Somewhere in the code of your practice website there is a script nobody on staff remembers approving. A marketing agency added it in 2021 to measure ad campaigns. It fires on every page, including the appointment request form, and it reports what it sees to an advertising company that has never heard of your practice and has certainly not signed anything with it.
That script is a tracking pixel, and the question of what it may collect has been litigated. The HHS Office for Civil Rights published a bulletin on online tracking technologies in December 2022, revised it on March 18, 2024, and lost part of it in federal court on June 20, 2024. Plenty of vendors will tell you the ruling means the problem went away. It did not. This post walks through what the regulation itself says, what the court actually vacated, where pixels remain a straightforward violation, and what to write into policy.
HIPAA Tracking Pixels: The Rule Under the Bulletin
1. Start With the Definition, Not the Guidance
The bulletin never created the obligation. The definitions in 45 CFR 160.103 did. Individually identifiable health information is information that "relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual" and that "identifies the individual" or provides "a reasonable basis to believe the information can be used to identify the individual." P.H.I. (Protected Health Information) is that information "transmitted or maintained in any other form or medium," which includes a browser request.
Under 45 CFR 164.502(a), a covered entity "may not use or disclose protected health information, except as permitted or required" by the Privacy Rule. A pixel that sends a patient's name, email, appointment type, and the page they were on to an ad network is a disclosure. The only question is whether the data it sends meets the definition above. On some pages it plainly does. On others, the court said, the government overreached.
2. What the Court Vacated, in the Court's Words
In American Hospital Association v. Becerra (N.D. Tex., No. 4:23-cv-01110), the court examined one specific position in the bulletin, which it labeled the "Proscribed Combination": the idea that connecting "(1) an individual's IP address with (2) a visit to a UPW addressing specific health conditions or healthcare providers" creates individually identifiable health information. A UPW is an unauthenticated public webpage, meaning a page anyone can view without logging in.
The court declared "that the Proscribed Combination, as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL, as it was promulgated in clear excess of HHS's authority under HIPAA," and ordered it vacated. Two details matter for a small practice. First, the court denied a permanent injunction and granted vacatur only, so the ruling erased that one position rather than telling HHS what to do next. Second, the order's own footnote states that the vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." The rest of the bulletin was not before the court and was not struck.
The practical translation: an IP address plus a visit to your public "Sleep Apnea Treatment" page is not, by itself, P.H.I. under that ruling. Everything past the login screen, and everything a form collects, was never part of the fight.
3. Where Pixels Are Still a Disclosure
Sort your pages into three buckets. The first bucket is authenticated pages: the patient portal, the telehealth waiting room, the bill-pay screen, the results viewer. Anyone on those pages is a known patient, and the URL, the page title, and the form fields describe their care. A tracking script there transmits P.H.I. to whoever operates the script. That vendor is receiving P.H.I. on your behalf, which under 45 CFR 160.103 is the definition of a business associate, and 164.502(e)(2) requires "a written contract or other written agreement" before that disclosure happens, in practice a B.A.A. (Business Associate Agreement).
The second bucket is unauthenticated pages that still collect identity: the appointment request form, the new patient registration form, the "request a callback" widget, the online intake. A visitor who types a name, a phone number, and a request for a colonoscopy consult has handed you P.H.I. A pixel configured to capture form fields, button text, or the URL of the thank-you page ("/thank-you-mammogram-request") sends it out the door. The court's ruling does not touch this bucket, because the identifiers are not inferred from an IP address; the patient typed them.
The third bucket is the public brochure site: the home page, the services pages, the blog. This is where the vacated position lived. Analytics on these pages is the lowest-risk use, provided the script is not also loaded on the first two buckets and is not configured to capture anything a visitor submits.
| Page type | What a pixel typically captures | HIPAA status |
|---|---|---|
| Patient portal, telehealth, bill pay (login required) | URL, page title, user ID, clicks, sometimes form fields | P.H.I. disclosed to the script vendor; B.A.A. required or remove the script |
| Appointment, registration, intake, callback forms (no login) | Form fields, button text, thank-you URL, email or phone if captured | P.H.I. once identity plus a health purpose is present; treat as bucket one |
| Public condition and service pages | IP address, page visited, device, referrer | The court vacated the position that this alone is P.H.I.; lowest risk, still configure carefully |
| Email and text links with patient-specific codes | Click identity tied to a patient list | P.H.I.; the list came from your records |
4. The Marketing Problem on Top of the Privacy Problem
Retargeting is the reason most pixels exist: a person visits the page, the ad network follows them across the internet with your ad. When the person is a known patient, that is a use of P.H.I. for marketing. 45 CFR 164.501 defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service," and 164.508(a)(3) requires "an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions for face-to-face communications and gifts of nominal value. No patient has signed an authorization letting an ad platform build an audience from the portal login page. The authorization form itself is covered in the HIPAA authorization requirements guide.
Separate from HIPAA, the Federal Trade Commission has pursued health companies over the same pixels under its own authority, and the enforcement side of that story is covered in the marketing agencies post. The vacatur did not reach the FTC.
5. What Happens If the Pixel Was Already Sending P.H.I.
Under 45 CFR 164.402, an impermissible disclosure "is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised," based on a four-factor risk assessment. Years of portal traffic sent to an ad network is not a small event. It is a documented breach risk assessment, likely notification, and a data request from OCR for the script inventory you did not have. The notification mechanics are in the Breach Notification Rule guide. Removing the script is the fix going forward; the risk assessment covers what already left.
6. The Audit: One Afternoon With a Browser
You do not need a consultant to find the scripts. Open the site in a browser, open the developer tools, load the network tab, and visit each page type in the table above. Every request leaving the page to a domain you do not own is a script vendor. Do the same inside the portal with a test account. Then open the tag manager, if the agency installed one, because a tag manager is a door that lets anyone with the login add trackers later without touching the site.
- Inventory: every third-party script, the pages it loads on, who installed it, and what it collects (page URL only, or form fields and clicks).
- Classify pages into the three buckets above and record which scripts fire on each.
- Remove every script from authenticated pages and form pages unless the vendor has signed a B.A.A. that covers this exact data flow. The contract terms are in the BAA guide.
- Configure what stays: no form-field capture, no conversion tracking fed with patient email, no URL parameters that carry appointment types, IP handling set to the most restrictive option the tool offers.
- Lock the tag manager to two named people and log every change.
- Record it in the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A). Website data flows are part of "the potential risks and vulnerabilities" to ePHI that the analysis must cover.
7. What to Write Into Policy
The website policy fits on one page. It names the person who approves any script, states that no third-party code loads on authenticated pages or on pages with forms unless a B.A.A. is on file, requires the script inventory to be reviewed at least annually and at every site redesign, and directs the marketing agency to work inside those limits. If an agency runs your site or ads, it is a business associate itself and needs its own agreement; the broader website obligations are in the HIPAA-compliant website guide. The 18 identifiers list is a useful training handout here, because IP addresses and URLs are both on it.
One last point about the bulletin. The court removed one position from a guidance document that, in the court's description, "do[es] not have the force and effect of law." The Privacy Rule was never the thing on trial. A pixel on the portal was a disclosure before December 2022, and it is a disclosure today.
---
FAQ
Are Google Analytics or Meta Pixel a HIPAA violation on a medical website?
Not automatically. On public pages with no login and no forms, the June 2024 ruling vacated the position that an IP address plus the page visited is P.H.I. On patient portals and on any page that collects a name, contact detail, or health purpose, the same script transmits P.H.I. and needs a business associate agreement or removal.
Did the court throw out the OCR tracking bulletin?
Only one part. The court declared unlawful and vacated the "Proscribed Combination" in the March 18, 2024 bulletin (IP address plus a visit to a public health-related page), and its order states that the vacatur does not limit the rest of the document.
Do we need a BAA with our analytics vendor?
If the vendor's script receives P.H.I., which means anything from an authenticated page or an identifying form, yes, under 45 CFR 164.502(e). If the vendor will not sign one, the script cannot run on those pages.
Is retargeting patients with ads allowed under HIPAA?
Using P.H.I. to build an advertising audience is marketing as defined in 45 CFR 164.501, and 164.508(a)(3) requires a signed authorization for marketing uses, apart from face-to-face communications and gifts of nominal value.
What if the pixel has been on our portal for years?
Treat it as a potential breach. Run and document the four-factor risk assessment under 45 CFR 164.402, notify if the presumption of breach cannot be rebutted, and remove the script from every authenticated and form page.
Conclusion
A script inventory and a one-page website policy take an afternoon, and they close a gap that shows up in the first data request after a complaint. One Guy Consulting's Full-Scope plan includes the website and vendor review, the policy template, and consulting time to walk through your tag manager with whoever runs your marketing. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 160.103 (definitions: individually identifiable health information, protected health information, business associate)
- 45 CFR 164.502 (uses and disclosures: general rules)
- 45 CFR 164.501 (definitions: marketing)
- 45 CFR 164.508 (authorization required for marketing)
- 45 CFR 164.402 (breach definition and presumption)
- 45 CFR 164.308 (risk analysis)
- American Hospital Association v. Becerra, No. 4:23-cv-01110 (N.D. Tex. June 20, 2024), Opinion and Order (GovInfo)
- HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
Related Reading