Does CCPA apply to medical practices?

A practice owner reads that HIPAA covers patient information and assumes state consumer privacy laws do not reach the practice at all. In Virginia and Texas that is close to true for a covered entity. In California and Colorado, the exemption covers only the patient information itself, and the website visitor data, ad audiences and marketing lists around it can fall under a state privacy law.

This guide is for owners and managers of independent practices, med spas and other health businesses that run a website and online ads. It explains the two kinds of HIPAA exemption found in state consumer privacy laws, walks through California, Virginia, Texas and Colorado, and covers the marketing parts these laws care about: sensitive data, targeted ads and opt-out signals sent by a browser. For the separate state laws written only for consumer health data, see our guides to Washington’s My Health My Data Act and the Nevada and Connecticut consumer health data laws. For how these laws treat sexual orientation and transgender status, see our guide to LGBTQ-inclusive practice marketing.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: California Civil Code 1798.135, 1798.140, 1798.145 and 1798.146 (the California Privacy Protection Agency’s compiled statute effective January 1, 2026, and Internet Archive copies of the official leginfo pages dated October 2, 2026, because the state site does not load for automated checks), the agency’s CCPA regulations effective January 1, 2026 and its threshold page, Virginia Code 59.1-575 to 59.1-578, Texas Business and Commerce Code 541.001 to 541.107 and House Bill 4 (2023), Colorado Revised Statutes 6-1-1303, 6-1-1304, 6-1-1306 and 6-1-1308 (as compiled in 2024) and the Colorado Attorney General’s privacy page, and 45 CFR 160.103. State privacy laws are amended and new ones take effect each year, so check yours, and have a health care attorney review how your website, ads and patient data map to each state where you see patients or run ads.

The short version

There are two kinds of HIPAA exemption. An entity-level exemption takes a HIPAA covered entity out of the law entirely. A data-level exemption takes out only protected health information, and the rest of what the practice collects can still be covered.
Virginia and Texas use entity-level exemptions. Both laws say they do not apply to a covered entity or business associate governed by the HIPAA rules, and they also exempt protected health information held by anyone.
California and Colorado are narrower. California exempts protected health information and a covered entity only to the extent it maintains patient information the way HIPAA requires. Colorado exempts protected health information and information maintained in the same manner by covered entities and health care providers.
Being a covered entity is not automatic. Under 45 CFR 160.103, a health care provider is a covered entity if it transmits health information electronically in connection with a HIPAA standard transaction, such as billing insurance electronically. A cash-only med spa may not be one.
Ads are where these laws bite. Each of the four laws gives consumers a right to opt out of selling or sharing their data for targeted ads, and California and Colorado require businesses that sell data or run targeted ads to honor an opt-out signal sent by the browser.

Why this matters for a practice website

A practice website collects more than patient records. Analytics tools record visits. Ad tags send page views to ad platforms so the practice can show ads to past visitors. A newsletter form collects names and emails of people who are not yet patients. A quiz or symptom checker may collect answers about health.

Whether any of this is protected health information under HIPAA is its own question, which our tracking pixels guide covers. This guide asks the next question: if that data is not protected health information, or if your business is not a HIPAA covered entity at all, does a state consumer privacy law reach it?

Entity-level and data-level exemptions

State consumer privacy laws handle HIPAA in one of two ways, and the wording decides how much of your practice is outside the law.

An entity-level exemption says the law does not apply to a covered entity or business associate. If your practice is a covered entity, the law does not reach the practice at all, including its website and marketing data. Virginia and Texas are written this way.

A data-level exemption says the law does not apply to protected health information, or to information a covered entity keeps the same way it keeps protected health information. Data outside that description, such as website visitor data that is not protected health information, can still be covered if the practice meets the law’s thresholds. California and Colorado are written this way, with differences in the details below.

First question: is your business a HIPAA covered entity?

The entity-level exemptions only help a business that is a covered entity or business associate. Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or “a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.” Billing insurance electronically, checking eligibility electronically and similar standard transactions bring a provider in.

A physician practice that bills insurers electronically is a covered entity. A med spa, wellness studio or cash-pay clinic that never conducts those transactions may not be, and then an entity-level exemption does not apply to it. That business is treated like any other business under a state privacy law, subject to the law’s thresholds. Our HIPAA marketing rules guide covers what HIPAA requires once a practice is covered.

California: CCPA thresholds and the health exemptions

The California Consumer Privacy Act applies to a “business” as defined in Civil Code 1798.140(d): a for-profit entity that does business in California, decides why and how personal information is processed, and meets one or more of three thresholds. The thresholds are annual gross revenue above 25 million dollars as adjusted (the California Privacy Protection Agency lists the adjusted figure as 26,625,000 dollars, effective January 1, 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or getting 50 percent or more of annual revenue from selling or sharing personal information.

“Sharing” in the CCPA has a specific meaning in 1798.140(ah): making personal information available to a third party for cross-context behavioral advertising, whether or not money changes hands. Ad tags that send visitor activity to an ad platform for retargeting can fall within it, which is why the 100,000 threshold deserves a real count for a site with high traffic, not a guess.

The health exemptions sit in 1798.145(c) and 1798.146. The law does not apply to medical information governed by California’s Confidentiality of Medical Information Act, or to protected health information collected by a covered entity or business associate. It also does not apply to a provider of health care governed by that Act, or to a covered entity, “to the extent” the provider or covered entity maintains patient information in the same manner as medical information or protected health information. The compiled 2026 statute adds a similar exemption for a business associate to the same extent, and an exemption for information deidentified under 45 CFR 164.514 that was derived from patient information.

The phrase “to the extent” is the key. The exemption follows patient information handled under HIPAA or California’s medical information law. Website visitors who never became patients, ad audiences and marketing lists are not patient information, so a California practice that meets a threshold should ask counsel how the CCPA applies to that data.

Virginia: an entity-level exemption

Virginia’s Consumer Data Protection Act applies to businesses that conduct business in Virginia or target products or services to its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while getting over 50 percent of gross revenue from selling personal data (Va. Code 59.1-576(A)).

Section 59.1-576(B) says the chapter does not apply to any covered entity or business associate governed by the HIPAA privacy, security and breach notification rules. Section 59.1-576(C) separately exempts protected health information under HIPAA. For a practice that is a covered entity, the Virginia law does not reach the practice, its website or its ad data. A cash-pay health business that is not a covered entity and meets a threshold is covered, and its health data is sensitive data, as described below.

Texas: an entity-level exemption and a small business rule

The Texas Data Privacy and Security Act, chapter 541 of the Business and Commerce Code, took effect July 1, 2024 under House Bill 4 (2023). It has no head count threshold. Section 541.002(a) applies it to a person that conducts business in Texas or produces a product or service consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the United States Small Business Administration.

Section 541.002(b)(3) says the chapter does not apply to a covered entity or business associate governed by the HIPAA rules, and 541.003 separately exempts protected health information and health records. As in Virginia, a covered entity practice is outside the Texas law.

One rule reaches small businesses too. Under 541.107, a small business may not sell personal data that is sensitive data without the consumer’s prior consent. A small cash-pay clinic in Texas that is not a covered entity should treat any sale of health-related data as needing consent first.

Colorado: a data-level exemption

The Colorado Privacy Act applies to a controller that conducts business in Colorado or targets products or services to its residents and that controls or processes personal data of 100,000 or more consumers in a calendar year, or gets revenue or a discount from selling personal data while processing data of 25,000 or more consumers (C.R.S. 6-1-1304(1)). The Colorado Attorney General’s page dates the law’s effect to July 1, 2023.

Section 6-1-1304(2) lists what the law does not apply to. It includes protected health information collected, stored and processed by a covered entity or its business associates, information a covered entity creates to comply with HIPAA, deidentified health information, and information maintained in the same manner by a covered entity, business associate, health care facility or health care provider. It does not exempt covered entities as such. As in California, data that falls outside those descriptions, such as website and ad data that is not handled as protected health information, can be covered when the practice meets a threshold.

Sensitive data: health information outside HIPAA needs consent

Each of these laws treats health information as sensitive when it is covered at all. Virginia defines sensitive data to include personal data revealing a “mental or physical health diagnosis” (Va. Code 59.1-575), Texas uses the same words (Tex. Bus. and Com. Code 541.001), and Colorado’s definition covers a “mental or physical health condition or diagnosis” (C.R.S. 6-1-1303).

In Virginia, Texas and Colorado, a controller may not process sensitive data without the consumer’s consent (Va. Code 59.1-578(A)(5), Tex. Bus. and Com. Code 541.101(b)(4), C.R.S. 6-1-1308(7)). For a health business that is not exempt, that reaches a symptom quiz, an intake form that is not handled as protected health information, or a contact form that asks about a condition.

California works differently. Its definition of sensitive personal information in 1798.140(ae) includes personal information collected and analyzed concerning a consumer’s health. Section 1798.121 gives consumers a right to limit its use to what is needed to provide the service they asked for, and 1798.135(a) requires a “Limit the Use of My Sensitive Personal Information” link when a business uses it for other purposes.

Washington, Nevada and Connecticut also have laws written for consumer health data, with their own consent rules. Those are covered in our Washington guide and our Nevada and Connecticut guide.

Targeted ads and opt-out rights

Each of the four laws lets consumers opt out of their data being used for targeted advertising or sold. Virginia (59.1-577(A)(5)) and Texas (541.051(b)(5)) give a right to opt out of processing for targeted advertising, the sale of personal data, and certain profiling. Colorado has the same set of rights in 6-1-1306. California gives a right to opt out of the sale or sharing of personal information (1798.120), and 1798.135(a) requires a “Do Not Sell or Share My Personal Information” link on the homepage of a business that sells or shares, unless it uses the alternative described below.

Virginia’s definition of targeted advertising (59.1-575) covers ads selected from activity “over time and across nonaffiliated websites or online applications,” and excludes ads based on activity within the controller’s own sites, ads based on the context of a current search or visit, and ads sent in response to the consumer’s request. Retargeting ads built from data shared with an ad platform are the kind of activity these opt-out rights are written for. Search ads shown against a keyword, without a visitor profile, are contextual.

Universal opt-out signals

A universal opt-out signal is a setting in a browser or extension that tells each website the visitor wants to opt out. Three of the four states treat it as a real request.

California: the CCPA regulations effective January 1, 2026 (11 CCR 7025) say a business that sells or shares personal information shall process an opt-out preference signal that meets the regulation’s requirements as a valid request to opt out of sale and sharing for that browser or device, and for the consumer if known. The regulation gives an HTTP header field or JavaScript object as examples of the format.
Colorado: under 6-1-1306(1)(a)(IV)(B), effective July 1, 2024, a controller that processes personal data for targeted advertising or sale shall let consumers opt out through a user-selected universal opt-out mechanism that meets the Attorney General’s technical specifications. The Attorney General publishes a list of recognized mechanisms under 4 CCR 904-3, Rule 5.07.
Texas: 541.055(e), effective January 1, 2025, lets a consumer designate an authorized agent through a browser setting, extension or global device setting to opt out, and requires the controller to comply, subject to listed conditions such as being able to verify that the consumer is a Texas resident.
Virginia: the sections read for this guide do not contain a universal opt-out signal requirement.

In practice, this means a site with ad tags should be able to detect a recognized signal and stop sending that visitor’s data for targeted ads. A cookie banner alone does not answer the signal question. Our cookie consent banner guide covers how banners fit in.

Questions to take to your attorney

Is our business a HIPAA covered entity under 45 CFR 160.103, and is each of our locations and brands part of that entity?
In which states do we see patients, offer telehealth or run ads, and which of those have a consumer privacy law in effect now or within the next year?
Do we meet any threshold, counting website visitors, ad audiences and list contacts, not only patients?
Which of our website and ad data is handled as protected health information, and which is not?
Does any form, quiz or chat on our site collect health information that is not protected health information, and do we get consent before collecting it?
Do our ad tags count as selling or sharing under California law, or targeted advertising under the other states, and do we offer the required opt-out?
Does our site detect and honor universal opt-out signals in the states that require it?
Does our website privacy policy describe what we collect and how to opt out, separately from our Notice of Privacy Practices?

Use and avoid

Use: “We use ad tags on pages that do not ask about your health. You can opt out of targeted ads here.” Avoid: “Your data is fully protected under HIPAA,” when the data in question is website visitor data.
Use: “State privacy laws give you rights over your personal information. Here is how to make a request.” Avoid: “State privacy laws do not apply to medical practices.”
Use: a privacy policy that names the categories of data collected through the website and ads. Avoid: pointing visitors to the Notice of Privacy Practices as the only privacy document.
Use: a consent step before a symptom quiz collects answers, if your attorney says a sensitive data rule applies. Avoid: collecting health answers first and asking for consent later.

An illustration

This example is invented. [Practice name] is a dermatology group with offices in Colorado and Texas. It bills insurance electronically, so it is a HIPAA covered entity. It also runs a cash-pay aesthetics brand under a separate company with its own website and ad account, and that company never bills insurance.

Its attorney maps the pieces. In Texas, the covered entity practice is outside the state law under 541.002(b)(3), while the aesthetics company is not a covered entity and is checked against the small business rule. In Colorado, the covered entity practice’s patient data handled under HIPAA is exempt, but its website retargeting data is not handled as protected health information, so the attorney counts consumers against the Colorado thresholds. The aesthetics company has its own count.

The result: the practice keeps ad tags off pages about medical conditions, which its HIPAA review already required, sets the remaining tags to stop for visitors whose browser sends a recognized opt-out signal, adds a website privacy policy with an opt-out method, and asks Dr. [Name] to approve a consent step before the aesthetics quiz.

Checklist

Confirm whether each business entity is a HIPAA covered entity under 45 CFR 160.103.
List the states where you see patients, offer telehealth or run ads.
For each state, note whether the HIPAA exemption is entity-level or data-level.
Count consumers against each threshold, including website and ad data.
Separate data handled as protected health information from website and ad data that is not.
Get consent before collecting health information that a sensitive data rule covers.
Offer an opt-out from targeted ads, and the California links if you sell or share.
Honor recognized universal opt-out signals where required.
Update the website privacy policy, and recheck when you add a state.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. On the privacy side of a website, that means keeping ad tags off pages about conditions, setting tags to respect opt-out signals, and writing forms that ask only for what the visit needs, with your attorney deciding how each state law applies. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Does the CCPA apply to medical practices?

It can. California exempts medical information and protected health information, and exempts a provider or covered entity only to the extent it maintains patient information in the same manner as that information. A practice that meets a CCPA threshold can still be covered for data that is not patient information, such as website visitor and ad data.

What is the difference between an entity-level and a data-level HIPAA exemption?

An entity-level exemption takes a HIPAA covered entity or business associate out of the law entirely, as in Virginia and Texas. A data-level exemption covers only protected health information and similar data, as in California and Colorado, so other data the practice collects can still be covered.

Is a med spa exempt from state privacy laws because of HIPAA?

Not unless it is a HIPAA covered entity or business associate. Under 45 CFR 160.103, a provider is a covered entity if it transmits health information electronically in connection with a standard transaction such as billing insurance. A cash-only med spa may not be one, and then the state law’s thresholds decide.

Do we have to honor Global Privacy Control or other browser opt-out signals?

In California, a business that sells or shares personal information must treat a valid opt-out preference signal as an opt-out request under 11 CCR 7025. Colorado requires controllers that do targeted advertising or sell data to honor recognized universal opt-out mechanisms from July 1, 2024. Texas has a similar rule in 541.055(e) from January 1, 2025.

Do retargeting ads count as targeted advertising?

Retargeting built from visitor activity shared with an ad platform fits the definitions in these laws, and California treats it as sharing for cross-context behavioral advertising. Ads based on the context of a current search or visit are excluded from Virginia’s definition. Ask counsel how each of your ad setups is classified.

State consumer privacy laws and medical practices: where the HIPAA exemption stops