The U.S. Department of Health and Human Services Office of Civil Rights issued guidance to entities and business associates using tracking technology under the Health Insurance Portability and Accountability Act. OCR noted some regulated entities often share electronic protected health information with online tracking providers “in a manner that violates the HIPAA Rules.”