HIPAA and tracking pixels on medical websites: what to know in 2026

Tracking pixels and analytics tags from Meta, Google and other companies can send information about your website visitors to those companies. On a medical website, that information can be protected health information (PHI). As of October 2026, HIPAA still restricts tracking on patient portals, login pages and appointment flows, even though a 2024 court ruling narrowed federal guidance for public pages.

What is a tracking technology?

Tracking technology is the term HHS uses for a script or code on a website or mobile app that gathers information about users or their actions as they interact with it. Examples include cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts.

What does HHS guidance say about tracking on medical websites?

The HHS Office for Civil Rights (OCR) published a bulletin on online tracking technologies in December 2022 and revised it in March 2024. These parts still apply:

Tracking on pages that require a login, such as patient portals, generally has access to PHI. Those tools may only use or disclose data as HIPAA allows, which usually means the vendor must sign a business associate agreement (BAA).
Some public pages can involve PHI too: appointment scheduling and symptom-checker pages where visitors enter an email address or a reason for the visit, and login or registration pages.
Data collected by a practice’s mobile app is generally PHI.
A cookie banner is not a valid HIPAA authorization, and neither is a statement in your privacy policy.

What did the court vacate in AHA v. Becerra?

On June 20, 2024, the US District Court for the Northern District of Texas, in American Hospital Association v. Becerra, declared unlawful and vacated one part of the guidance: the position that connecting a visitor’s IP address with a visit to an unauthenticated public page about specific health conditions or providers was enough to make that information protected. HHS withdrew its appeal in August 2024.

The rest of the guidance still stands. HHS’s page notes the ruling and says the department is evaluating its next steps. In practice, you have more room on general public pages, such as a blog post about migraines. You do not have more room on patient portals, login pages or forms where people enter their own information.

Does the FTC regulate health data on websites too?

Yes, particularly for health apps, wellness brands and other businesses that HIPAA does not cover. Its recent actions show what it looks for:

In February 2023, in its first enforcement action under the Health Breach Notification Rule, the FTC said GoodRx shared users’ medication and health information with advertising platforms including Facebook and Google. GoodRx agreed to a $1.5 million civil penalty.
In March 2023, BetterHelp agreed to pay $7.8 million after the FTC alleged it had shared email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat and others for advertising, despite promising to limit how it used that data.
In April 2024, the FTC finalized changes to the Health Breach Notification Rule confirming that it covers health apps and similar technologies, and that an unauthorized disclosure, not only a hack, counts as a breach.

In July 2023, the FTC and HHS also sent a joint letter to about 130 hospital systems and telehealth providers warning them about the privacy risks of online tracking.

Which state laws apply to health data on websites?

Washington’s My Health My Data Act took effect on March 31, 2024 (June 30, 2024 for small businesses). It requires opt-in consent to collect consumer health data and separate consent to share it, and consumers can sue. Its exemption covers PHI handled under HIPAA rather than whole organizations, so website data from a HIPAA-covered practice that is not PHI may still fall under it.
Nevada’s SB 370 took effect the same day, with similar consent rules and a ban on geofencing within 1,750 feet of places that provide in-person health care. It excludes entities subject to HIPAA and has no private right of action, but it can reach health and wellness businesses that operate outside HIPAA.

Other states have added their own health data rules, so check the laws where your patients live.

What changed for health advertisers on Meta?

Since early 2025, Meta has limited the data it accepts from websites it places in a health and wellness category. Depending on the level assigned, Meta strips custom parameters and parts of URLs, blocks optimization for lower-funnel events such as purchases, or blocks event sharing entirely. Sending data through the Conversions API does not get around these limits, and Meta’s terms tell advertisers not to send health information. Check your pixel’s category in Events Manager before you plan campaigns around conversion tracking.

A tracking checklist for medical websites

Inventory every tag. List each pixel, analytics script, chat widget, session recording tool and embedded video on your site, what it collects and where it sends data. Include tags added by your website, booking and marketing vendors.
Remove ad pixels from sensitive areas: patient portals, login pages, appointment requests, intake forms and symptom checkers.
Use analytics a vendor will cover with a BAA. Google says it does not offer BAAs for Google Analytics and that its tags should not be placed on HIPAA-covered pages. HHS describes using a vendor under a BAA, such as a customer data platform, to de-identify data before it reaches vendors that won’t sign one. Server-side tagging can help, but it is not a loophole: if PHI reaches a vendor, HIPAA still applies.
Sign BAAs with every vendor that handles PHI, including scheduling, chat, call tracking, forms and email. Our email marketing guide covers the email side.
Add a consent banner for public pages. It can help with state consent rules, but it does not replace a HIPAA authorization.
Make your privacy policy match reality. The FTC’s BetterHelp case turned on a gap between what the company promised and what it did.
Review ad audiences and conversion tracking with your compliance advisor before launching campaigns.
Repeat the review every quarter, because plugins and vendor updates can add new tags.

Tracking is one part of a compliant website. Our guide to medical website must-haves for 2026 covers the rest.

This article is general information, not legal advice. Rules on tracking and health data are changing; review your website with your compliance advisor or attorney.

Related service: Website design

Not sure what your website is tracking?

Healthcare-compliant ads and analytics are part of our medical marketing service. Start with a free marketing diagnosis and we’ll show you where your website and campaigns stand.