HIPAA gets discussed as a rule about paperwork. For a practice website it is mostly a rule about JavaScript. Here is what regulators have actually pursued, what the courts changed, and how to measure marketing without shipping health information to ad platforms.
Most American practices treat HIPAA as an administrative concern — forms, signatures, a binder somewhere. Then they install a tag manager, drop in an advertising pixel and a chat widget, and quietly build the single largest privacy exposure the practice has. The mechanism is not obvious, which is why it persists.
This is a technical problem with a technical fix, and it is worth understanding rather than delegating.
This is a practitioner's summary written by marketers, not legal advice. Regulations change, and enforcement varies. Confirm the current text with your regulator or your own counsel before you publish.
Protected health information is not only a diagnosis in a chart. Under the HIPAA framework, information that both identifies an individual and relates to their health, care, or payment for care is protected. An advertising pixel typically transmits an IP address, a device or cookie identifier, and the URL of the page being viewed.
If that URL is a page about a specific condition or procedure, the combination of identifier plus page can relate an identifiable individual to a health matter. That is the argument the Office for Civil Rights set out in its guidance on online tracking technologies, and it is the reason a large number of health systems have found themselves in litigation and enforcement discussions over ordinary marketing tags.
The picture has not stood still. A federal court in Texas subsequently vacated part of that guidance as it applied to tracking on unauthenticated public webpages — meaning OCR's specific theory about ordinary public pages does not stand as written. That is a genuine narrowing, and it is not an all-clear. The reasons why:
The practical posture that survives all four: do not ship condition-level browsing behaviour to advertising platforms, regardless of which specific rule you think applies to you.
If your page path names a condition, every request generated on that page carries the condition. Structure matters more than you would expect, and a URL scheme that keeps diagnosis language out of the path removes a whole category of leakage without touching your content.
The same applies to query strings. Booking flows that pass a service, reason for visit, or referral source in the URL will hand those to every third-party script on the page.
Chat widgets, session replay tools and heatmaps capture input by default. Every one of them offers masking. Turn it on, verify it by actually recording a test session and inspecting what was stored, and re-verify after every vendor update.
Instead of letting a browser tag report what a visitor did, have your own server report a conversion event with no personal detail attached. You keep the ability to optimise campaigns; the ad platform stops receiving the browsing trail. This is the single highest-leverage change available and it also happens to make your measurement more accurate as browser restrictions tighten.
Offline conversion imports go a step further: match booked appointments back to campaigns using an identifier you control, on your own schedule, with only the fields you choose to include.
Any vendor that will handle protected information needs a business associate agreement. The major advertising platforms generally will not sign one for their standard advertising products — which is itself the answer about whether protected information should be flowing to them.
A banner that loads after the tags have fired documents an intent you did not honour. Gate marketing tags behind consent, and make the refusal path work as reliably as the acceptance path.
Patient stories are permitted with proper written authorization — specific, informed, revocable, and not buried in an intake packet. What is not permitted is the thing that happens accidentally: responding to a negative online review in a way that confirms the reviewer is a patient, or explains their care. Even "we have no record of this visit" is a disclosure about the individual's status.
The safe reply is short, generic, and moves the conversation off-platform: acknowledge the feedback in general terms, provide a direct contact route, and say nothing about any individual. Write that reply once and give it to whoever handles reviews, because the mistake is almost always made in the moment by someone trying to help.
Similarly, do not upload patient contact lists into advertising platforms to build audiences. It is a standard growth tactic in other industries and a straightforward problem here.
Text messaging is where practices assume clinical exemption covers marketing. Appointment reminders, results notifications and care instructions occupy a different category from promotional messages, and the moment a promotion rides in the same message the character changes. Consent rules for automated marketing messages have been in flux at the federal level; the durable answer is to obtain express written consent for marketing specifically, keep the record of what the patient saw and when, and honour opt-outs immediately.
Practices that do this properly end up with better marketing, not worse. Server-side measurement is more accurate than the browser-based tracking it replaces. Clean URLs are better for search. Consent-gated tags load faster. Content that educates rather than mines behaviour ranks better in a search environment increasingly built around demonstrated expertise.
Our HIPAA marketing reference covers the compliance landscape in summary, and our market notes cover New York, Los Angeles and Chicago. If you want the technical audit run properly, we do that.
Writing on healthcare growth, AI-powered patient acquisition, and the operational reality of marketing inside hospitals and clinics.
The exact 90-day patient-acquisition system, step by step.
The ethics code says do not solicit patients. The market is full of doctors advertising heavily. Both things are true, a…
Three regulators, one free-zone authority with its own rulebook, and a permit requirement before anything goes live. A p…
Four bodies have a view on how a UK consultant markets: the GMC, the CQC, the ASA, and the ICO. The single most enforced…
Six reasons hospitals, clinics, and doctors pick a healthcare-only firm over a generalist agency.
It's all we do. No retail, no fintech — the whole team thinks in patient journeys, clinical trust, and the way people actually choose a doctor.
Receptionists, WhatsApp triage, and attribution built in-house — we answer patients in seconds and tie every click to a booked appointment.
HIPAA, ASCI, NABH and GDPR sign-off baked into every campaign — our standard, not an upcharge or an afterthought.
The senior who pitched you stays on the engagement. No bait-and-switch to juniors learning on your budget.
Patient-level attribution across calls, forms, and walk-ins. Monthly reports show booked patients — not just clicks and impressions.
We name our clients and show the work. Quarterly reviews with the numbers attached, every cycle.
Adjacent practices, the relevant tools, and the case files where we shipped this thinking against real patient-acquisition targets.
