HIPAA Online Tracking Technologies: Compliance Guide for Covered Entities and Business Associates

Tracking is HIPAA-compliant when any data a tracking technology collects that ties a person to a health condition, treatment, or payment is either (a) sent only to vendors under a signed BAA for permitted purposes, (b) disclosed under a valid written HIPAA authorization, or (c) de-identified before it leaves your control. A 2024 court ruling narrowed HIPAA’s reach on unauthenticated pages, but state wiretapping and federal ECPA claims still apply. Those, not OCR enforcement, are where healthcare settlements are paid.

In June 2024, a federal court struck down part of the HIPAA guidance that had scared hospitals off web analytics. Healthcare tracking settlements kept climbing anyway. If you run web or app analytics on a hospital site, patient portal, or health app, the legal ground under your tag manager is narrower in one place. Everywhere else, it is broader.

This raises some practical questions: What part of the guidance did the court actually remove? Why did the settlements keep coming? What can you still run? And how can you check what’s running on your pages?

This guide covers online tracking technologies such as pixels, tags, cookies, SDKs, and session replay. It does not cover HIPAA Security Rule audit logging or SIEM monitoring, as those are separate topics addressed by HHS Security Rule guidance.

What counts as “tracking technology” under HIPAA

OCR defines tracking technology by whether data leaves your control. Any script, pixel, cookie, SDK, or embed that collects user interactions on your website or mobile app and sends them to a third party is considered tracking technology, regardless of marketing intent.

This definition is broader than many expect. If you ask your team about trackers on your site, they might only mention Google Analytics or Meta Pixel. In reality, most mid-sized health system usually has a much longer list.

The online tracking technologies most healthcare sites run

Tracking technologies collect information and track users in various ways, many of which are not apparent to the users:

• Cookies: small files that remember a visitor; ad cookies tie it to an advertising ID.
• Analytics tags: GA4, and often a second platform nobody remembers commissioning.
• Tracking pixels/web beacons: One-pixel images or scripts that fire a page-visit event (plus URL, IP, and more) to third-party tracking technologies such as Meta, Google Ads, LinkedIn, TikTok, and programmatic retargeting.
• Session replay scripts: Tools that record keystrokes, clicks, and form entries, effectively videoing the visit.
• Chat and scheduling widgets: Third-party embeds that sit on high-intent pages by design.
• Call tracking: Dynamic number insertion, which ties a phone conversation to a browsing session.
• A/B testing and personalization: Often loaded through the same tag manager, often unreviewed.
• Fingerprinting scripts identify a browser using its configuration, such as fonts, screen size, extensions, and timezone, instead of cookies. These scripts still work even if cookies are deleted or private browsing is used, which is why they often lead to wiretapping claims. Visitors who try not to be tracked can still be tracked by these methods.
• Mobile app SDKs: Third-party code inside your app that pulls device IDs, ad IDs, and usage data off the phone.
• Advertising and device IDs: The identifiers (IDFA, GAID, hashed email) that connect a visit to a person.

Who do the HIPAA rules apply to

Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to covered entities (providers who bill electronically, health plans, clearinghouses) and to business associates, who are vendors that create, receive, maintain, or transmit Protected Health Information (PHI) on a covered entity’s behalf, under 45 CFR § 164.308(b). Subcontractors inherit the same duties. The definitions live at 45 CFR § 160.103. Hospital, telehealth company, billing insurance, or vendor touching either one’s patient data? Assume you’re in scope.

Now the part that catches people. A tracking technology vendor receiving PHI from your site becomes a business associate by function, whether or not anyone signed anything. Paperwork doesn’t create the relationship. The data flow does. What missing paperwork creates is an impermissible disclosure. 

When website or mobile app data becomes PHI, and when it doesn’t

Website data becomes PHI when an identifier is combined with information indicating the person sought or received care. Both halves are required. Page views alone aren’t PHI. An identifier attached to a page about a specific condition, a provider search, or an appointment request usually is.

The identifier is rarely a person’s name. Most often, it’s an IP address, cookie ID, or device ID. Even if you remove names from all form fields, you can still send a persistent identifier with every request.

Is an IP address PHI?

On its own, no. Combined with a page that reveals someone was seeking care, it can be.

That combination is what OCR’s bulletin addressed, and what the 2024 court ruling narrowed for unauthenticated pages. Behind a patient login, the answer gets simpler. Tracking inside an authenticated portal has access to PHI in essentially every case, and there’s no serious argument otherwise.

A worked example: one visitor, traced end to end

Take a single session on a health system website.

1. A visitor searches a symptom and lands on your condition page. The referrer string may carry the original query. Your analytics tag fires, transmitting the URL and IP address.
2. The URL is the disclosure. A path like /oncology/breast-cancer-screening states a diagnosis-adjacent interest in plain text. Query parameters make it worse. Campaign parameters, appointment IDs, and internal search terms all get appended, and all get transmitted.
3. They click “Find a doctor” and filter by specialty. That filter selection often fires as a tracked event, with the specialty as the event label.
4. They open an appointment request form. Form-field events, and sometimes field values, get captured by session replay and analytics alike. An identifier is now attached to an intent to receive a specific service.

At no point did the visitor type their name. By step four, a third party holds an identifier and care-seeking context.

The key point here is that most privacy failures are systemic, not just isolated mistakes. PHI leaks in web tracking often happen gradually during a session, through processes that no single team completely manages.

HIPAA tracking enforcement

Here’s how we got to this point: In June 2022, The Markup found the Meta Pixel on 33 of the top 100 U.S. hospital websites. The HHS Office for Civil Rights (OCR) responded with a tracking-technologies bulletin that December. In 2023, the FTC took action against GoodRx and BetterHelp, and together with the U.S. Department of Health and Human Services (HHS), warned about 130 hospital systems. The AHA ruling came in June 2024, HHS dropped its appeal in August, and the lawsuit wave kept growing. The rule didn’t die. Enforcement moved to courts and statehouses.

What the 2024 court ruling changed

There are two common misconceptions, and they lead to confusion.

Some people think the guidance no longer matters. Others believe nothing has changed. If your organization holds either view, you may misunderstand the current risks.

On 20 June 2024, the U.S. District Court for the Northern District of Texas, in litigation brought by the American Hospital Association, vacated a specific portion of OCR’s online tracking guidance. The vacated part provided that HIPAA obligations are triggered when an online technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. The court held this exceeded HHS’s authority. HHS filed an appeal, then withdrew it on 29 August 2024.

Everything else in the bulletin stands. The ruling doesn’t touch authenticated pages, logins, scheduling tools, symptom checkers, or apps. It doesn’t bind state courts or state laws (Washington’s MHMD, California’s CMIA and CIPA have their own plaintiffs), doesn’t bind the FTC, and doesn’t stop private plaintiffs, who were never suing “under HIPAA” in the first place.

You can stop worrying about your careers page, but this does not mean your patient portal is risk-free. HIPAA was not the main reason behind most lawsuits in the first place.

The court ruling does not change your contract with Google. Google’s HIPAA page still refers to the bulletin, including the vacated section, and instructs regulated entities not to tag authenticated webpages or unauthenticated pages related to health care services. While the court decision may lower your regulatory risk, your agreement with Google still applies. You can comply with HIPAA and still violate Google’s policy at the same time.

HIPAA compliance requirements for your tracking stack

HHS issued guidance on December 1, 2022, for HIPAA compliance and revised it on March 18, 2024. OCR’s position remains, with one exception: the piece a federal court vacated in June 2024. What it requires, in operator terms:

Why the lawsuits didn’t stop and what still gets you sued in 2026

Start with the load-bearing fact. HIPAA has no private right of action. Patients cannot sue you “for a HIPAA violation,” so the lawsuit wave never needed OCR’s vacated theory. Plaintiffs file under state wiretap statutes, consumer-protection laws, and privacy torts.

Layer 1: the class-action machine

Settlements through mid-2026:

Add Inova ($3.1 million), Skagit ($400,000), and Northwell’s fee award, and the verified total since 2023 clears $100 million.

Two things operators miss in this table. 

First, these claims travel. CIPA is California law, but look at the geography above: California, Massachusetts, Illinois, North Carolina, New York. Plaintiffs plead federal wiretap theories and state analogs to reach providers wherever they operate – “we don’t run pixels in California” isn’t a defense. 

Second, authentication doesn’t settle anything. The AHA ruling turned on whether HIPAA reaches unauthenticated pages. A wiretap claim asks a different question – did a third party intercept a communication without consent – and it’s indifferent to logins. Sutter was a login page. MGB was public pages. Both paid.

The notification trap is how a misconfiguration becomes a nine-figure problem. A pixel leaks data. Under the breach-notification rule at 45 CFR § 164.402, an impermissible disclosure is presumed reportable, so the health system notifies. Aurora told roughly 3 million people in October 2022, and those letters became the plaintiffs’ evidence trail: an admission that PHI went somewhere it shouldn’t have, with a class list attached. The settlement followed.

The suit against Meta itself. In re Meta Pixel Healthcare Litigation (MDL 3084, N.D. Cal.) goes after Meta for designing the collection system; wiretap and intrusion theories have survived dismissal twice, and the docket is active through 2026 (CourtListener). Plaintiffs’ counsel has already mapped hundreds of provider web properties. If you ran the pixel, you’re findable.

What settlements force you to do. Aurora’s forward-looking terms are the de facto compliance standard: remove PHI-sharing trackers from patient-facing pages, adopt written policies, train staff, run regular website and mobile app audits, and notify OCR of future incidents. Plaintiffs don’t always win – in March 2026, the court in the separate Meta Pixel tax-filing MDL denied class certification over individualized issues (docket). But with per-claimant payments of $15–$111 and classes in the millions, defendants settle rather than find out.

Layer 2: state privacy statutes with private rights of action

• Washington My Health My Data Act (MHMD). Effective March 31, 2024, RCW 19.373 covers “consumer health data” far beyond HIPAA covered entities: consent for collection and sharing, a geofencing ban around health facilities, AG penalties up to $7,500 per violation, private actions with treble damages to $25,000. The first private class action, Maxwell v. Amazon.com Inc. (filed February 10, 2025), targeted an ad SDK. So what: MHMD applies even where HIPAA doesn’t, and it reaches companies with Washington visitors wherever they’re based.
• California CMIA. Patients can sue for $1,000 nominal damages per violation without proving harm (Cal. Civ. Code § 56.36). So what: “no one was hurt” is not a defense in California.
• California CIPA. Plaintiffs repurpose a 1967 wiretap law: § 631 (eavesdropping) and § 638.51 (pen registers: recording dialing/routing information, now applied to pixels) carry $5,000 statutory damages per violation. We cover how CIPA wiretap claims work and pen registers and your website elsewhere. The Sutter settlement above is a CIPA case.
• VPPA. If your pages carry video, the Video Privacy Protection Act ($2,500 per violation) is one to watch – the Supreme Court hears Salazar v. Paramount Global in October 2026 to decide who counts as a “consumer” (SCOTUSblog case page).

The point: “HIPAA-safe” never was the whole test.

Layer 3: the FTC and the Health Breach Notification Rule

The FTC covers everyone HIPAA doesn’t (health apps, direct-to-consumer telehealth, wearables):

• GoodRx (Feb 2023): $1.5 million, the first Health Breach Notification Rule (HBNR) action – condition-linked ad data to Meta, Google, and Criteo (FTC).
• BetterHelp (Mar 2023): $7.8 million in refunds – mental-health data to Facebook and Snapchat (FTC).
• Premom (May 2023): $100,000 civil penalty plus $100,000 to two states and D.C. – ovulation data shared for advertising (FTC).
• Cerebral (Apr 2024): more than $7 million and a first-of-its-kind ban on using sensitive data for advertising (FTC).
• Monument (Apr 2024): an ad-data ban after custom events literally titled “Paid: Weekly Therapy” (FTC).

The amended HBNR, effective July 29, 2024, treats unauthorized disclosures by health apps as “breaches” and requires FTC notice within 60 days at 500-plus people. Between that and the 2023 joint letters to ~130 providers, tracking enforcement is a permanent program. The FTC’s pace has cooled since 2025 – weather, not climate.

Layer 4: OCR investigations and state AGs

OCR’s leverage runs through breach-notification duties and Security Rule investigations – no tracking-specific penalty announced as of this writing. The civil monetary penalties (CMPs) it would reach for rose in January 2026: per-violation maximums of $73,011, annual caps of $2,190,294 per identical provision (91 FR 3665). State AGs are active: New York extracted $300,000 from NewYork-Presbyterian in December 2023 over tracking tools that ran 2016–2022 across 54,000-plus visitors.

The exposure math. CMIA: $1,000 × your California monthly visitors. CIPA: $5,000 × violations. MHMD: $7,500 per violation from the AG, private actions on top. CMPs: $73,011 per violation at the top tier. Multiply by a class of 2.5 million notified patients. That’s why a $15-per-claimant settlement still clears eight figures.

What’s allowed: tracking you can keep (with conditions)

Six patterns lawful in 2026, each with its condition in bold.

1. Tracking on genuinely general pages:

Condition: They stay general. 

Careers, visiting hours, general service information, and (post-AHA) even condition-education pages carry low HIPAA risk. State laws still apply: California’s consumer-privacy statute gives visitors rights over the same pixels, per our CCPA compliance guide.

2. First-party analytics on your own infrastructure:

Condition: No third-party recipient. 

A self-hosted Matomo instance on servers you control means no outside vendor receives anything, so no analytics-vendor BAA is needed (your hosting provider may still need one).

3. Any analytics or marketing vendor with a signed BAA:

Condition: a permitted purpose. 

A BAA plus a Privacy-Rule-permitted use makes the disclosure lawful. Verify the vendor signs and that the scope covers what you send.

4. The CDP de-identification pattern: 

Condition: stripping happens on your side. 

OCR’s bulletin expressly blesses routing data through a BAA-covered CDP that removes identifiers before forwarding to non-BAA tools (bulletin, including its CDP discussion). It’s the HHS-sanctioned way to keep non-BAA tools.

5. Aggregate, de-identified measurement:

Condition: real de-identification. 

HIPAA’s de-identification standard (Safe Harbor or expert determination, 45 CFR § 164.514) puts data outside HIPAA entirely. Hashing an email address is not de-identification.

6. Marketing to your own patients:

Condition: stay within § 164.508’s lines. 

Refill reminders and treatment communications are fine without authorization. Most other “marketing” to your own patients requires it, per 45 CFR § 164.508.

The server-side trap: Systems must implement server-side filtering to anonymize sensitive data before sharing. Moving tags server-side, as with Meta’s Conversions API (CAPI) or server-side Google Tag Manager (GTM), removes the visible pixel, but the data is still sent to the same vendor. This method can bypass your tag manager, crawler, and most audit tools, increasing your risk while making tracking less visible. Server-side setups are designed to avoid detection, not to ensure compliance. Also, server-side routing only controls what your pipeline sends; it does not limit what a vendor’s client-side script does on the page.

The decision matrix: what you can track, page by page

The verdict column describes what a page can carry without a BAA. With a signed BAA and permitted purpose, almost any tool can run anywhere. “Post-AHA” on row two is HIPAA-only. 

Where PHI actually leaks

1. URL paths and query strings. /appointments/oncology or ?condition=diabetes travels with every pixel and referrer.
   Fix: sanitize paths and strip query params before tags fire.
2. Referrer headers. A link clicked from a condition search result leaks the query to the destination.
   Fix: referrer-policy headers and internal redirect hygiene.
3. Form-field and form_submit capture. Tag managers that “helpfully” capture form values capture the reason-for-visit field.
   Fix: turn off form tracking on health forms.
4. Session replay. Records the visitor typing symptoms into a chat box – the worst offender per byte.
   Fix: never run replay on data-entry or user-authenticated webpages.
5. Click-event parameters. A button labeled “Schedule mammogram” forwards the label as an event parameter.
   Fix: neutral labels.
6. Hashed-email customer-list uploads. Hashing is not de-identification for the sender: you disclosed the patient’s identity to the platform, which un-hashes it against its own users.
   Fix: skip patient lists and use the customer data platform (CDP) pattern.
7. Server-side event streams. CAPI and server-side GTM move the leak where your browser tools can’t see it.
   Fix: contract and log review, plus the same data-minimization rules.

The fourth-party problem nobody audits 

A fourth-party tracker is a script loaded by one of your approved vendors, not by you. The tag you installed loads another vendor’s script, and each hop inherits your page’s full context (URL, referrer, identifiers) for recipients you never contracted with. 

Questionnaires and contract reviews can’t catch this. The chain only resolves at runtime, in a real browser, and it can change without notice, without a version bump, and without anyone telling you.

The regulation anticipated the chain. Under 45 CFR § 164.308(b)(2), a business associate may let a subcontractor create, receive, maintain, or transmit ePHI on its behalf only after obtaining satisfactory assurances the subcontractor will safeguard it. Map that onto a tag chain: you’re the covered entity, your analytics vendor is the business associate, and the advertising partner their script loads is functionally the subcontractor. “What does your script load?” isn’t a paranoid question. It’s an assurance your vendor already owes. Ask it in every vendor review, and cite the section when they hesitate.

The three-question page test

For any page, ask: 

1. Does this page tie a person to a health context (login, scheduling, symptoms, payment)? 
2. Does any data leave for a third party? 
3. Is there a BAA or authorization covering that transfer? 

If 1 and 2 are yes and 3 is no, you have your answer.

For example, a visitor browsing your “Find a cardiologist” directory carries no personal health context, so question 1 is no. The same visitor clicks “Book with Dr. Lee,” hits a scheduling form asking a reason for the visit, and question 1 flips to yes the moment they type. Same site, same session, different verdict.

What tracking technologies are safe to run 

There are two important rules to remember. First, vendors can change their terms, so every “yes” above means you should check the current terms regularly. No product is officially “HIPAA-certified.” Second, compliance depends on how you implement the tool; no tool is compliant on its own.

Evaluating a replacement comes down to five things: BAA availability, data residency and hosting model, encryption in transit and at rest, audit logging and access controls, and whether the vendor’s own script loads any subprocessors in the browser. That last one gets skipped most often. 

Is Google Analytics HIPAA compliant?

No. Google doesn’t offer a business associate agreement for Google Analytics, and Google’s own policy prohibits sending protected health information to the platform. GA4 can run on a healthcare property only if no PHI ever reaches it, which means controlling the data layer, URL structure, query parameters, form events, and referrer strings. Continuously, not once.

That’s achievable. It’s also more fragile than teams expect, because every one of those controls can break silently when a campaign adds a new landing page.

The vendor-selection checklist

“Do you sign a BAA?” is question one of eight:

1. BAA availability and scope (does it cover the features you’ll actually use?)
2. Self-host vs. SaaS hosting options
3. Data residency
4. Encryption in transit and at rest
5. Audit logs and access controls on the vendor dashboard
6. IP anonymization and data-redaction controls
7. Data-retention and deletion controls
8. Whether the vendor uses your data for its own purposes (advertising, benchmarking)

The last point is where promises like “we’d never sell your data” can be contradicted by the fine print.

The HIPAA tracking audit

Run this yourself or hand it to your agency. Each step lists the evidence you should produce. The expanded walkthrough lives in our HIPAA tracking audit checklist.

Two things to remember as you work through it. The “regular audits” are the legal standard now, and you can’t audit what you can’t see; observation beats questionnaires. 

Why does your tracker audit go stale?  

A tracker audit is only accurate for about a week. A quarterly review shows what was running in March, but not what may have started running in May.

The problem is not negligence. The people who update your tag stack and those responsible for HIPAA compliance are often different, working on separate systems without a shared process. Marketing teams may have valid reasons to publish changes, vendors may need to update scripts, and new pages often inherit default settings.

So point-in-time auditing structurally can’t hold this. What holds it is continuous monitoring. Scanning the live property on a schedule, diffing against the approved inventory, and alerting when something new appears, or an existing vendor starts loading something new.

That’s the problem Melurna’s exposure management and compliance monitoring capabilities are built for. Agentless discovery of what’s executing on your properties, traced from first party through third to fourth, mapped against the frameworks you report on. 

Found a leak?

Preserve the evidence before you remediate. Export tag manager version history, take network captures of the affected pages, screenshot the current configuration. Remediation destroys the record of what was firing and for how long, which is exactly what you need to determine scope. 

Then work the assessment.

An impermissible disclosure of unsecured PHI is presumed to be a breach under 45 CFR § 164.402. The presumption is rebuttable, but only by demonstrating a low probability that the PHI was compromised, based on a risk assessment of at least these four factors:

1. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
2. The unauthorized person who used the PHI or to whom the disclosure was made.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which the risk has been mitigated.

Factor two is where tracking cases get uncomfortable. The recipient isn’t an unknown attacker. It’s a named advertising platform with substantial re-identification capability and a commercial interest in the data. That’s a hard factor to argue down.

If the assessment doesn’t establish low probability, notification obligations follow. Individual notice is required without unreasonable delay and no later than 60 calendar days after discovery. Notice to the Secretary is required contemporaneously with individual notice for breaches affecting 500 or more individuals, and annually, within 60 days of year-end, for smaller ones (§ 164.408).

Document the assessment either way. A documented decision not to notify is a defensible position. An undocumented one isn’t. 

Next steps

• See your own stack: Start with a company name or domain. No questionnaire is required to begin.
• Run the audit: work through the checklist this week.
• Go deeper on the statutes: how CIPA wiretap claims work, pen registers and your website, CCPA compliance guide
• MELURNA: solution overview, compliance monitoring platform

FAQs

DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.