American Hospital Association et al. v. Becerra
AHA v. Becerra: the unauthenticated-page theory of HIPAA liability was vacated in 2024.
Regulatory — guidance vacated or withdrawn
Primary source
Last verified Sep 8, 2026
The matter
- Matter ID
- SND-0160
- Organization
- HHS OCR tracking-technology bulletin and AHA v. Becerra
- Location
- National
- Court
- N.D. Tex. (Judge Pittman)
- Docket
- 4:23-cv-01110
Timeline
- Filed
- Dec 1, 2022
- Key ruling
- Jun 20, 2024
Outcome
- Structure
- Civil penalty
Key ruling
N.D. Texas vacated the bulletin’s “proscribed combination” (IP address plus an unauthenticated condition-page visit as PHI); HHS withdrew its appeal Aug. 29, 2024.
Status note
Court VACATED the “proscribed combination” portion of the bulletin (IP address + visit to an unauthenticated condition page as IIHI) as exceeding HIPAA authority. HHS filed an appeal, then withdrew it Aug. 29, 2024. Remainder of bulletin stands. No OCR resolution agreement or civil money penalty involving website trackers located through Sept. 2026. | Essential context for every blog post about unauthenticated pages.
Source
AHA Agency release
Data licensed under CC BY 4.0. Cite as SounderData.com Tracker Litigation Database, September 11, 2026.