Is your healthcare website leaking patient data? Tracking pixels and HIPAA

If you run a medical, dental or wellness practice, there’s a good chance your website has a few lines of code you’ve never thought about: the Meta Pixel, Google Analytics, a chat widget, a scheduling plugin. They’re there to measure ads and traffic. They can also send information about your patients to companies that have no business seeing it.

Over the past few years this has gone from an obscure technical issue to one of the most active areas of healthcare privacy enforcement and litigation.

What happened

Tracking tools work by sending details about each visit back to the vendor: the page URL, the button clicked, sometimes form contents, along with identifiers like an IP address or a Facebook login cookie. On a healthcare site, “this person visited the page for oncology appointments and then clicked Book” can reveal something very personal.

• HHS guidance. In December 2022 the HHS Office for Civil Rights warned HIPAA-covered entities that tracking technologies can disclose protected health information, and that sharing it with vendors without a business associate agreement can violate HIPAA. The guidance was updated in 2024.
• A court narrowed part of it. In June 2024 a federal court in Texas vacated the portion of that guidance covering some tracking on public, unauthenticated pages. That didn’t make tracking safe. Patient portals, appointment flows and anything tied to an identifiable patient are still squarely in HIPAA territory.
• The FTC acted outside HIPAA. The FTC brought cases against digital health companies, including GoodRx and BetterHelp, for sharing health data with advertising platforms. Not being a HIPAA covered entity doesn’t mean you’re in the clear.
• The lawsuits keep coming. Hospitals and health systems across the country have faced class actions over the Meta Pixel, and several have settled for millions of dollars.

Why small practices should care

Most of the headlines involve large health systems, but the same plugins and pixels are installed on small practice websites every day, often by a well-meaning web designer or an ad agency that never asked about HIPAA. A small practice has less room to absorb a complaint, a breach notification or a lawsuit.

What to check on your site

1. Inventory every tag. List every script on your site: analytics, ad pixels, heatmaps, chat, video embeds, scheduling and form tools. You can’t assess what you don’t know is there.
2. Look at where it fires. Tracking on your homepage is a very different risk from tracking on a symptom page, an appointment form or a patient portal login.
3. Check your forms. Contact and intake forms are a common leak. Make sure form contents aren’t being passed to analytics or ad platforms, and that the form provider will sign a business associate agreement if it handles PHI.
4. Get BAAs, or remove the tool. If a vendor receives PHI, you need a business associate agreement. Most ad platforms won’t sign one, which usually means the pixel has to go from sensitive pages.
5. Use privacy-respecting alternatives. Server-side tagging, HIPAA-eligible analytics and consent management can let you keep measuring marketing without exposing patients.
6. Document what you decided. Add your website to your HIPAA risk analysis. Showing you assessed the risk and acted on it matters if anyone ever asks.

The bottom line

You don’t have to choose between marketing your practice and protecting your patients, but you do have to make the choice on purpose. If you’re not sure what’s running on your website, that’s the first thing to find out.

This article is general information, not legal advice. Guidance in this area has changed several times, so check the current HHS position, and talk to your compliance counsel about your specific situation.