American Hospital Association et al. v. Becerra

AHA v. Becerra: the unauthenticated-page theory of HIPAA liability was vacated in 2024.

Industry challenge to guidance
Regulatory — guidance vacated or withdrawn

Timeline

Filed
Dec 1, 2022
Key ruling
Jun 20, 2024

Key ruling

N.D. Texas vacated the bulletin’s “proscribed combination” (IP address plus an unauthenticated condition-page visit as PHI); HHS withdrew its appeal Aug. 29, 2024.

Status note

Court VACATED the “proscribed combination” portion of the bulletin (IP address + visit to an unauthenticated condition page as IIHI) as exceeding HIPAA authority. HHS filed an appeal, then withdrew it Aug. 29, 2024. Remainder of bulletin stands. No OCR resolution agreement or civil money penalty involving website trackers located through Sept. 2026. | Essential context for every blog post about unauthenticated pages.

Exposure

Pages covered

Public website (unauthenticated)

Data licensed under CC BY 4.0. Cite as SounderData.com Tracker Litigation Database, September 25, 2026.