What is the HIPAA issue with tracking pixels?
HIPAA and tracking pixels refers to the risk that third-party tracking code on a healthcare website or app discloses protected health information to ad or analytics companies without a BAA or patient authorization. Pixels can send IP addresses, page URLs, form events and device IDs. On pages tied to a person's care, that data can be PHI.
- HHS's Office for Civil Rights issued guidance on online tracking technologies in 2022 and updated it in 2024.
- Highest risk: patient portals, booking flows, forms and pages where people share health details.
- A federal court in 2024 vacated part of that guidance about some public, unauthenticated pages; the rest of HIPAA still applies.
- Many ad platforms will not sign a BAA, so practices limit what the pixel sees or use server-side setups.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What the issue is
A tracking pixel is a small piece of code from an ad platform or analytics vendor. When a visitor loads a page or submits a form, it sends data back to that vendor. That data often includes the page address, the visitor's IP address, cookie or device IDs, and sometimes form field values.
HHS's Office for Civil Rights (OCR) published a bulletin on the use of online tracking technologies by HIPAA covered entities in December 2022 and revised it in March 2024. It said that identifiable information collected on a regulated entity's website or app can be PHI, and that sharing it with a tracking vendor for marketing without a BAA or patient authorization may violate HIPAA. In June 2024, a federal court in Texas vacated the part of the guidance covering certain public pages viewed by unauthenticated visitors. Tracking on authenticated pages, such as patient portals, and on pages where people submit health information remains a clear risk area. The FTC and state laws also act on health data sharing.
How it affects practice marketing
- Audit every tag on the site: ad pixels, analytics, chat widgets, heatmaps, embedded video.
- Remove or restrict pixels on booking, intake, portal and condition-specific form pages.
- Stop form values and URL parameters with health details from reaching third parties.
- Use vendors that sign a BAA, or a server-side setup that strips identifiers before anything leaves your control.
- Measure with de-identified conversions where possible, and match bookings back offline in a compliant way.
The HIPAA-safe website tracking guide walks through a setup. Platform specifics are in HIPAA-safe Google Ads and HIPAA-safe Meta Ads.
Common mistakes and limits
Turning on an ad platform's "restricted data" or health setting helps, but it does not by itself create a HIPAA basis for sharing PHI. Cookie banners also do not equal HIPAA authorization; a valid authorization has specific content requirements. Another mistake is forgetting tags added by website builders, chat tools or scheduling widgets.
This area has moved quickly through guidance, litigation and settlements, and state laws keep adding rules. Review your setup at least when you add a tool or page type, and check specific decisions with your compliance or legal team.
Related pages from the US team
HIPAA-safe website tracking
Step-by-step setup for practice websites.
HIPAA-safe Google Ads
Measurement and targeting without PHI leaks.
HIPAA-safe Meta Ads
Pixel and audience rules for aesthetic practices.
US healthcare marketing glossary
Every term, defined in plain English.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Are Meta and Google pixels allowed on healthcare websites?
They can be used, but with care. Placing them where they collect identifiable information about patients' care, such as booking, intake or portal pages, can disclose PHI to a vendor that has not signed a BAA. Many practices remove them from those pages or use a server-side setup that strips identifiers.
What did the 2024 court ruling change about HHS tracking guidance?
In June 2024 a federal court in Texas vacated the part of HHS's tracking-technology guidance that treated certain visits to public, unauthenticated web pages as PHI disclosures. It did not remove HIPAA obligations for patient portals, forms or other places where identifiable health information is collected.
Does a cookie consent banner make tracking HIPAA compliant?
No. A cookie banner is not a HIPAA authorization. A valid authorization must meet specific content and signature requirements. Practices should instead limit what tracking code collects or use vendors that sign a BAA.
How can a practice measure ads without sending PHI to ad platforms?
Common approaches are server-side tagging that removes identifiers, de-identified conversion events, and counting bookings in the practice's own systems. Any vendor that receives PHI along the way needs a BAA. A compliance review should confirm the final setup.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Want to know what your website pixels send today?
Book a 30-minute call. The US team will review your tags and show which pages are leaking data to third parties.