Book a practice review

Insights / Practice websites, privacy and tracking

Tracking pixels and Google Analytics on a practice website: what HHS and the courts said

Tracking pixels on practice websites: the HHS OCR bulletin, what a 2024 court ruling removed, and measuring calls and forms without sharing patient data.

Creahive Health team

Almost every practice website runs some tracking: Google Analytics, a Google Ads conversion tag, a Meta pixel, a chat widget, a session recording tool. These tools tell you which ads bring calls and where people drop off. They also send information about your visitors to the companies that make them.

For a healthcare practice that matters. In 2022 the HHS Office for Civil Rights (OCR) published a bulletin on tracking technologies under HIPAA, and in 2024 a federal court struck down part of it. Much of what you read online about this is either out of date or written to sell a product. This guide sets out what the documents actually say and what a practice can do about it, with links to the sources at the end. For quizzes, risk calculators and symptom checkers in particular, see our guide to health quizzes and symptom checkers on a practice website. Why contacts from appointment requests should not become ad audiences is in following up on abandoned appointment requests. What to keep off booking and confirmation pages is in our guide to online booking widgets. Uploading patient lists to ad platforms is a separate step, covered in our guide to patient list uploads and customer match. Microsoft’s own conversion tag rules are covered in our guide to Microsoft Advertising for medical practices. For the Reddit Pixel and Reddit’s data terms, see our guide to Reddit Ads for medical practices. For Google Analytics in particular, see our guide to Google Analytics on medical practice websites. For lead data sent back to ad platforms from your CRM, see our guide to lead form ads in healthcare.

This is general information for practice owners, not legal advice. Whether a specific page or tool on your site involves protected health information depends on the facts. Talk to your privacy officer or a healthcare attorney before you decide.

What counts as a tracking technology

OCR’s bulletin describes a tracking technology as a script or code on a website or mobile app that gathers information about users and what they do there. It names cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts as common examples. The bulletin also points out that tools made by third parties generally send the information directly to those third parties.

On a typical practice site, that list usually includes:

  • Google Analytics and Google Tag Manager
  • Ad conversion tags and pixels (Google Ads, Meta, Microsoft and others)
  • Session recording and heatmap tools that capture clicks and typing
  • Third-party chat, scheduling and form widgets, which often carry their own trackers
  • Call tracking scripts that swap phone numbers on the page

What the OCR bulletin says

The bulletin, titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” explains how the HIPAA Rules apply when practices and other regulated entities use these tools. Its starting point: HIPAA applies when the information collected through tracking, or sent to a tracking vendor, includes protected health information (PHI). It then looks at three settings.

  • Pages behind a login such as a patient portal or telehealth platform. OCR says tracking on these pages generally has access to PHI, such as IP address, medical record number, email address or appointment dates.
  • Public pages that anyone can open without logging in. OCR says tracking on many of these pages does not have access to PHI, and gives examples like a page with your location, hours or job openings. But it singles out public pages where people schedule appointments or use a symptom checker: if a tracker collects an email address or the reason for a visit that someone typed or selected, OCR says that is a disclosure of PHI. The same goes for what someone enters on a portal login or registration page.
  • Mobile apps offered by the practice. OCR says the information these apps collect generally is PHI.

Three more points in the bulletin are often missed:

  • Mentioning tracking in your privacy policy or terms does not, on its own, permit disclosing PHI to a tracking vendor.
  • A cookie banner where visitors accept or reject cookies is not a valid HIPAA authorization.
  • A vendor promising to strip out or de-identify PHI after receiving it is not enough. OCR says a disclosure of PHI without authorization needs both a signed business associate agreement (BAA) and a Privacy Rule permission.

What the 2024 court ruling changed

The American Hospital Association and others sued HHS over the bulletin. On June 20, 2024, the U.S. District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra (No. 4:23-cv-1110) and vacated part of the guidance. HHS now carries a note at the top of the bulletin that describes what was vacated: the guidance to the extent it says HIPAA obligations are triggered when an online technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. HHS later withdrew its appeal.

In plain terms, the court removed one specific idea: that an IP address plus a visit to a public page about a condition or a provider is, by itself, enough to bring in HIPAA. The ruling did not remove the rest of the bulletin. The note on the HHS page says only that portion was vacated, so the parts about logged-in pages, appointment and symptom forms, mobile apps, privacy policies, cookie banners and BAAs are still there.

HIPAA is not the only rule

Not every practice is a HIPAA covered entity. Under the HIPAA definitions in 45 CFR 160.103, a health care provider is covered when it transmits health information electronically in connection with certain standard transactions, such as insurance claims. Some cash-pay practices, including some med spas, may fall outside that definition. That does not mean anything goes.

In July 2023, the FTC and HHS OCR jointly sent letters to about 130 hospital systems and telehealth providers about the privacy and security risks of online tracking. The FTC’s announcement says companies not covered by HIPAA still have a responsibility to protect against unauthorized disclosure of health information, and points to the FTC Act and the FTC’s Health Breach Notification Rule. States also have their own health privacy laws. Whichever rules apply to you, the practical answer is the same: do not send patients’ health information to ad and analytics companies. State wiretap laws are a separate risk for chat and session replay tools, covered in our guide to website chat, session replay and wiretap laws.

What Google itself says about Google Analytics

Google’s help page on HIPAA and Google Analytics is direct. Google makes no representation that Google Analytics satisfies HIPAA requirements and does not offer BAAs for it. Google says customers subject to HIPAA must not use Google Analytics in a way that gives Google access to PHI, should not put Google Analytics tags on authenticated pages, and should not put them on unauthenticated pages that are HIPAA-covered. It refers to the HHS bulletin and tells customers to work with their legal teams to decide which pages those are.

Ad features deserve a separate look. Google describes enhanced conversions in Google Ads as capturing first-party customer data such as an email address, name, home address or phone number in the conversion tag, hashing it, and sending it to Google. On a page where someone books an appointment, that is exactly the kind of form data the bulletin is talking about. Hashing does not change the fact that it leaves your site.

A practical setup for a practice website

You can still learn which ads and pages bring patients. The approach is to measure that something happened, not who it happened to or why.

  1. List every script on the siteOpen your tag manager and your page source and write down every tool, who makes it and which pages it loads on. Plugins and widgets often add trackers nobody remembers installing.
  2. Sort your pagesSeparate general pages (home, about, location, hours, services overview) from pages where people log in, book, fill in symptoms or send a message. Your legal adviser decides where the line falls for your practice.
  3. Keep third-party trackers off sensitive pagesNo ad pixels, analytics tags, session recordings or chat trackers on portal, booking, intake or symptom pages, unless your legal adviser has confirmed a BAA and a Privacy Rule permission cover that vendor and that use.
  4. Count conversions without contentRecord that a form was submitted or a call was placed, from a thank-you page that carries no form data in the URL. Do not pass names, emails, phone numbers or the reason for the visit to ad or analytics tools, and leave features like enhanced conversions off on those forms.
  5. Keep form content in your own systemsSend form submissions to the practice, not through a marketing tool. Ask any vendor that will receive patient information what its BAA covers, in writing, before anything flows to it.
  6. Review after every changeNew plugins, chat tools and ad campaigns add scripts. Repeat the inventory when the site changes and at least once a year.

Illustration. A dental practice runs Google Ads to its implants page and has an online booking form. A setup in line with the steps above counts a conversion when the booking confirmation page loads, with no patient details in the page address or the tag. The booking form itself sends its contents only to the practice’s scheduling system. Google Ads learns that a booking happened after an ad click. It never learns who booked or why.

How we handle this

When we build a practice website or run Google Ads for a practice, we track calls and form submissions as events and keep patient information out of ad and analytics tools. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. For the ad side, see our healthcare ad policy basics, and for phone calls our guide to choosing an AI receptionist.

Frequently asked questions

Can a medical practice use Google Analytics?

Google says HIPAA-regulated customers may only use Google Analytics on pages that are not HIPAA-covered, must not use it in a way that gives Google access to PHI, and that Google does not offer a BAA for it. In practice that means general pages only, no tags on login, booking or symptom pages, and no patient details sent in events. Your legal adviser should confirm which pages qualify.

Did the 2024 court ruling cancel the HHS tracking guidance?

No, only part of it. The court in American Hospital Association v. Becerra vacated the guidance to the extent it said an IP address combined with a visit to a public page about health conditions or providers triggers HIPAA. The bulletin’s other sections, including those on logged-in pages, appointment and symptom forms, mobile apps, cookie banners and BAAs, remain on the HHS website.

Is a cookie consent banner enough?

Not under HIPAA. OCR’s bulletin says a banner asking visitors to accept or reject cookies is not a valid HIPAA authorization, and that a privacy policy statement alone does not permit disclosing PHI to a tracking vendor.

Can we use the Meta pixel or Google Ads tags on our site?

Many practices keep ad tags on general pages and off any page where patients log in, book, or describe symptoms, and count conversions without sending form contents. Whether a given page is safe for a given tag is a decision for your legal adviser, based on what the tag can see.

Our practice does not bill insurance. Does any of this apply?

HIPAA may or may not apply, depending on whether you are a covered entity. The FTC has said that companies not covered by HIPAA still have a responsibility to protect health information, and state laws can apply too. Keeping patient information out of tracking tools is the sensible default either way.

For tags on pages or apps directed to children under 13, see our guide to COPPA for pediatric practice websites and apps.

Sources

More in Practice websites, privacy and tracking

Want a second pair of eyes on your patient path?

Book a practice review. We look at how patients find you, what they see on your site, what happens when they call, and what you can measure today. You get a plain list of what we would fix first.

Book a practice review