What the standard says
HHS’s Office for Civil Rights (OCR) covers this in its bulletin “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” [1]. A covered entity is a health plan, clearinghouse or provider that bills insurance electronically, which includes most medical and dental practices. HHS defines tracking technology as a script or code on a website or app that gathers information about users or their actions, including cookies, web beacons or tracking pixels, and session replay scripts [1].
The bulletin was first issued in December 2022 and revised on March 18, 2024 [2]. On June 20, 2024, a federal court in the Northern District of Texas, in American Hospital Association v. Becerra, vacated one part of it [2]. HHS now shows a notice about it on the bulletin [1]. The vacated part said HIPAA applied when a tracker linked a visitor’s IP address with a visit to a public, no-login page about a specific health condition or provider [1]. The court held that combination is not protected health information (PHI, the health details HIPAA protects when they can be tied to a person) [2].
What the ruling didn’t touch:
Logged-in pages. HHS says trackers on pages that require a login, like patient portals, generally have access to PHI and must be set up to follow the HIPAA Privacy Rule [1]. The court’s opinion addressed only public pages without a login [2].
Public pages that collect PHI. HHS’s examples include booking an appointment or using a symptom checker, where a visitor enters an email address or reason for a visit [1].
Business associate agreements. A business associate agreement (BAA) is a contract in which a vendor promises to protect PHI it handles for a practice. HHS says a tracking vendor that receives PHI needs one, and that mentioning trackers in a privacy policy isn’t enough [1]. If a vendor won’t sign, HHS says the practice can’t share PHI with it without each patient’s authorization [1]. Google, for example, says it does not offer BAAs for Google Analytics and that HIPAA-regulated entities must not send it PHI [3].
Marketing. HHS says sharing PHI with tracking vendors for marketing without patient authorization is not permitted [1].
HHS also says OCR is prioritizing Security Rule compliance in its tracking investigations, and that practices should include trackers in their risk analysis [1].
What you’ll hear
“Any analytics on a medical website is a HIPAA violation.”
That goes too far. HHS itself says many public pages, like ones listing job openings or visiting hours, don’t involve PHI [1]. The opposite claim is also common: “The court threw out the pixel rules, so it doesn’t matter.” That goes too far too. The ruling removed one scenario about public pages; the rest of the bulletin still stands, including portals and pages where patients enter their own information [1][2].
The fair version: where the tracker sits and what the page collects is what matters.
What the numbers say
We couldn’t find a reliable count of small practices with trackers on booking or portal pages. Here is what regulators have published:
About 130: hospital systems and telehealth providers that received a joint FTC and HHS warning letter about tracking technologies, July 2023 [4].
$1.5 million: civil penalty in the FTC’s proposed order against GoodRx, February 2023, the first action under its Health Breach Notification Rule [5]. The FTC said GoodRx shared medication and health condition information with Facebook, Google and others [5].
$7.8 million: amount in the FTC’s proposed order against BetterHelp, March 2023, for sharing email addresses, IP addresses and health questionnaire information with advertisers [6].
Both FTC cases involved consumer health companies, not medical practices. The Health Breach Notification Rule doesn’t apply to HIPAA covered entities or to companies acting as their business associates [7]. They show how regulators view health data sent to advertisers.
What we’ve seen
We haven’t run into this yet.
Putting it together
Trackers on general pages are mostly a marketing question. On booking forms, portals and anything a patient types into, they become a HIPAA question that the court ruling didn’t change. A short inventory with your web developer and compliance contact settles which ones stay.
What good looks like
A written list of every tracker on the site, what it does and who owns the account.
No ad or social trackers on booking, intake, symptom checker or portal pages.
Any vendor that could receive PHI either signs a BAA or is kept off those pages.
Trackers covered in the practice’s HIPAA risk analysis.
A check after every site redesign, new form or new plugin.
The privacy policy matching what the site actually does.
Questions for your IT resource
Which trackers are on our site today, and which pages do they load on?
Do any load on the booking page, intake forms or patient portal login?
Web developer: who added each tag, and is it still needed?
Compliance contact: do any of these vendors receive PHI, and do we have a BAA with them?
Are trackers part of our HIPAA risk analysis?
Who checks this again when the site changes?
Related learning
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
Who holds the keys to your domain and website?
Your domain registrar, DNS provider and web host each have a login, and whoever holds those logins controls your website and where your email is delivered. Give each one its own strong password, turn on MFA, and know who has access.
Is your website’s software up to date?
Your website is built from software: the platform, its add-ons and the code libraries it loads. Keeping each piece current, removing what you don’t use and backing up first closes the known holes that automated attacks look for.
Related industries
Sources
U.S. Department of Health and Human Services, Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, content last reviewed June 26, 2024 (includes June 20, 2024 court-order notice). (checked 2026-10-08)
U.S. District Court for the Northern District of Texas, American Hospital Association et al. v. Becerra et al., No. 4:23-cv-01110, Opinion & Order, June 20, 2024, via GovInfo. (checked 2026-10-08)
Google, HIPAA and Google Analytics, Analytics Help. (checked 2026-10-08)
Federal Trade Commission, FTC and HHS Warn Hospital Systems and Telehealth Providers about Privacy and Security Risks from Online Tracking Technologies, July 20, 2023. (checked 2026-10-08)
Federal Trade Commission, FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising, February 1, 2023. (checked 2026-10-08)
Federal Trade Commission, FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising, March 2, 2023. (checked 2026-10-08)
Federal Trade Commission, 16 CFR Part 318: Health Breach Notification Rule, eCFR, amended May 30, 2024. (checked 2026-10-08)
This page is general information, not legal advice. For questions about how it applies to your business, check with your attorney or compliance contact.
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.