Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

The Ohio Legislature recently passed a law (<a href="https://search-prod.lis.state.oh.us/api/v2/general_assembly_135/legislation/hb173/05_EN/pdf/" target="_blank" rel="noreferrer noopener">Ohio House Bill (HB) 173</a>) restricting how hospitals can engage in targeting advertising and sell personal data. Although Ohio has not yet enacted a comprehensive data privacy law, HB 173’s prohibitions on targeted advertising and the sale of personal data mirror requirements set forth in other states’ data privacy regulations, including the California Consumer Privacy Act. Interestingly, the new Ohio law does not create an exception for these prohibitions based on an end user’s consent. Accordingly, this law may have a significant impact on how hospitals configure their websites to include third-party advertising and analytical tools, and it adds to an already complex issue in light of recent <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html" target="_blank" rel="noreferrer noopener">federal guidance</a> and <a href="https://www.aha.org/system/files/media/file/2024/06/opinion-order-in-aha-et-al-v-xavier-becerra-et-al-6-20-2024.pdf" target="_blank" rel="noreferrer noopener">judicial actions</a> regarding use of online tracking technologies. HB 173’s requirements become effective on April 3, 2025.

contentpilot/introduction

core/heading

A key focus of HB 173, which Governor Mike DeWine signed into law in January, is to update state requirements for hospitals to publish a consumer-friendly list describing certain charges related to the services and goods they offer patients.

core/paragraph

Alternatively, hospitals can fulfill the requirement for a list of standard charges for shoppable services by providing a qualifying internet-based price estimator tool. Hospitals that provide an internet-based price estimator tool have to abide by several requirements, which are nearly identical to those found in the federal <a href="https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-E/part-180/subpart-B/section-180.60" target="_blank" rel="noreferrer noopener">Hospital Price Transparency Rule</a>. For instance, the estimator must be free of charge; must not require a user to register or establish a user account or password; and must not require a user to submit personal identifying information, including any information relating to an individual’s health care coverage or other benefits.

New Data Protection Requirements for Ohio Hospitals

HB 173 adopts the following requirements that go beyond the Hospital Price Transparency Rule’s:

A hospital must not sell personal data acquired from the price estimator tool

core/list-item

A hospital must not “use, sell, or process personal data” acquired from the tool for the purposes of “targeted advertising,” as defined by the new law

core/list

HB 173 defines “targeted advertising” as displaying an advertisement that is selected based on “personal data” obtained through the use of a hospital’s internet-based price estimator tool by a person in Ohio. It explicitly excludes from the definition the following advertising activities:

Advertising in response to the user’s request for information or feedback

Advertising based on activities within a hospital’s own websites or online applications

Advertising based on the context of a user’s current search query, visit to a website, or online application

Processing personal data solely for measuring or reporting advertising performance, reach, or frequency

For the purposes of the law, “personal data” broadly means any information that is linked or reasonably linkable to an identified or identifiable person in Ohio. It excludes publicly available information and personal data that has been de-identified or aggregated such that no person nor a device linked to that person can be reasonably identified.

Interestingly, the law does not expressly create an exception for these new prohibitions on the sale of data and targeted advertising based on an end user’s consent. Accordingly, although it is common for websites to offer “cookie management tools” that allow an end user to select whether a website deploys third-party advertising cookies, this option does not appear to align with the plain text of HB 173.

Administrative penalties for noncompliance will be imposed at the discretion of the Ohio Director of Health subject to prescribed considerations (i.e., seriousness of violation and demonstration of good faith). The Director of Health will notify hospitals of violations in advance and they will be allowed to address violations via a corrective action plan. Penalties will apply when there is both a violation of the law and a violation of a corrective plan.

When a hospital provides a price estimator tool, it should be aware of and comply with HB 173’s requirements. This includes communicating to its design and product teams the ease-of-use requirements as well as implementing appropriate safeguards to prevent personal data from being inadvertently captured, blocking pixels or other tracking tools from capturing data that can be reasonably linked to a person, and ensuring that any personal data inadvertently captured is not subsequently used for targeted advertising. It is worth noting that the adoption of this new law may indicate that the Ohio Legislature is willing to move forward on enacting a comprehensive consumer privacy law, such as <a>the </a>Ohio Personal Privacy Act (HB 345), which was introduced in 2023.

core/separator

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2025/03/Privacy-Cybersecurity-Update-Ohio-Regulates-Targeted-Advertising-and-Sale-of-Personal-Data-by-Hospitals.pdf

Ohio Regulates Targeted Advertising and Sale of Personal Data by Hospitals

Services