Sen. Cassidy’s privacy bill aims to curb data tracking

On April 3, Senator Bill Cassidy (R-LA), chair of the Senate Health, Education, Labor and Pensions Committee, reintroduced the Data Elimination and Limiting Extensive Tracking and Exchange (DELETE) Act to provide Americans with greater control over their personal data. The bill creates mechanisms for consumers to remove their information from commercial databases and block future collection attempts.

“Privacy should be expected and protected online,” said Dr. Cassidy. “This bill gives Americans a solution to ensure their personal data is not tracked, collected, bought or sold by data brokers.”

Data trackers emerged in the early 2000s as the internet evolved from an information resource to a commercial platform. Google Analytics launched in 2005, while Facebook (now Meta) introduced its Pixel tracking tool in 2015. These technologies allow website owners to gather valuable analytics about visitor behavior while enabling targeted advertising.

Data trackers have become essential to modern business practices and most businesses can use them without uproar from their consumers – except in healthcare. 

The practice has triggered a wave of legal action from patients who are disturbed that they receive targeted ads based on their private health problems. 

In February 2023, a lawsuit was filed against Cedars-Sinai Medicine for using tracking technologies on its website, where it had encouraged users to research conditions, find doctors, and book appointments—all data it was then sending to tracking vendors like Facebook and Google.

The plaintiff in this case claimed he saw an increase in health-related ads, specifically concerning a condition he researched using the patient portal, after using Cedars-Sinai’s platform.

Similar lawsuits have targeted numerous healthcare providers. At least 21 hospitals, health systems, and technology companies have faced lawsuits over allegedly sharing confidential patient information with social media giants such as Meta, Facebook, Instagram, and Google.

Some cases have already resulted in significant settlements. Novant Health agreed to pay $6.6 million to settle a class action lawsuit filed by patients who had their protected health information in MyChart transferred to third parties due to tracking tools.

Regulatory Response

The Department of Health and Human Services (HHS) weighed in on the issue in December 2022, issuing guidance that warned healthcare providers about potential violations of the Health Insurance Portability and Accountability Act (HIPAA) through the use of tracking technologies.

However, the healthcare industry pushed back. In November 2023, the American Hospital Association (AHA), along with the Texas Hospital Association and two nonprofit Texas health systems, filed a lawsuit against HHS in federal court in Fort Worth, Texas.

The lawsuit accuses the agency of overstepping its authority and claims the guidance was put forward without giving medical providers and others in the industry a chance to comment. The hospital groups contend that the tools are necessary for effective patient outreach.

“The Department of Health and Human Services’ new rule restricting the use of critical third-party technologies has real-world impacts on the public, who are now unable to access vital health information,” the AHA argued.

A federal judge in Texas ruled in June 2024 that the HHS guidance “was promulgated in clear excess of HHS’s authority under HIPAA.” 

Moving Forward

Senator Cassidy’s DELETE Act offers a broad approach to data privacy that might impact many healthcare organizations’ reliance on data trackers. If many people choose to remove their name from data collectors and prevent future collection, then healthcare organizations, along with businesses across all industries, might need to look for a new way to share their offerings and connect with customers.