Is the Meta Pixel or Google Analytics on My Medical Website a HIPAA Problem?
Last updated: November 13, 2026 · By Kayce Sadler, Founder & CEO, Abode Marketing
It can be. HHS has said that tracking tools on pages where patients log in, book appointments or describe a condition can send protected health information to companies like Meta or Google, and that practices need a HIPAA basis to allow that. A 2024 court ruling narrowed HHS’s guidance for public pages, but it did not make tracking on patient portals or booking forms safe. Most practices should audit what fires where, remove ad pixels from sensitive pages, and use privacy-safe analytics for the rest.
Key takeaways
- HHS’s Office for Civil Rights issued guidance in December 2022, updated in March 2024, on online tracking technologies used by HIPAA-regulated entities.
- In June 2024 a federal court in Texas vacated part of that guidance, the part about unauthenticated public pages.
- Tracking on logged-in portals, appointment requests and symptom or intake forms is still the risky zone.
- Google says Google Analytics is not set up for HIPAA, and Meta does not sign business associate agreements for its pixel.
- The safest setup separates marketing measurement from anything a patient types about their health.
What did HHS actually say about tracking pixels?
In December 2022, the HHS Office for Civil Rights published a bulletin on the use of online tracking technologies by HIPAA covered entities and business associates, and revised it in March 2024. The core point: tracking code like the Meta Pixel, Google Analytics or similar tools collects data such as IP address, pages visited and form activity, and when that is connected to a person’s past, present or future health care, it can be protected health information. Disclosing it to a tracking vendor without a HIPAA permission, usually a business associate agreement, can be an impermissible disclosure.
The bulletin also noted that tracking vendors won’t always sign a business associate agreement, which leaves practices with a problem if their code is collecting health information.
What changed after the 2024 court decision?
In American Hospital Association v. Becerra, decided in June 2024, a federal court in the Northern District of Texas vacated the part of the guidance that said tracking on unauthenticated public pages could be a HIPAA disclosure simply because the visitor might be looking for care. HHS did not appeal that ruling.
Here’s my take: owners read that headline as “pixels are fine now,” and that’s not what it means. The ruling dealt with general public pages. It did not bless tracking inside patient portals, on appointment requests, or on forms where someone types symptoms or their name and phone number. State privacy and consumer protection laws, and the FTC’s Health Breach Notification Rule for some apps and non-HIPAA entities, are also still in play, and class-action lawsuits over hospital pixels have continued.
Which pages on a practice website are the risky ones?
| Page type | Risk level | Why |
|---|---|---|
| Patient portal or logged-in pages | High | The visitor is an identified patient, and the pages relate to their care. |
| Appointment request or booking pages | High | Names, phone numbers, reasons for visit and provider choices can be captured. |
| Intake, symptom or “which treatment is right for me” forms | High | The visitor is describing a health condition. |
| Condition and treatment pages | Medium | Less clear after the 2024 ruling, but paired with ad retargeting it can still create risk. |
| Home, about, team, blog and location pages | Lower | General information, as long as forms on them don’t send health details to vendors. |
How can a practice still measure its marketing safely?
- Inventory every script. List each pixel, tag and chat widget on the site and which pages it fires on, including anything loaded through Google Tag Manager.
- Pull ad pixels off sensitive pages. At minimum, remove Meta and similar ad pixels from booking, intake, portal and thank-you pages tied to appointment requests.
- Stop form contents from leaving the site. Make sure form fields, URLs with query strings and button labels don’t pass names, conditions or appointment reasons to third parties.
- Use a HIPAA-ready vendor where you need detail. Several analytics and call-tracking providers will sign a business associate agreement. Use them for anything that touches patient data.
- Measure leads in your own systems. Count booked appointments in your scheduling or practice management system and match them to sources there, rather than sending conversion details to ad platforms.
- Document it. Write down what you changed and when, and include website tracking in your HIPAA risk analysis.
Can we still run Google Ads or Facebook ads?
Yes. Running ads is not the issue; what you send back to the ad platform is. You can advertise a service, send people to a public page and still count results through calls and booked appointments recorded on your side. What I’d avoid is using health-condition audiences or retargeting people based on the condition pages they visited, which also runs into Meta’s and Google’s own policies on sensitive health targeting.
I’m not a lawyer, and this isn’t legal advice. If your site has had ad pixels on booking or portal pages, talk with your healthcare attorney about whether anything needs to be reported.
What we’d check first
We’d crawl your site and list every tracking script, which pages fire it, and what data each form sends out, then flag anything on booking, intake or portal pages for your compliance lead to review.
If you’d like a second set of eyes, our free visibility audit covers this and shows where you stand on Google, Maps and AI search.
More owner questions we’ve answered: Should my practice offer online booking? · Responding to patient reviews under HIPAA · Marketing within compliance lines
Frequently asked questions
Is Google Analytics HIPAA compliant?
Google has said Google Analytics is not intended for HIPAA-regulated data and it does not sign business associate agreements for it. Practices can use it on general pages but should keep it away from anything that captures health information.
Did the 2024 court ruling make tracking pixels legal for practices?
No. It vacated the part of HHS’s guidance about unauthenticated public pages. Tracking on portals, booking forms and intake forms still carries real HIPAA risk.
Does the Meta Pixel count as a business associate?
Meta does not sign business associate agreements for its pixel, so it shouldn’t receive protected health information from your site.
What about call tracking numbers?
Call tracking can be used safely if the vendor signs a business associate agreement and recordings or transcripts are handled under HIPAA.
Should we remove all tracking from our website?
Not necessarily. Remove ad pixels from sensitive pages, keep privacy-safe analytics on general pages, and measure appointments inside your own systems.
Sources
- HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates — The tracking technologies bulletin and its 2024 update
- Google Analytics Help: HIPAA and Google Analytics — Google says Analytics should not be used with protected health information
- FTC: Health Products Compliance Guidance — FTC expectations for health-related marketing claims
