HIPAA still limits tracking pixels. In June 2024 a federal court vacated one part of OCR's guidance: that an IP address plus a visit to a public page about a health condition or provider triggers HIPAA. Under OCR's remaining guidance, pixels on portals, logins, booking forms and symptom checkers need a vendor BAA and a permitted purpose, or removal.
Most practice websites carry more tags than anyone on staff remembers adding: an analytics script, an ad pixel, a chat widget, a call-tracking number, a booking plugin. Each one can send data to a third party. Since December 2022, HHS’s Office for Civil Rights (OCR) has said what HIPAA expects of those tools, and a 2024 court ruling changed part of that answer.
This guide sets out what the court vacated, what OCR still says, where the FTC and Washington State’s health data law reach beyond HIPAA, and a page-by-page checklist your practice or healthcare marketing team can work through. It ends with replying to online reviews, where OCR has settled with several practices.
Key takeaways
- AHA v. Becerra (June 2024) vacated one theory in OCR’s guidance: an IP address plus a visit to a public condition or provider page.
- Tags on portals, logins, booking forms and symptom checkers can still disclose PHI: get a BAA or remove them.
- Cookie banners are not HIPAA authorizations, and Google offers no BAA for Google Analytics.
- The FTC Act reaches HIPAA-covered practices, and Washington’s health data law covers data HIPAA does not.
- Never confirm a reviewer is a patient; OCR has settled cases over review replies.
What does OCR's guidance on online tracking technologies say?
OCR’s bulletin says HIPAA applies whenever a tracking tool on your website or app collects protected health information (PHI). You may then disclose PHI only as the Privacy Rule permits, must protect it under the Security Rule, and, unless patients have authorized the disclosure, need a Business Associate Agreement (BAA) with the vendor.
OCR issued the bulletin in December 2022 and revised it on March 18, 2024, per the court opinion. The HHS OCR bulletin covers cookies, pixels, session replay scripts and fingerprinting scripts. It is guidance; the HIPAA Rules it applies are law.
What the bulletin still says
- Logged-in pages: tracking on a patient portal generally has access to PHI.
- Some public pages: login, registration, appointment and symptom-checker pages can collect PHI when a visitor enters credentials, an email address or a reason for care.
- Apps: data collected by a practice’s own app generally is PHI.
- Vendors: a BAA comes before any PHI; a promise to strip PHI afterward is not enough.
- Consent: cookie banners and privacy-policy notices are not HIPAA authorizations.
- Marketing: PHI sent to a vendor for marketing without patient authorization is an impermissible disclosure.
OCR is prioritizing Security Rule compliance in tracking investigations, and an impermissible disclosure is presumed to be a breach unless you show a low probability of compromise. Put every tag in your risk analysis (see our 2025 HIPAA Security Rule article and HIPAA compliance checklist for medical practices).
What did the AHA v. Becerra ruling vacate, and what still applies?
The court vacated one theory, not the whole bulletin. On June 20, 2024, the U.S. District Court for the Northern District of Texas declared unlawful and vacated the “Proscribed Combination”: a tool linking a person’s IP address with a visit to a public, unauthenticated page about specific health conditions or health care providers.
In American Hospital Association v. Becerra, the court held that this theory exceeded HHS’s authority under HIPAA, and granted vacatur but not an injunction. HHS withdrew its appeal on August 29, 2024, the American Hospital Association reported. OCR’s bulletin now opens with a notice describing the vacated part. As of October 2026, that notice still says HHS is evaluating its next steps, and the page shows a last review date of June 26, 2024.
The opinion states its limits: its analysis concerns only the Proscribed Combination, and the vacatur should not be read as limiting the bulletin’s other guidance. It did not rule on portals, logins, booking flows, apps, BAAs or banners.
| Date | What happened | What it means for your site |
|---|---|---|
| Dec 2022 | OCR issues its tracking bulletin: HIPAA applies when tags collect PHI | Treat each tag as a possible disclosure |
| Jul 20, 2023 | FTC and HHS send about 130 hospital systems and telehealth providers a joint warning on tracking | Regulators are watching website tags |
| Mar 18, 2024 | OCR revises the bulletin; Security Rule is its investigation priority | Add tags to your risk analysis |
| Mar 31, 2024 | Washington My Health My Data Act applies (small businesses: Jun 30, 2024) | Non-PHI health data is regulated too |
| Jun 20, 2024 | AHA v. Becerra vacates the IP-address-plus-public-page theory | Less HIPAA risk for public-page analytics |
| Jul 29, 2024 | Amended FTC Health Breach Notification Rule takes effect | Non-HIPAA health apps face breach notice duties |
| Aug 29, 2024 | HHS withdraws its appeal; the vacatur stands | Portal, form and app guidance remains in the bulletin |
Sources: HHS OCR; AHA v. Becerra (N.D. Tex. 2024); American Hospital Association (2024); FTC (2023, 2024); Federal Register (2024); Washington Attorney General.
The ruling is not a green light
If a visitor types an email address or reason for visit into a form on a public page, OCR’s guidance on that disclosure still stands. Data outside HIPAA can still fall under FTC or state law.
Where does the FTC come in?
The FTC covers health data outside HIPAA and polices HIPAA-covered practices too. Its Health Breach Notification Rule applies to non-HIPAA health apps; the FTC Act’s ban on unfair or deceptive practices applies more broadly.
The FTC approved the amended rule in April 2024 on a 3-2 vote, and the final rule took effect July 29, 2024. Under 16 CFR Part 318, a breach includes an unauthorized disclosure, not only a hack. Individuals must be told no later than 60 calendar days after discovery, and the FTC at the same time when 500 or more people are affected. HIPAA-covered entities, and business associates acting in that role, are excluded.
In February 2023, GoodRx agreed to a $1.5 million civil penalty, the first action under the rule, over sharing users’ medications and health conditions with platforms including Facebook and Google. In March 2023, BetterHelp agreed to pay $7.8 million for consumer refunds after the FTC alleged it shared email addresses, IP addresses and health questionnaire answers with advertisers.
The FTC’s health data guidance says FTC Act obligations apply to HIPAA-covered entities and business associates, and warns against false or misleading claims of being “HIPAA Compliant,” “HIPAA Secure” or “HIPAA Certified.” The FTC and OCR also sent a joint warning on tracking in July 2023.
Cash-only practices: check whether HIPAA applies
A provider is a HIPAA covered entity only if it sends health information electronically in a standard transaction, such as an electronic claim (HHS). A practice that never does may fall outside HIPAA, not outside the FTC Act.
A state law example: Washington's My Health My Data Act
State laws can reach website data that HIPAA leaves out. Washington’s My Health My Data Act (RCW 19.373) applies to entities that do business in Washington or target Washington consumers.
- What counts: examples include data identifying a consumer seeking health care services, and precise location suggesting an attempt to get care.
- Consent: collecting needs consent for a specified purpose, and sharing needs a separate consent; neither is needed when the data is necessary to provide a service the consumer requested.
- Selling: needs the consumer’s valid authorization.
- Geofencing: banned within 2,000 feet of a site providing in-person care when used to track care-seekers or send them ads.
- Enforcement: a per se Consumer Protection Act violation; the Attorney General and private parties can sue.
Per the Washington Attorney General, most regulated entities had to comply from March 31, 2024, small businesses from June 30, 2024, and each must link a consumer health data privacy policy from its homepage. HIPAA PHI is exempt. That is the catch: a public-page visit that is no longer PHI under OCR’s guidance may still be data identifying a consumer seeking care. If you treat or advertise to Washington residents, review consent with counsel.
Which tags can run on which pages of a practice website?
Sort pages by what visitors do there. Reading carries the least risk; logging in, typing, booking or paying can send PHI to any vendor whose tag loads.
| Page type | OCR's guidance | Ad and analytics tags | Recommended setup |
|---|---|---|---|
| Hours, directions, careers, about us | Visits unrelated to a person’s health are not PHI | Lower HIPAA risk | Keep tags minimal |
| Public service, condition or provider pages | IP-plus-visit theory vacated (June 2024) | Lower HIPAA risk; FTC and state law apply | No ad remarketing; check state consent rules |
| Appointment request, contact and chat forms | An email or reason for care sent to a vendor is PHI | BAA vendors only | Form data goes to intake, not ad platforms |
| Symptom checkers | PHI when a visitor enters details | BAA vendors only | Remove third-party pixels |
| Portal login and registration | Credentials and registration details are PHI | No ad pixels or session replay | Portal vendor under a BAA |
| Logged-in portal, including billing | Tracking generally has access to PHI | No ad pixels; analytics only under a BAA | Leave measurement to the portal vendor |
| Booking confirmation pages | Not named in the bulletin | Treat like the form before it | Count bookings in your scheduling system |
Source: HHS OCR tracking bulletin (2024, with court notice). ‘Recommended setup’ is RCM Finder’s practice, not an OCR rule.
Planning a redesign? Map tags before launch; our roundup of medical website designs shows common page types.
A practical tracking checklist for your practice website
Work through six steps, and rerun them for each new tool, including channels added from our marketing strategies for small medical practices.
1. Inventory every tag
List every script, pixel, widget and plugin, including those your platform, booking tool or chat vendor adds, and where each sends data. OCR warns that third-party tracking can follow users after they leave your site.
2. Match every vendor to a BAA, or remove it
A vendor that creates, receives, maintains or transmits PHI for you is a business associate (HHS); OCR says that holds with or without a BAA. If a vendor will not sign, OCR’s options are another vendor, or sending it only de-identified data through one that will sign, such as a Customer Data Platform. Google says it offers no BAA for Google Analytics and limits HIPAA-regulated customers to pages that are not HIPAA-covered.
| Tool | What it can receive | BAA needed? | Safer setup |
|---|---|---|---|
| Analytics (e.g., Google Analytics) | IP address, page URLs, events | Yes if PHI reaches it; Google offers no BAA | Only on pages that are not HIPAA-covered |
| Ad pixels (Meta, Google Ads, others) | IP address, URLs, form and button events | Yes if PHI reaches it | Off forms, portal and confirmation pages |
| Session replay and heatmaps | Clicks and, depending on settings, typed text | Yes if used on forms or the portal | Exclude forms and logged-in pages |
| Call tracking | Caller number, source page, recordings | Yes if it stores patient call details | BAA; no call details sent to ad platforms |
| Booking, forms and chat | Names, contact details, reason for visit | Yes | BAA before go-live |
| Review-request platforms | Patient names, contacts, visit dates | Yes | BAA before sharing any patient list |
| Server-side container or Customer Data Platform | Everything the browser sends | Yes if a third party hosts it and PHI reaches it | Strip identifiers before forwarding |
Sources: HHS OCR (2024); HHS business associate guidance; Google Analytics Help (accessed October 2026).
3. Filter data on a server you control
Server-side tagging processes events on a server you control instead of in the visitor’s browser (Google’s documentation), so you can drop IP addresses, full URLs and form fields before data reaches a vendor. HIPAA’s de-identification safe harbor (45 CFR 164.514) lists IP addresses, URLs, email addresses, phone numbers and device identifiers among identifiers to remove.
It is a method, not a compliance status. If a third party hosts the container, or its cloud account, and PHI reaches it, that party needs a BAA.
4. Treat HIPAA and state-law consent separately
A cookie banner does not satisfy HIPAA, but state laws such as Washington’s may require consent for non-PHI health data. Use banners for that, and keep PHI away from non-BAA vendors whatever visitors click.
5. Count conversions without sending PHI
Record the campaign source (UTM parameters or a tracking number) at booking in your scheduling system or EHR, then report totals by campaign: calls, booked visits, kept visits. Never upload patient lists to ad platforms. Our medical marketing ROI guide turns those totals into return, and our healthcare SEO guide covers local search measurement.
6. Check call tracking and review tools
A call-tracking vendor that records, transcribes or stores patient calls handles PHI for you and needs a BAA. Review-request tools receive patient names and contacts from your schedule, so the same rule applies.
Not sure what your website sends to ad platforms?
Our free practice audit reviews your website, booking flow and call handling, and shows which tools touch patient data and what to fix first.
Get a Free Practice AuditHow do you reply to online reviews without disclosing PHI?
Never confirm that a reviewer is a patient. A reply that mentions a visit, treatment or bill can disclose PHI, and OCR has settled with practices over exactly that.
In October 2019, Elite Dental Associates in Dallas agreed to pay $10,000 over social media disclosures of patients’ PHI. In December 2022, New Vision Dental in California paid $23,000 over responses to patient reviews on social media. In 2023, Manasa Health Center, a New Jersey psychiatric practice, agreed to pay $30,000 after OCR’s investigation indicated it disclosed four patients’ PHI in replies to negative Google reviews; its corrective action plan required workforce training.
A reply pattern that confirms nothing
- Thank without confirming a visit: “Thank you for sharing this.”
- State your standard, not their case: “We take every concern seriously.”
- Move it offline: “Please call our office manager at [number].”
- Never mention a visit, provider, condition, treatment, bill or insurance, even to correct the record.
- Give replies to one trained person with a script (see our HIPAA guidelines for the front desk).
“A review reply is a public disclosure. If you would not say it in a full waiting room, do not post it.”
— Awais Afzal, Healthcare Operations & Data Analyst
For how to ask for reviews, see our online reputation management strategies for doctors.
Want marketing measured without risking PHI?
See how our healthcare digital marketing team runs local SEO, Google Ads and review requests for medical practices.
See Healthcare Marketing ServicesOur recommendations
- Start with an inventory, not a policy. We list every tag before discussing rules. Plugins and booking widgets often add scripts nobody remembers.
- Keep ad pixels off anything a patient logs into or types into. Portal, login, booking, contact, chat, symptom-checker and confirmation pages get no ad-platform tags, even where the law is unsettled.
- Get a BAA or remove the tool. If a vendor that could receive PHI will not sign, we replace it. Our own rule is the same: we put a Business Associate Agreement in place before accessing patient data.
- Measure bookings, not pixels. We count calls, booked visits and kept visits in the practice’s own systems and report totals by campaign.
- Read the court ruling narrowly. It removed one theory about public pages. Guidance on portals, forms and apps stands, and FTC and state law are untouched.
- Re-check after every change. A new plugin or redesign can add tags overnight. We re-run the inventory after each change and at least quarterly.
Bottom line
The 2024 court ruling narrowed one part of OCR’s guidance. It did not clear pixels for portals, logins, booking forms or symptom checkers, and it does not touch FTC or state law. Map your tags to your pages, get BAAs or remove tools, count conversions inside your own systems, and reply to reviews without confirming anyone is a patient. If you want a marketing team that works this way, see our healthcare digital marketing services or start with a free practice audit.
Frequently asked questions
Is the Meta pixel allowed on a medical practice website?
No HIPAA rule names the Meta pixel; what matters is what it can see. Under OCR’s guidance, a pixel on a portal, login page, booking form or symptom checker can disclose PHI, which needs a BAA and a permitted purpose, and marketing uses need patient authorization. On purely informational pages, the June 2024 ruling lowered the HIPAA risk, but FTC and state laws still apply.
Did the AHA v. Becerra ruling make tracking pixels HIPAA compliant?
No. The court vacated only the part of OCR’s guidance that treated an IP address plus a visit to a public page about health conditions or providers as triggering HIPAA. It said the ruling should not be read as limiting the rest of the guidance. OCR’s guidance on logged-in pages, login and registration pages, booking flows and apps still stands.
Can we use Google Analytics on our practice website?
Google says it does not offer Business Associate Agreements for Google Analytics and that HIPAA-regulated customers may use it only on pages that are not HIPAA-covered. It adds that logged-in pages are likely covered and pages tied to providing care are more likely to be. In practice, that means informational pages only, or an analytics vendor that will sign a BAA.
Does a cookie consent banner make our tracking HIPAA compliant?
No. OCR says banners asking visitors to accept or reject tracking are not valid HIPAA authorizations, and a privacy policy notice is not enough either. A banner can still help with state laws that require consent for health data, such as Washington’s My Health My Data Act. Treat the two questions separately.
Is server-side tagging HIPAA compliant?
Server-side tagging is a method, not a compliance status. It lets you strip identifiers such as IP addresses and full page URLs before data reaches a vendor. If a third party hosts the container and PHI reaches it, that party needs a BAA, and OCR says a vendor’s promise to remove PHI after receiving it is not enough.
How should we reply to a negative review without violating HIPAA?
Do not confirm the reviewer is a patient, and do not mention any visit, treatment, bill or condition. Thank them, state your general standard and invite them to call the office. OCR has settled with practices that disclosed patient information in review replies, including a 2023 settlement with a New Jersey psychiatric practice over replies to four patients’ Google reviews.
Get your free practice audit
Tell us about your practice. A member of our operations team replies within one business day.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — HHS Office for Civil Rights (2024 (revised bulletin with June 2024 court notice; content last reviewed June 26, 2024))
- American Hospital Association v. Becerra, No. 4:23-cv-1110 (N.D. Tex. June 20, 2024), Memorandum Opinion and Order — U.S. District Court for the Northern District of Texas (via GovInfo) (2024)
- HHS will not appeal AHA court victory in online tracking case — American Hospital Association (2024)
- FTC Finalizes Changes to the Health Breach Notification Rule — Federal Trade Commission (2024)
- Health Breach Notification Rule (final rule, 89 FR 47028) — Federal Register (Federal Trade Commission) (2024)
- 16 CFR Part 318 — Health Breach Notification Rule — eCFR (National Archives) (2026)
- FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising — Federal Trade Commission (2023)
- FTC to Ban BetterHelp from Revealing Consumers' Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising — Federal Trade Commission (2023)
- FTC and HHS Warn Hospital Systems and Telehealth Providers about Privacy and Security Risks from Online Tracking Technologies — Federal Trade Commission (2023)
- Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule — Federal Trade Commission (2023 (updated August 2024))
- Protecting Washingtonians' Personal Health Data and Privacy (My Health My Data Act) — Washington State Office of the Attorney General (2024 (accessed October 2026))
- Chapter 19.373 RCW — Washington My Health My Data Act — Washington State Legislature (2023 (accessed October 2026))
- HHS Civil Rights Office Enters Settlement with Dental Practice Over Disclosures of Patients' Protected Health Information (New Vision Dental) — HHS Office for Civil Rights (2022)
- Resolution Agreement and Corrective Action Plan: Manasa Health Center, LLC — HHS Office for Civil Rights (2023)
- Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients' Protected Health Information (Elite Dental Associates) — HHS Office for Civil Rights (2019)
- HIPAA and Google Analytics — Google (Analytics Help) (accessed October 2026)
- An introduction to server-side tagging — Google for Developers (accessed October 2026)
- 45 CFR 164.514 — Other requirements relating to uses and disclosures of protected health information (de-identification) — eCFR (National Archives) (2026)
- Business Associates — HHS Office for Civil Rights (accessed October 2026)
- Covered Entities and Business Associates — HHS Office for Civil Rights (accessed October 2026)
Disclaimer: This article is general educational information about HIPAA, FTC and state privacy rules as they apply to medical practice websites. It is not legal advice and does not create an attorney-client relationship. Guidance, court decisions and state laws change, and how they apply depends on your practice, your vendors and where your patients live. Talk to qualified health care privacy counsel before changing your website tracking or marketing.
