Episode 625: Google Analytics for Therapy Practice Websites – The HIPAA Risks Explained

Welcome solo and group practice owners! We are Liath Dalton and Evan Dumas, your co-hosts of Group Practice Tech.

In our latest episode, we unpack the reasoning, step by step, behind PCT's position on Google Analytics for therapy practices.

We discuss:

• Can website activity constitute Protected Health Information?
• HIPAA's definition of healthcare operations vs. HIPAA's definition of marketing
• Business Associates, and how there is no BAA available for Google Analytics
• The disclosures required for HIPAA authorization for marketing activity
• Cases where collecting PHI without a BAA has gone awry
• The risk context in an increasingly AI world
• The takeaway: is it permissible for therapy practices to use Google Analytics on their practice websites?
• Uniting as an industry to demand BAAs for Google Analytics

Listen here: https://personcenteredtech.com/group/podcast/

For more, visit our website.

• Marketing in Mental Health: The Legal and Ethical Do's and Don'ts You Need to Know — This 3 legal-ethical CE credit hour on-demand training, presented by therapist and HIPAA attorney Eric Ström, JD PhD LMHC, unpacks the legal and ethical standards that apply to marketing in mental health practice, with particular attention to HIPAA marketing requirements, Business Associate Agreements (BAAs), authorizations/ROIs, advertising, referrals, reviews, and endorsements.
• Group Practice Care Premium
  • weekly (live & recorded) direct support & consultation service, Group Practice Office Hours — including monthly session with therapist attorney Eric Ström, JD PhD LMHC
  • Device Security Suite: assignable staff HIPAA Security Awareness: Bring Your Own Device training + access to Device Security Center with step-by-step device-specific tutorials & registration forms for securing and documenting all personally owned & practice-provided devices (for *all* team members at no per-person cost)
  • Remote Workspace Security Suite: assignable staff HIPAA Security Awareness: Remote Workspaces training for all team members + access to Remote Workspace Center with step-by-step tutorials & registration forms for securing and documenting Remote Workspaces (for *all* team members at no per-person cost) + more
• HIPAA Risk Analysis & Risk Mitigation Planning service for mental health practices — care for your practice using our supportive, shame-free risk analysis and mitigation planning service. You'll have your Risk Analysis done within 2 hours, performed by a PCT consultant, using a tool built specifically for mental health practice, and a mitigation checklist to help you reduce your risks.
• PCT's Comprehensive HIPAA Security Compliance Program (discounted) bundles:
  • For Group Practices
  • For Solo Practitioners
    • Comprehensive HIPAA Security Policies & Procedures
    • Forms & Logs for documenting implementation and maintenance of Policies & Procedures in practice
    • Device & Workspace Security Suites
    • Direct Support & Consultation from PCT team + therapist attorney Eric Ström, JD PhD LMHC (live & recorded + searchable library)
    • Includes the Risk Analysis & Risk Mitigation Planning service + tool
  • HIPAA Security & Privacy Ethics training

• HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — OCR's current guidance on how the HIPAA Privacy, Security, and Breach Notification Rules apply to website and app tracking technologies. It addresses when website activity may constitute PHI, tracking on authenticated and unauthenticated webpages, Business Associate Agreements, marketing disclosures, HIPAA authorization, and risk analysis.
• Google: HIPAA and Google Analytics — Google's own guidance for HIPAA-regulated organizations. Google states that regulated entities must not expose Google Analytics to PHI and that Google does not offer Business Associate Agreements for Google Analytics.
• American Hospital Association v. Becerra — June 20, 2024 Court Decision — The federal court decision that partially vacated OCR's tracking-technology guidance regarding an IP address combined with a visit to an unauthenticated health-related webpage. The decision is important for understanding what may—and may not—constitute individually identifiable health information in the context of website tracking.
• HHS: Business Associates — HHS guidance on when a person or company becomes a HIPAA Business Associate, including when a vendor performs data analysis or other functions involving PHI on behalf of a covered entity.
• HHS: Marketing and the HIPAA Privacy Rule — Guidance on HIPAA's specific definition of marketing, the exceptions to that definition, and when written individual authorization is required for uses or disclosures of PHI for marketing.
• FTC: BetterHelp Health Data and Advertising Enforcement Action — The FTC's action concerning BetterHelp's disclosure of sensitive consumer health information to third parties for advertising purposes. Importantly, this was FTC consumer privacy enforcement, not HIPAA enforcement, but it provides a real-world example of the risks associated with health-related information flowing into advertising and tracking ecosystems.