Tracking Pixels and Patient Privacy on a Practice Website

Tracking pixels and other analytics and advertising tools send information about website visitors to outside companies. On a healthcare website, some of that information can be protected health information. Federal guidance, updated after a 2024 court ruling, draws the line mainly at pages where a visitor identifies themselves or shares health details, such as appointment forms and patient portals.

This article summarizes published guidance. It is not legal advice, and state privacy laws may add further requirements.

In this article

• What HHS guidance says
• What the 2024 court ruling changed
• Where a typical orthodontic website is exposed
• Practical steps for tracking pixels
• Does this mean you cannot measure marketing?
• Questions for your website or marketing vendor
• The tools that track, and what they send
• How to find out what is running on your site
• A page-by-page tracking map
• Questions to settle with your privacy counsel
• Measuring marketing with less exposure
• An illustrative example
• Common mistakes
• Frequently asked questions
• What to ask each vendor
• A yearly routine
• Privacy as part of trust

What HHS guidance says

The U.S. Department of Health and Human Services publishes guidance on online tracking technologies for organizations covered by HIPAA. In summary:

• Pages behind a login, such as a patient portal, generally give tracking technologies access to protected health information. They must be configured so that information is used and disclosed only as the Privacy Rule permits.
• Public pages often do not involve protected health information, so the rules often do not apply.
• The exception is a public page that collects identifiable health information, for example when a visitor types an email address or reason for care into an appointment form.
• Vendors that receive protected health information need a signed business associate agreement, and a permitted purpose, before any disclosure.
• Cookie banners do not count as a valid HIPAA authorization.

What the 2024 court ruling changed

On June 20, 2024, a federal district court in Texas, in a case brought by the American Hospital Association, declared one part of the guidance unlawful and vacated it. That part had said HIPAA obligations were triggered when a tracking tool connected a visitor’s IP address with a visit to a public page about specific health conditions or providers.

The rest of the guidance remains published. The practical effect is that a simple visit to a public treatment page is treated differently from submitting a form with personal and health details.

Where a typical orthodontic website is exposed

Page	Risk level	Why
Home and treatment pages	Lower	Public, no personal details entered
Consultation request form	Higher	Name, contact details and reason for visit
Form confirmation page	Higher	Its address can reveal that a request was made
Online scheduling tool	Higher	Personal and appointment information
Patient portal	Highest	Authenticated; treatment and billing data

Practical steps for tracking pixels

1. List every tracking tool on the site: analytics, advertising pixels, chat widgets, session recorders, embedded maps and video.
2. Note which pages each one loads on.
3. Remove advertising pixels and session recorders from forms, confirmation pages, scheduling and the portal unless the vendor has signed a business associate agreement and the use is permitted.
4. Check what your form tool and scheduling vendor do with submitted data, and whether they will sign an agreement.
5. Track conversions in a way that does not send the visitor’s details to an advertising platform.
6. Write down what you decided and review it yearly.

Does this mean you cannot measure marketing?

No. You can still count calls and form submissions and see which channel they came from. The care is in how the count is made and what data leaves the site. A setup that records “a consultation form was submitted from a Google Ads visit” is very different from one that sends the patient’s email address to an ad network.

Questions for your website or marketing vendor

• Which tracking tools are installed, and on which pages?
• Do any of them load on forms or the scheduling page?
• Which vendors receive form data, and have they signed a business associate agreement?
• How are conversions reported to advertising platforms?

We review tracking on every site we audit and flag anything that needs a decision from the practice. See our SEO audit, or read what to set up before spending on Google Ads.

The tools that track, and what they send

“Tracking pixels” is shorthand for a family of tools. Each one loads code from another company, and each can send information about the visit to that company.

Tool	What it is for	What it may send
Website analytics	Counting visits and where they came from	Pages viewed, device, approximate location, IP address
Advertising pixels	Measuring ads and building audiences	Pages viewed, actions taken, identifiers that link to an ad account
Session recorders and heatmaps	Watching how visitors use a page	Mouse movement, clicks and sometimes what is typed into forms
Chat widgets	Answering questions	Anything the visitor types
Embedded video and maps	Showing content from another site	That the visitor loaded the page
Scheduling and form tools	Taking appointment requests	Name, contact details and reason for the visit
Call tracking	Attributing phone calls to a source	Caller number and call details

None of these is wrong in itself. The question on a healthcare website is which pages they run on and whether the information they collect there is protected.

How to find out what is running on your site

Many practices do not know which tools are installed, because they were added over the years by different people. Three steps give you a full list.

1. Ask your web provider for a written list of every script, pixel and plugin that sends data to a third party, and the pages each one loads on.
2. If the site uses a tag manager, ask for an export of everything in it.
3. Open the site in a browser with its privacy or developer tools switched on and note which outside companies are contacted on the home page, a treatment page, the consultation form and the confirmation page.

Compare the three. Tools nobody can explain are common. If nobody uses the data a tool collects, remove it.

A page-by-page tracking map

Write the result down in a simple table. It becomes the document you review each year and show to anyone who asks.

Page	Tools loading	Personal or health details entered?	Decision
Home		No
Treatment pages		No
Consultation request form		Yes
Form confirmation page		Implied by reaching the page
Online scheduling		Yes
Patient portal		Yes

The “decision” column records what you chose to do and why: keep, remove, restrict to certain pages or replace with a vendor that will sign an agreement. A dated record of careful decisions is worth having.

Questions to settle with your privacy counsel

The guidance leaves room for judgment, and state laws add their own requirements. Take these questions to someone qualified to answer them for your practice.

• Which pages on our site collect information that is protected under HIPAA?
• Which of our vendors receive that information, and do we have a business associate agreement with each one?
• Is each disclosure permitted, or does it need the patient’s authorization?
• Do any state privacy or health data laws apply to our website in addition to HIPAA?
• Does our privacy policy describe what the site actually does?
• What is our procedure if we find that information was shared when it should not have been?

A marketing provider can tell you what is installed and how it behaves. Whether a particular use is lawful is a question for counsel.

Measuring marketing with less exposure

It is possible to know what your marketing produces without sending patient details to advertising companies. The principle is to count events, not people.

Goal	Higher-exposure way	Lower-exposure way
Know how many forms were submitted	An advertising pixel on the form and confirmation page	Count submissions in your own form tool and record the source of the visit
Know which ads produce calls	Sharing caller details with the ad platform	Call tracking from a vendor that will sign an agreement, reporting totals by campaign
Understand how visitors use the site	Session recording on every page, including forms	Analytics on public pages only, with recording excluded from forms
Build audiences for ads	Lists based on visits to treatment or form pages	Advertising by search term and location instead

A setup that records “one consultation form was submitted by a visitor who arrived from a Google ad” tells you what you need. One that sends the visitor’s email address, or the fact that they asked about a specific treatment, to an ad network tells that network far more, and may not be permitted.

Lower exposure usually costs some precision. Most practices can accept that, because the decisions they need to make, such as which channel to fund next quarter, do not depend on tracking individuals. See measuring orthodontic marketing.

An illustrative example

The example is invented. It shows the kind of review described above.

A practice asks its web provider for a list of tools. The answer includes an analytics tag on every page, two advertising pixels added during a campaign three years ago, a session recorder nobody remembers installing, an embedded video on the home page and a chat widget. The advertising pixels and the recorder load on every page, including the consultation form and its confirmation page.

After discussion with counsel, the practice removes the session recorder entirely, takes the advertising pixels off the form and confirmation pages, keeps analytics on public pages, and asks the chat vendor whether it will sign a business associate agreement. The answer is no, so the chat is replaced with a clear phone number and a short form. Conversions are now counted from the form tool’s own records. The practice writes the decisions down and sets a reminder to repeat the review in a year.

Nothing dramatic happened. A list was made, decisions were taken by the right people and the result was recorded.

Common mistakes

• Assuming the cookie banner solves it. The HHS guidance says a banner does not amount to a valid HIPAA authorization.
• Leaving old campaign pixels in place. Tools outlive the campaigns they were installed for.
• Recording form fields. Session recorders can capture what visitors type unless they are set not to.
• Confirmation pages with telling addresses. An address that says a consultation request was completed reveals the action to every tool on that page.
• Chat tools that store conversations with a vendor who has signed nothing. Parents describe health concerns in chat.
• Believing the ruling removed all obligations. The 2024 court decision vacated one part of the guidance. The rest remains published.
• Leaving it to the agency. The practice is responsible for its own website.

Frequently asked questions

Are tracking pixels illegal on a practice website?

Not in themselves. The question is what information they receive, on which pages, and whether that disclosure is permitted. Public pages where no personal or health details are entered are treated differently from forms, scheduling tools and portals.

Can we still use analytics?

Analytics on public pages is common. Talk to counsel about forms, confirmation pages and anything behind a login, and about whether your analytics vendor will sign an agreement where one is needed.

Do we have to stop advertising?

No. You can advertise and measure results. The care lies in how conversions are counted and what data leaves the site. See what to set up before you spend on Google Ads.

What is a business associate agreement?

A contract required under HIPAA when a vendor handles protected health information on a practice’s behalf. The guidance says vendors that receive such information need one, along with a permitted purpose, before any disclosure.

Did the 2024 court ruling make this guidance irrelevant?

No. It vacated the part concerning a visitor’s IP address combined with a visit to a public page about health conditions or providers. The rest of the guidance remains published.

Do state laws matter?

Yes. Several states have their own privacy or health data laws, and they can apply in addition to HIPAA. Ask counsel which apply to you.

How often should we review tracking?

Once a year, and whenever a tool, a campaign or a vendor changes.

Who should carry out the review?

Your web or marketing provider can produce the list of tools and where they load. The decisions belong to the practice, with advice from privacy counsel. We flag tracking on every site we review as part of our SEO audit.

What to ask each vendor

Before a tool is added to the website, and once a year for the tools already there, put the same questions to the company that provides it.

1. What information does your tool collect from our visitors, and on which pages?
2. Where is it stored, and who can see it?
3. Do you use it for your own purposes, such as advertising or product improvement?
4. Can the tool be limited to certain pages and kept off forms?
5. Will you sign a business associate agreement if the information is protected?
6. What happens to the data if we stop using the tool?

A vendor that cannot answer plainly is telling you something. Keep the replies with your tracking map.

A yearly routine

Tracking is not a project to finish. Websites change, campaigns start and stop, and tools are added in a hurry. A short annual routine keeps the picture accurate.

Step	Who	Time
Ask the web provider for the current list of tools and where each loads	Practice manager	A short email
Compare the list with last year’s map and note what changed	Practice manager	Thirty minutes
Remove anything nobody uses	Web provider	An hour
Review forms, confirmation pages and scheduling with counsel if anything changed	Doctor and counsel	As needed
Update the privacy policy so that it matches what the site does	Counsel	As needed
Record the date and the decisions	Practice manager	Ten minutes

Most years the review is quick, because little has changed. The value lies in knowing that, and in being able to show that tracking pixels and other tools on the site were chosen deliberately instead of accumulating unnoticed.

Privacy as part of trust

Parents share a good deal with an orthodontic practice: their child’s name, health history and financial details. Most never think about what the website does with a consultation request, and they should not have to. A practice that has looked carefully at its own tracking can say with confidence that a request for an appointment goes to the practice and nowhere else it should not. That is worth more than a slightly more detailed advertising report.