Tracking pixels on healthcare websites: what still applies after the 2024 ruling

In late 2022 the HHS Office for Civil Rights (OCR) published a bulletin on tracking technologies: the pixels, tags and scripts that send data about website visitors to companies such as Google and Meta. It said HIPAA could apply even on public pages, and many hospitals and practices removed advertising pixels as a result. OCR revised the bulletin in March 2024, and in June 2024 a federal court struck down part of it. This is what changed, what did not, and what to check on your own site.

What the court decided

In American Hospital Association v. Becerra, the U.S. District Court for the Northern District of Texas ruled on June 20, 2024 that part of the bulletin was unlawful. That part, which the court called the “Proscribed Combination”, treated a visitor’s IP address combined with a visit to a public page about a health condition or provider as protected health information. The court vacated it. HHS filed an appeal in August 2024 and withdrew it days later, so the ruling stands.

What still applies

The ruling covered one scenario: public pages that anyone can read without logging in or entering health information. The rest of OCR’s guidance was not vacated, and HIPAA itself has not changed.

• Patient portals and other pages behind a login. OCR’s guidance says tracking on user-authenticated pages generally has access to protected health information. Google, for example, tells HIPAA-covered customers not to place Google Analytics tags on authenticated pages.
• Booking, intake and symptom-checker pages. OCR’s guidance says tracking on a public page that lets people “schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances.”
• Business associate agreements. A vendor that receives protected health information on your behalf needs one. Google says it does not offer business associate agreements for Google Analytics, and most advertising platforms do not sign them either.
• Laws beyond HIPAA. Washington’s My Health My Data Act covers consumer health data held by many businesses that HIPAA does not reach, and the FTC has acted against companies that shared health data with advertising platforms, including GoodRx and BetterHelp in 2023.

A checklist for your site

1. Inventory every tag. List every script on the site, including those loaded through Google Tag Manager, and what data each one sends. Your browser’s developer tools or a tag audit tool will show the outgoing requests.
2. Map pages by risk. Separate public information pages from portals, booking flows, forms and confirmation pages.
3. Remove advertising pixels from high-risk pages. Keep Meta, TikTok and similar pixels off portals, booking pages and form pages entirely.
4. Check URLs and page titles. An address such as /appointments/confirm?service=oncology can carry health information into every tool on the page.
5. Count conversions without health details. Record that a booking happened without passing the service, condition or form contents. Server-side tagging can strip fields before anything leaves your control.
6. Put agreements in place. Use vendors that sign business associate agreements wherever patient data is involved, and keep the agreements on file.
7. Tell visitors. Describe the tools you use in your privacy notice, and give visitors a way to opt out where the law requires it.
8. Review after every change. A new plugin, form or chat widget can add tracking without anyone noticing.

What this means for your marketing

None of this stops a practice from measuring its marketing. You can still see which pages bring in appointments, which campaigns work and what each new patient costs. The difference is where the measurement happens: on public pages and in aggregate, without sending patient details to advertising platforms.

This article is general information, not legal advice. Your compliance officer or healthcare attorney should review how these rules apply to your organization.