health systems."

Andrea Fox is senior editor of Healthcare IT News.

Email:  afox@himss.org

Healthcare IT News is a HIMSS Media publication.

That's one way to talk about other human beings.

As writer Elizabeth Weil notes in a new profile of OpenAI CEO Sam Altman in New York Magazine, the powerful AI executive has a disconcerting penchant for using the term "median human," a phrase that seemingly equates to a robotic tech bro version of "Average Joe."

Altman's hope is that artificial general intelligence (AGI) will have roughly the same intelligence as a "median human that you could hire as a co-worker."

It's a disconcerting assertion, considering that it really sounds like Altman is looking to replace the work of normal people with a not-yet-realized AGI.

And according to Insider, it's not even the first time he's said as much. In a 2022 interview on the Lex Fridman podcast, Altman explained that this theoretical AI would be able to "do anything that you'd be happy with a remote coworker doing just behind a computer, which includes learning how to go be a doctor, learning how to go be a very competent coder."

In other words, if you happen to live a "median" life, you could soon be out of a job — or, at least, that's one way to interpret his comments. Cheers to our AI future.

As Insider and New York Mag both note, Altman isn't the only person in the world of AI who uses the unsettling terminology. The phrase is present across an incredible number of AI blogs, and was even featured in a CNBC article titled "How to talk about AI like an insider."

"Eventually, when we develop an AGI in earnest," reads a blog post from an AI startup dubbed Snippet, which seems to fall very much in line with Altman's median theory, "it would display the capabilities of the median human, but retain the potential to become an expert in the field, something we now consider reserved for the narrow AI."

To use the word "median" specifically also feels like a distinct — and telling — choice. It's a squishy term that could leave plenty up to interpretation. How Altman, or anyone else, could possibly go about determining a holistic definition for this statistical average is unclear. Regardless, such a quantification of the human experience feels in many ways dehumanizing and incomplete.

"Comparing AI to even the idea of median or average humans is a bit offensive," Brent Mittelstadt, director of research at the Oxford Internet Institute, told Insider. "I see the comparison as being concerning and see the terminology as being concerning too."

Adding that there's yet to be a "concrete measurable comparison of human intelligence" within AI research, Mittelstadt also noted that the concept of a median person seems like "an intentionally vague concept as compared to having a very specific grounded meaning."

Besides, the concept of performance and the much-less-tangible notion of human intelligence are two very different things — and as Middlestadt told Insider, equating them doesn't quite add up.

"That is a hugely problematic leap to make," said the Oxford researcher, "because all of a sudden you're assigning agency, comprehension, cognition, or reasoning to these mechanistic models."

Middlestadt isn't alone in his critique.

"One thing that current AI architectures and models have shown is that they can achieve basically typical human-level performance. That's not problematic in itself," Henry Shevlin, an AI ethicist and professor at the University of Cambridge, told Insider. "I feel when we get into things like intelligence people are more touchy, and there are some good reasons for that."

It's an arguably depressing porthole glimpse into the thoughts of Altman, who exerts a tremendous amount of influence over the industry. He's often talked about saving the world, arguing that we can use AI to solve climate change, bring about Universal Basic Income, create clean energy, and so on. He has also declared that OpenAI's mission is to ensure that AGI, if it were to ever exist, will "[benefit] all of humanity."

But of course, we all have very different ideas and opinions of what saving the world or ensuring that everybody benefits equally from AI  looks like. And in this case, that reality is defined by someone who sees much of humanity as quantifiable "median" figures, ready to be replaced with AI.

Fingers crossed we all pass the test.

More on OpenAI saving the world: Experts Slam OpenAI's "Meaningless" New Promises About AGI