HIPAA and website tracking for healthcare businesses

For healthcare businesses covered by HIPAA, tracking pixels and analytics tags on patient-facing pages are a known risk. Tools such as the Meta Pixel or Google tags can send data like page URLs, IP addresses and form actions to tech companies, and when that data reveals that a specific person is a patient or has a condition, it may be protected health information shared without a business associate agreement. The safer approach: keep third-party tracking off patient portals, booking flows and sensitive forms, use vendors that sign a BAA where needed, and measure results through your own systems.

This topic has drawn regulators, class actions and settlements, and the guidance shifted in 2024. Below is a plain-English overview of HIPAA and website tracking for clinics, practices and other healthcare businesses. It is not legal advice; talk to your compliance advisor or attorney before you change your setup.

Why tracking became a HIPAA issue

HIPAA protects individually identifiable health information held by covered entities (most healthcare providers, health plans and clearinghouses) and their business associates. When a website shares such information with a vendor, that vendor generally needs to sign a business associate agreement, or the sharing needs to be otherwise permitted.

Marketing tags were never designed with this in mind. A typical pixel sends the full page URL, referring page, IP address, device identifiers and events such as "booked appointment". Put together, a URL like /conditions/depression/book/ plus an IP address plus a "booking completed" event can reveal a lot about a person. Ad platforms generally do not sign business associate agreements for their pixels.

What the regulators said, and what changed

In December 2022, the HHS Office for Civil Rights issued a bulletin on online tracking technologies and updated it in March 2024. It said tracking on authenticated pages (portals, telehealth) generally involves protected health information, and that even some tracking on public pages could. In 2023, OCR and the FTC sent joint letters warning many hospitals and telehealth providers about these risks.

In June 2024, a federal court in Texas vacated part of that guidance: the part saying that combining a visitor's IP address with a visit to a public page about a health condition could, by itself, be protected health information. That ruling narrowed the guidance. It did not make tracking on portals, booking flows or forms that collect health details safe, and other laws and lawsuits still apply. Plaintiffs continue to bring privacy class actions over pixels on healthcare websites.

Pages by risk level

A quick self-check for your practice

Open your website on a computer and look at it the way a patient would. Then ask:

• Which pages mention specific conditions, treatments or medications?
• Which forms ask for symptoms, insurance details, date of birth or the reason for a visit?
• Does the booking flow run on your domain or a vendor's, and which scripts load there?
• Who added the tags currently on the site, and does anyone still use the data?
• Has anyone signed a business associate agreement with the vendors that receive this data?

If nobody on your team can answer the last two questions, that alone is a reason for an audit. Tags tend to pile up over the years as agencies, plugins and booking tools come and go.

Seven safer ways to measure

1. Audit your tags. List every script on the site and what it sends. Remove what you do not need.
2. Keep pixels off sensitive pages, especially portals, booking and forms.
3. Do not send health details in events or URLs. "Booking completed" is safer than "booking completed: dermatology, acne".
4. Use analytics vendors that sign a BAA if you need detailed analytics on sensitive pages.
5. Consider server-side tagging to control and strip data before it reaches any vendor. It is not a compliance shortcut by itself, but it gives you control. See server-side tracking.
6. Measure outcomes in your own systems. Count new patients by source in your practice management system or CRM, using source fields on intake rather than pixels on the booking page.
7. Review ad platform policies. Both Google and Meta restrict ads that target people based on health conditions, and they limit what health data you can send them.

Beyond HIPAA

Even if your business is not a HIPAA covered entity, health data is regulated:

• The FTC enforces against unfair or deceptive sharing of health data and applies its Health Breach Notification Rule to many health apps and services not covered by HIPAA.
• State laws, such as Washington's My Health My Data Act and similar laws in Nevada and Connecticut, cover "consumer health data" broadly and often require opt-in consent.
• Comprehensive state privacy laws treat health information as sensitive data.

That matters for med spas, wellness businesses, fitness studios with health assessments and supplement stores. More on the state side is in US state privacy laws and your website.

What this means for your marketing

None of this means healthcare businesses cannot advertise or measure. It means doing it differently:

• Count calls and bookings by source with call tracking that does not record or share clinical content, and with source fields in your intake process. The call tracking guide covers the setup.
• Optimize ads on conversions that carry no health details, such as "contact form submitted" on a general page.
• Use your CRM or practice software for the real numbers: new patients and revenue by channel.
• Keep consent and privacy notices accurate and easy to find.

How I work with healthcare clients

I am not a compliance advisor, and I will not tell you what HIPAA requires for your practice. What I do is the technical side: auditing tags, removing risky ones from sensitive pages, setting up analytics and conversions that avoid health details, and making the website match what your compliance advisor approves. The industry pages for medical clinics, dentists and med spas cover the marketing side in more depth.