HIPAA and tracking pixels: what clinics can and cannot track in 2026

Can healthcare websites use tracking pixels?

Yes, but carefully. A tracking pixel that sends a patient's identity together with health information to an ad platform can be an impermissible disclosure under HIPAA. Since a 2024 court ruling, public pages are lower risk than authenticated pages such as patient portals, but the safest setup is server-side tracking that sends only non-health events.

How the rules changed

Key events for tracking on healthcare websites

Date	What happened
December 2022	HHS Office for Civil Rights publishes guidance on online tracking technologies used by HIPAA covered entities.
2023	The FTC takes action against GoodRx and BetterHelp for sharing health data with advertising platforms.
March 2024	HHS updates its tracking guidance.
20 June 2024	In American Hospital Association v. Becerra, a federal court in Texas vacates the part of the guidance about IP addresses combined with visits to public, unauthenticated pages.
29 August 2024	HHS withdraws its appeal of the ruling.

What counts as PHI on a website?

Protected health information is health information that can identify a person and is held by a covered entity or business associate. On a website, risk is highest when identifiers (such as an IP address, email or device ID) are sent to a third party together with health details, for example:

• pages inside a patient portal or after login;
• appointment forms that capture a condition or symptom;
• event names such as "booked_IVF_consult" or "diabetes_form".

Safer vs riskier tracking

Riskier	Safer
Browser pixel on patient portal pages	No ad pixels on authenticated pages
Event names that reveal a condition	Generic events: Lead, Schedule
Form fields sent to ad platforms	Only hashed contact data, no health fields
Vendors without a BAA handling PHI	BAA in place, or no PHI shared at all
No consent banner for EU visitors	Consent before marketing cookies

A safe tracking setup for clinics

1. Audit. List every pixel, tag and script, the pages they run on and the data they send.
2. Remove pixels from sensitive pages such as portals and condition-specific forms.
3. Move conversions server-side. Use the Meta Conversions API and Google's server-side options to send only generic events like Lead and Schedule.
4. Strip health details. Never send conditions, treatments or free-text form answers.
5. Sign agreements. Use a Business Associate Agreement with any vendor that handles PHI, and a Data Processing Agreement in Europe.
6. Respect consent. Use a consent banner for marketing cookies where the law requires it.

This is how we set up tracking for clients. In our Radiant Beauty & Health case study, the pixel had been switched off for HIPAA. We rebuilt tracking server-side with generic Lead and Schedule events, and Meta could finally learn from real bookings. Read more about our compliance approach.

Beyond HIPAA: FTC and state laws

Not every health business is covered by HIPAA, but that does not mean anything goes. The FTC has used the Health Breach Notification Rule and its authority over unfair and deceptive practices against companies that shared health data with advertisers. Some states have passed consumer health data laws, such as Washington's My Health My Data Act, which can apply even outside HIPAA.

Summary

Tracking is still possible for clinics, and it is essential for efficient ads. Keep pixels off sensitive pages, send only generic events server-side, never share health details, and put the right agreements in place. Then you can measure marketing without putting patients, or your practice, at risk.

Frequently asked questions

Can clinics use the Meta Pixel under HIPAA?

Using browser pixels on pages that reveal health information, such as patient portals or appointment pages for a specific condition, can disclose protected health information. Many clinics switch to server-side tracking that sends only non-health events.

What did the AHA v. Becerra ruling change?

In June 2024 a federal court in Texas vacated part of the HHS tracking guidance that treated an IP address plus a visit to a public, unauthenticated page about health conditions as protected health information. HHS withdrew its appeal in August 2024. Authenticated pages such as patient portals are still covered.

Is server-side tracking HIPAA compliant?

Server-side tracking is not automatically compliant, but it lets you control exactly what data leaves your systems. Send only non-health events such as a lead or a booking, and use vendors who sign a Business Associate Agreement where needed.

Do non-HIPAA health apps have rules too?

Yes. The FTC enforces the Health Breach Notification Rule and has acted against companies such as GoodRx and BetterHelp for sharing health data with advertisers. Some states, such as Washington, have their own consumer health data laws.

What should a clinic do first?

List every tracking tool on your website, check which pages it runs on and what data it sends, remove pixels from sensitive pages, and move conversion tracking server-side with health details stripped out.

This article is general information, not legal advice. Ask a qualified adviser to review your setup.

Sources

• HHS: Use of online tracking technologies by HIPAA covered entities and business associates
• AHA: Judge rules in favor of AHA vacating HHS online tracking bulletin (June 2024)
• Morrison Foerster: HHS withdraws appeal (2024)
• FTC: Enforcement action against GoodRx (2023)
• Washington AG: My Health My Data Act