Most American practices treat HIPAA as an administrative concern — forms, signatures, a binder somewhere. Then they install a tag manager, drop in an advertising pixel and a chat widget, and quietly build the single largest privacy exposure the practice has. The mechanism is not obvious, which is why it persists.
This is a technical problem with a technical fix, and it is worth understanding rather than delegating.
This is a practitioner's summary written by marketers, not legal advice. Regulations change, and enforcement varies. Confirm the current text with your regulator or your own counsel before you publish.
Why a pixel is different from a filing cabinet
Protected health information is not only a diagnosis in a chart. Under the HIPAA framework, information that both identifies an individual and relates to their health, care, or payment for care is protected. An advertising pixel typically transmits an IP address, a device or cookie identifier, and the URL of the page being viewed.
If that URL is a page about a specific condition or procedure, the combination of identifier plus page can relate an identifiable individual to a health matter. That is the argument the Office for Civil Rights set out in its guidance on online tracking technologies, and it is the reason a large number of health systems have found themselves in litigation and enforcement discussions over ordinary marketing tags.
The picture has not stood still. A federal court in Texas subsequently vacated part of that guidance as it applied to tracking on unauthenticated public webpages — meaning OCR's specific theory about ordinary public pages does not stand as written. That is a genuine narrowing, and it is not an all-clear. The reasons why:
- Anything behind a login — a patient portal, a results page, a scheduling account — was never in dispute. Tracking there is high risk, full stop.
- State law has moved independently. Washington's health data statute and comparable laws elsewhere define consumer health data broadly and, in some cases, provide a private right of action. Those obligations do not depend on HIPAA at all.
- The Federal Trade Commission has pursued health-adjacent companies under the Health Breach Notification Rule and its unfairness authority for sharing health information with advertising platforms without consent. Those actions are public and instructive.
- Class-action plaintiffs have not waited for regulators, and wiretapping and session-recording theories are being tested actively.
The practical posture that survives all four: do not ship condition-level browsing behaviour to advertising platforms, regardless of which specific rule you think applies to you.
What to actually change
Get health context out of your URLs and page titles
If your page path names a condition, every request generated on that page carries the condition. Structure matters more than you would expect, and a URL scheme that keeps diagnosis language out of the path removes a whole category of leakage without touching your content.
The same applies to query strings. Booking flows that pass a service, reason for visit, or referral source in the URL will hand those to every third-party script on the page.
Stop client-side tags from seeing form fields
Chat widgets, session replay tools and heatmaps capture input by default. Every one of them offers masking. Turn it on, verify it by actually recording a test session and inspecting what was stored, and re-verify after every vendor update.
Move measurement server-side
Instead of letting a browser tag report what a visitor did, have your own server report a conversion event with no personal detail attached. You keep the ability to optimise campaigns; the ad platform stops receiving the browsing trail. This is the single highest-leverage change available and it also happens to make your measurement more accurate as browser restrictions tighten.
Offline conversion imports go a step further: match booked appointments back to campaigns using an identifier you control, on your own schedule, with only the fields you choose to include.
Get contracts in place
Any vendor that will handle protected information needs a business associate agreement. The major advertising platforms generally will not sign one for their standard advertising products — which is itself the answer about whether protected information should be flowing to them.
Consent, and mean it
A banner that loads after the tags have fired documents an intent you did not honour. Gate marketing tags behind consent, and make the refusal path work as reliably as the acceptance path.
Testimonials, reviews and the front desk
Patient stories are permitted with proper written authorization — specific, informed, revocable, and not buried in an intake packet. What is not permitted is the thing that happens accidentally: responding to a negative online review in a way that confirms the reviewer is a patient, or explains their care. Even "we have no record of this visit" is a disclosure about the individual's status.
The safe reply is short, generic, and moves the conversation off-platform: acknowledge the feedback in general terms, provide a direct contact route, and say nothing about any individual. Write that reply once and give it to whoever handles reviews, because the mistake is almost always made in the moment by someone trying to help.
Similarly, do not upload patient contact lists into advertising platforms to build audiences. It is a standard growth tactic in other industries and a straightforward problem here.
