A federal court on Thursday ruled the Health and Human Services Department lacks the authority under the Health Insurance Portability and Accountability Act to prohibit providers from using third-party web tracking technologies on their websites in certain situations.