OCR Bulletin On Online Tracking Technologies | McDermott

Do Cookies Collect PHI? A Deep Dive into the OCR Bulletin on Online Tracking Technologies


In December 2022, the Office for Civil Rights (OCR) of the US Department of Health and Human Services issued a Bulletin that discusses the obligations of HIPAA covered entities and business associates when deploying online tracking technologies on their websites and mobile apps. The Bulletin has caused HIPAA-regulated entities to reassess when and how they collect personal information from patients and other users online.

Join a data privacy technology expert from Ankura Consulting and members of McDermott’s Healthcare and Global Privacy & Cybersecurity practices as they address the application of HIPAA to online tracking technologies and the OCR Bulletin.

Discussion topics will include:

  • An explanation of cookies, pixels and other tracking technologies
  • How to determine what information is collected through online tracking technologies
  • When information collected online is HIPAA protected health information (PHI)
  • HIPAA compliance obligations for tracking technologies processing PHI
  • Risk of compromise assessments for unauthorized disclosures to tracking technology vendors


Emily Cohen, Managing Director, Ankura Consulting Group

Dig Deeper

London, United Kingdom / McDermott Event / September 19, 2024

HPE Europe 2024

Cambridge, United Kingdom / Speaking Engagements / July 1-3, 2024

Privacy Laws & Business | 37th International Conference

Chicago, IL / Speaking Engagements / May 14, 2024

Modern Healthcare Digital Health Summit: Patients and Trust

Nashville, TN / McDermott Event / May 17, 2024

Value-Based Care Symposium 2024

Nashville, TN / McDermott Event / May 15-16, 2024

Physician Practice Management and ASC Symposium 2024

Washington, DC / / May 8-10, 2024

2024 Privacy + Security Spring Academy

Get In Touch