Klyr MediaVisit Website →
← Back to blog

HIPAA Tracking Technologies: What Healthcare Providers Must Know

November 6, 2026
HIPAA Tracking Technologies: What Healthcare Providers Must Know

HIPAA applies to tracking technologies whenever a script on your website or app collects or discloses protected health information (PHI) and sends it to a vendor. That covers pixels, cookies, session replay and SDKs. The safe way to run them is to know what each tool collects, keep them off authenticated pages unless a business associate agreement (BAA) is in place, and audit the whole stack on a schedule. Below is what the rules say, what changed in court, and what to do on Monday morning.

Klyrmedia
Build a More Privacy-Conscious Website
Klyrmedia creates HIPAA-compliant websites and healthcare marketing systems for pharmacies, clinics, and practices.
Explore healthcare solutions

TL;DR

  • Tracking technologies are scripts or code that collect data on how people use your website or app. Under HIPAA, that data can be PHI when it is tied to an identifier and a health-related interaction.
  • Login-protected pages (patient portals, telehealth, scheduling after sign-in) generally have access to PHI, so the HIPAA Rules apply to trackers there.
  • A June 2024 federal ruling vacated part of HHS guidance on IP addresses and public pages. It did not make tracking on your site risk-free.
  • Audit every tracker, decide which vendors are business associates, sign BAAs where required, and strip identifiers from anything that can't be covered.
  • Even if you are not a HIPAA-covered entity, the FTC can still go after health data shared for advertising.

Table of Contents

What counts as a tracking technology

HHS defines a tracking technology as a script or code on a website or mobile app that gathers information about users or their actions as they interact with it. According to the HHS Office for Civil Rights (OCR), websites commonly use cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts. Mobile apps typically embed tracking code that can capture what the user enters plus device details such as a device ID or advertising ID.

If you run an independent pharmacy or a clinic site, you probably have more of these than you think:

  • Analytics tags. Page views, traffic sources, conversions.
  • Ad pixels. Meta, Google Ads, Bing and similar tags that report actions back to an ad platform.
  • Session replay or heatmap tools. They record clicks, scrolling and sometimes what people type.
  • Chat widgets and scheduling plugins. Often third-party code loaded on every page.
  • Call tracking numbers. Dynamic numbers that log caller details and sometimes recordings.
  • Embedded video and maps. A video player or map can drop its own cookies.

HHS notes that third-party tracking technologies send information to their developers and may keep tracking users after they leave your site. That is the part owners miss. You didn't write the code, but you chose to load it.

When tracking data becomes PHI

HIPAA protects individually identifiable health information (IIHI) held by covered entities and business associates. HHS says IIHI collected on a regulated entity's site or app generally is PHI, even without an existing patient relationship. The identifiers can be obvious (a medical record number, an email address, an appointment date) or less obvious (an IP address, a geographic location, a device ID or any unique code).

Examples of obvious and less-obvious identifiers

The health part comes from context. An IP address alone is just a number. An IP address attached to a click on "Book a refill for my prescription" is a different animal.

That is why the same pixel can be harmless on a blog post and a problem on a booking confirmation page. Law firms writing about the guidance point out that whether data is PHI depends partly on why the visitor is there, and neither you nor your vendor can know that.

Authenticated vs. unauthenticated pages

HHS draws a line between two kinds of pages:

Page typeExamplesHHS position on HIPAA
User-authenticatedPatient portal, telehealth platform, logged-in account areaTrackers generally have access to PHI, so the HIPAA Rules apply
UnauthenticatedHome page, service pages, location pages, blogMany trackers don't have access to PHI, so HIPAA doesn't regulate them, but some do, and then HIPAA applies

Source for both rows: HHS OCR bulletin.

The "some do" is where clinics get burned. Think of a public page where someone types a name and phone number to request an appointment for a specific condition. It looks public. The data flowing out isn't.

What the 2024 court ruling changed, and what it didn't

OCR first issued its bulletin in December 2022 and revised it in March 2024. Then the American Hospital Association sued. On June 20, 2024, the Northern District of Texas in American Hospital Association v. Becerra vacated the part of the bulletin saying HIPAA obligations are triggered when a tracker connects an IP address with a visit to an unauthenticated public page about health conditions or providers. The court found OCR had exceeded its authority.

The court reasoned that a visitor's intent is unknowable and that HIPAA doesn't require clairvoyance. According to one law firm analysis, the vacatur applies nationwide and limits HHS's ability to bring enforcement based only on that narrow part of the guidance.

Now the part that matters to you. The rest of the bulletin stands. HIPAA still applies when a person's health information is collected along with identifying data, and covered entities must still review their trackers and make sure any disclosure is permitted or authorized. Login pages, patient portals and forms that collect health details remain squarely in scope.

So here's the honest read: the ruling narrowed one theory. It didn't give anyone a free pass to pipe patient data to ad platforms. State privacy laws, plaintiffs' lawyers and the FTC all still care.

What the 2024 court ruling changed, and what it didn't

The FTC doesn't care if you're "covered"

Some practices assume that if HIPAA doesn't clearly apply, they're clear. Not quite. HHS and the FTC said jointly that even if you aren't covered by HIPAA, you still must protect against impermissible disclosures of personal health information under the FTC Act and the Health Breach Notification Rule.

The FTC has acted on this. Its 2023 privacy and data security update lists BetterHelp (ordered to pay $7.8 million in partial refunds), GoodRx ($1.5 million civil penalty) and Easy Healthcare ($100,000 civil penalty), plus a complaint against Flo Health alleging health data went to analytics providers including Facebook and Google. The FTC's update also describes the remedies: stop sharing health data for advertising, get affirmative express consent for other disclosures, and tell third parties to delete the data.

Those companies were far bigger than a corner pharmacy. The lesson is the pattern, not the size: health-adjacent data plus an ad pixel plus no consent.

Why it matters in the real world

HHS and the FTC say impermissible disclosures can reveal health conditions, diagnoses, medications and where someone seeks treatment, and can lead to identity theft, financial loss, discrimination and stigma. Picture a patient searching for a specialty pharmacy that fills HIV or fertility prescriptions. They'd never expect that click to show up in a social feed's ad targeting.

Independent pharmacies and small practices feel this harder than hospital systems. You don't have a privacy office. Your website was probably built years ago, and three different vendors have added tags since.

A practical audit for pharmacies and clinics

HHS tells regulated entities to assess whether tracking vendors are business associates, make sure PHI disclosures are permitted, sign BAAs where vendors meet the definition, fold trackers into their risk analysis and risk management, and apply Security Rule safeguards. The American Bar Association's guidance adds that you should audit which trackers are on your site and what each one collects, and consider a breach risk assessment if you find a problem.

Here's how that looks in practice.

  1. Inventory every tag. Use your tag manager, your browser's developer tools and a scan of every page template. Include pages behind login. Don't forget old tags from past agencies.
  2. Map what each tracker sees. URL paths, form fields, button text, query strings. A URL like /refill/oxycodone tells a story all by itself.
  3. Sort pages into zones. Public information pages. Pages with forms. Logged-in areas. Be strictest where patients act.
  4. Decide per vendor. Does the vendor create, receive, maintain or transmit PHI for you? If so, you need a BAA. If a vendor won't sign one, it shouldn't touch pages where PHI can flow.
  5. Remove, restrict or reconfigure. Pull ad pixels from portals and booking flows. Turn off session replay on anything with form fields. Mask or strip identifiers and URL parameters before data leaves your site.
  6. Update your notices and consent. Your privacy notice should match reality. Where you rely on authorization, make sure it's real, not a banner nobody can decline.
  7. Document it. Write the findings into your risk analysis, with dates and owners.
  8. Repeat. Every plugin update, redesign or new ad campaign can add a tag. Re-scan quarterly.

Common trouble spots

  • Meta and other ad pixels on appointment or refill pages. Conversion tracking often sends the page URL and event name along with hashed contact details.
  • Analytics set up with defaults. We've written about a HIPAA-aware GA4 setup for clinics because the out-of-the-box configuration isn't built with PHI in mind.
  • Call tracking. Recordings and caller data can be PHI. Our guide to HIPAA-compliant call tracking covers BAAs and the Security Rule checks.
  • Social ad rules. Platforms have their own health data restrictions, covered in our post on Facebook ad rules and HIPAA tracking risks.
  • Hosting and site build. Where your site lives and how forms are processed affects every tracker above. See why secure hosting matters for healthcare.

If a tracker may have leaked PHI

Don't panic, and don't quietly delete the tag and hope. HHS says that when an impermissible disclosure compromises PHI, with no Privacy Rule permission and no BAA, the entity must notify affected individuals, the Secretary and, when applicable, the media. A breach of unsecured PHI is presumed unless you can demonstrate a low probability that PHI was compromised.

Practical steps:

  1. Disable the tracker on the affected pages right away.
  2. Preserve logs and tag configurations so you can show what was collected and when.
  3. Bring in your privacy officer and healthcare counsel to run the breach risk assessment and decide on notification.
  4. Ask the vendor in writing to delete what it received.
  5. Fix the root cause and record it in your risk analysis.

This is a legal call. Your HIPAA attorney should own the notification decision, not your marketing team.

Perspective: marketing and compliance can't be separate jobs

We work only with healthcare providers, and the pattern repeats. A pharmacy owner hires someone to "get more calls," a pixel goes on every page, and nobody asks where the data goes. Months later the phone is ringing, and the compliance exposure is quietly piling up.

Our view is simple. You shouldn't have to pick between visibility and compliance. Local SEO, Google Maps visibility, paid search and patient follow-up can all be run with compliance designed in from day one, which is how we build our systems for independent pharmacies and clinics.

That means choosing measurement that fits healthcare, keeping identifiers off pages where patients act, and treating every vendor tag as a decision rather than a default. It's less glamorous than a growth hack. It also holds up when someone asks questions.

Independents are competing with chains and online giants that have legal teams. Getting your tracking right is one way to compete on trust, and trust is what keeps patients coming back.

Opinly

How we can help

If you've read this far and realized you can't say what's running on your site, that's the signal to get it looked at. We build HIPAA-compliant websites for pharmacies, clinics and practices, and our approach to local search, paid ads and automated patient follow-up is designed around healthcare rules rather than generic marketing playbooks.

Klyrmedia

If you're starting from the build, our HIPAA-compliant website workflow guide walks through the steps. If you want to talk through your current setup, start at klyrmedia.com.

FAQ

Does HIPAA ban Google Analytics or the Meta pixel?

HIPAA doesn't name specific products. It asks whether a tool collects or discloses PHI and whether the vendor relationship is permitted, typically with a BAA when the vendor acts as a business associate. Tools that can't be set up that way shouldn't run on pages where PHI can flow, such as portals and booking or refill forms.

Did the 2024 court ruling end HIPAA rules for website tracking?

No. The court vacated only the part of the HHS bulletin about IP addresses tied to visits to unauthenticated public pages on health topics or providers. HIPAA still applies when health information is collected with identifying data, and trackers on authenticated pages remain covered by HHS's position.

Is an IP address PHI?

It can be. HHS lists IP addresses among identifiers that become PHI when combined with health information in a regulated entity's context. The court ruling removed the theory that a visit to a public health-topic page alone makes an IP address PHI, but an IP address tied to an appointment request still can be.

Do small pharmacies and clinics need to worry about this?

Yes, if you're a covered entity or business associate, the rules apply regardless of size. Even providers outside HIPAA face FTC rules on sharing health data with advertisers. A tag inventory and a short written risk analysis are a realistic starting point for a small team.

How often should I audit my website trackers?

HHS expects tracking technologies to be part of your ongoing risk analysis and risk management. In practice, that means scanning after any redesign, plugin change or new ad campaign, and on a regular schedule such as quarterly.

Sources