Can we use tracking pixels like Meta or Google Analytics on our site without violating HIPAA?

Short answer: A sitewide tracker is not a safe default. Google says it makes no representation that Google Analytics satisfies HIPAA and does not offer a business associate agreement for Analytics. Whether any other flow is permissible depends on the company, page, data, recipient, contract, and use. Privacy counsel should review the actual implementation, not the product label.

“HIPAA-safe pixel” is the wrong unit of analysis

A pixel is a delivery mechanism. The risk lives in the data flow: what leaves the browser or app, what context travels with it, who receives it, what that recipient is allowed to do with it, and how the data will be used later.

A pageview can carry a URL, page title, referrer, IP address, device or advertising identifier, and campaign parameters. An event can add a button label, appointment status, form value, or user identifier. A seemingly generic conversion such as appointment_complete becomes much more revealing when it is paired with an identifiable visitor, a specialty-specific URL, or intake data. Moving the same event through a server-side container changes the route; it does not automatically change the disclosure.

Before assigning the cleanup, use the agency readiness audit to see whether tracking ownership, clinical review, and approvals are clear enough to brief outside help. The promise a patient sees and the data sent behind the page need to agree.

Start with the entity, page, and data flow

If the operator is a HIPAA-covered entity or business associate, map every field and recipient before choosing a tag. Ask counsel whether the flow discloses PHI, what permission is required, whether minimum-necessary rules apply, and whether the vendor and product can operate under the required contract. Google Analytics is a clear example of why the product matters: Google does not offer a BAA for Analytics.

A contract alone is not a hall pass. The review has to match the vendor's real service, downstream use, safeguards, and the exact information sent.

Public pages need a careful read because of a court-imposed limit on federal guidance. On June 20, 2024, a federal court vacated the government's "Proscribed Combination": an individual's IP address combined with a visit to an unauthenticated public page about a condition or provider. But the opinion separately says a page that asks the visitor's subjective motive for visiting "would be one thing." That is why a general information page and a reason-for-visit form should not be treated as the same data flow.

If HIPAA does not apply to your company or product

“Not covered by HIPAA” does not mean “unregulated.” The FTC's consumer-health data guidance says the FTC Act applies to HIPAA-covered entities and business associates as well as companies outside HIPAA. It also identifies behind-the-scenes tracking that shares sensitive health data against a company's privacy promises as an FTC Act violation. Certain non-HIPAA health apps, websites, and connected products may also be covered by the Health Breach Notification Rule.

Under the FTC's current Health Breach Notification Rule guidance, an unauthorized disclosure by the company itself, not only a hack, can trigger notice duties. Affected people must be notified without unreasonable delay and within 60 calendar days. A breach involving 500 people or more requires notice to the FTC at the same time as notice to affected people, also no later than 60 days after discovery.

The numbers turn an abstract privacy review into an operating risk. The FTC's GoodRx action carried a $1.5 million civil penalty and noted that more than 55 million consumers had visited or used GoodRx's site or apps since January 2017. The FTC's final BetterHelp order required $7.8 million in payments and banned sharing health data for advertising and personal information for retargeting. These cases show why email addresses, IP addresses, questionnaire data, and advertising use cannot be reviewed in separate silos.

State law may add obligations as well. Your review therefore needs the states tied to your patients and users, not just a federal HIPAA checkbox.

Treat consent and authorization as separate questions

A banner records a browser choice. Whether a particular disclosure requires a separate legal authorization is a different question. Do not treat a banner, privacy policy, or terms notice as the complete analysis; have counsel identify what permission the exact data flow requires.

The practical distinction is simple: consent-interface configuration and legal authorization are separate workstreams. Neither should be assumed to repair data that was already sent.

What to do before you turn tracking back on

This is strategic guidance, not legal advice; have privacy counsel validate the implementation and state-specific exposure. Until that review is complete, pause third-party advertising and analytics tags on the highest-risk surfaces, including authenticated areas, intake, scheduling, patient messaging, payment, and portal pages.

Treat the cleanup as one part of the paid-ads preflight, where the claim, landing page, measurement plan, and patient handoff are reviewed together.

Build a data-flow inventory. List every pixel, analytics tag, tag manager, software development kit, chat widget, scheduler, session-replay tool, advertising API, and server-side destination. For each one, record the exact fields sent, trigger, page, recipient, subprocessors, retention period, permitted reuse, and deletion path. Inspect live network requests; a configuration spreadsheet is not proof of what the browser sends.
Classify pages and events, not just domains. Separate general corporate pages from care-related public pages, intake and appointment flows, authenticated portals, and apps. Then classify every event and parameter on those surfaces. A generic event name does not neutralize a revealing URL, query string, form field, device identifier, or account link.
Map the legal lane for each flow. Confirm whether each operating entity is a HIPAA covered entity, a business associate, a non-HIPAA consumer health product, or more than one of those in different contexts. Add FTC and state-law review. Do not assume the legal status of the parent company answers the question for every product, clinic, app, and vendor relationship.
Review the vendor, product, and contract together. Ask whether the vendor will receive PHI, whether it is willing and able to act as a business associate for that specific service, and whether its product terms permit the proposed data. Google, for example, says Analytics has no BAA. If nobody owns this review internally, decide whether to hire a healthcare growth agency or build in-house before scaling.
Minimize before you optimize. Default-deny tags on high-risk surfaces. Remove form capture, user IDs, email addresses, free text, query strings, granular event names, and advertising features unless each field has a documented purpose and permission. Do not call data de-identified merely because it is hashed or routed through an intermediary; the FTC says hashes are not anonymous. Test the released configuration again after every tag, page, or consent-management change.

If a performance agency has told you that hashing the patient data makes it safe to send, that is a specific claim with a specific answer, and it is worth reading before the next call: why hashing does not make patient data anonymous, in the FTC's own words.

Replace risky user-level measurement and retargeting. Use aggregate first-party reporting in an appropriately governed environment, channel-specific landing pages or campaign codes, and aggregate counts of qualified inquiries or completed bookings. Consider time- or market-based incrementality tests when they can be run without exposing individual health behavior. For acquisition, contextual campaigns and platform-defined broad audiences avoid building lists from care-seeking behavior. Google lists health among its sensitive-interest categories and bars advertiser-curated audiences for those categories. Platform permission is not legal clearance, so validate the final design rather than treating any one alternative as universally safe. If an outside partner will manage campaigns, review what to settle before you hire an agency and make the data restrictions contractual before any tag deployment.
Make tag governance an operating process. Keep an approved-tag register, name an owner, require privacy review before new events launch, monitor unexpected network calls, and rerun the assessment when pages, vendors, consent tools, or campaign goals change. Treat this as an operating process, not a one-time marketing setup ticket.

Where is the line between measurement and prohibited retargeting?

From Pranay Parikh, MD:

The line gets crossed the moment an identifier attaches to a signal about what care someone wants. It is not one fixed event. It moves with your architecture. A condition-first company may cross it at the product page. A category site may cross it at the section click. A single-service telehealth brand may create health context at the ad click itself because the ad already names the condition.

Finding that line for your own architecture is the first thing to do, before anyone writes an ad.

Before you turn another tag back on, run the marketing triage quiz and choose the privacy-and-tracking path; the output should tell your marketing, engineering, privacy, and legal owners what needs review first. For the larger system around privacy, trust, positioning, and acquisition, continue through the Marketing Triage diagnostic.

One of five patterns. This is one of the five evidence-backed patterns in the public telehealth advertising record. See all five, with the enforcement language behind each one.

Frequently asked questions

Is the Meta Pixel HIPAA compliant?

No pixel is HIPAA compliant in the abstract. The answer depends on whether the implementation discloses PHI, whether the disclosure is permitted, the vendor's role and contract, and how the data is used. Technical acceptance by an advertising platform is not legal clearance.

Is Google Analytics HIPAA compliant?

Google says it does not offer a BAA for Google Analytics and that HIPAA-regulated entities must not expose PHI to Analytics. Google advises those entities not to place Analytics tags on authenticated pages and to use Analytics only on pages determined not to be HIPAA-covered.

Does a cookie banner make pixels HIPAA compliant?

A cookie banner records a browser choice; it is not the whole legal analysis. Have counsel determine what permission or authorization the exact flow requires rather than treating the banner as clearance.

Did the 2024 court ruling make pixels safe on public healthcare pages?

No. The court vacated one interpretation involving an IP address and a visit to an unauthenticated public page about a condition or provider. The same opinion separately discusses a page that asks a visitor's reason for visiting. It did not create blanket clearance for every healthcare data flow.

Can a non-HIPAA health app use health data for retargeting?

HIPAA may not govern that app, but the FTC Act, the FTC Health Breach Notification Rule, vendor policies, and state law may still apply. The FTC says an unauthorized disclosure by a covered health app can be a reportable breach even when the company, not an outside attacker, made the disclosure.

What can we measure if user-level retargeting is too risky?

Start with aggregate first-party funnel counts, campaign or landing-page codes, channel-level cost and qualified-inquiry reporting, and carefully designed incrementality tests. Use contextual or otherwise non-user-level acquisition where possible, and submit the exact data flow, not a product label, to privacy and legal review.