Tracking pixels and analytics tools can expose behavioral health providers to privacy and legal risk if they send patient information to third parties without proper safeguards. A 2024 federal court ruling narrowed HHS’s guidance on public webpages, but HIPAA still applies to patient portals and other protected information, substance use records have extra federal protection, and state privacy lawsuits continue. Audit your tracking now.
This guide is general information, not legal advice. Consult a healthcare privacy attorney.
How we put this guide together
MGMT Digital builds websites, analytics and tracking for behavioral health providers. This guide draws on HHS guidance, the 2024 ruling in American Hospital Association v. Becerra and analyses from healthcare law firms.
Key risks at a glance
| Area | Risk level | What to do |
| Patient portals and logged-in pages | High | Avoid third-party tracking without proper agreements |
| Forms, VOB and appointment pages | High | Keep health details out of ad and analytics platforms |
| Public informational pages | Lower under HIPAA, but state law risk remains | Audit, limit data, review consent |
| Call tracking and chat tools | Varies | Confirm vendors’ privacy safeguards and agreements |
| Substance use records | High | Follow 42 CFR Part 2 protections |
1. HHS warned about tracking technologies in 2022
In December 2022, HHS’s Office for Civil Rights issued a bulletin on how HIPAA applies to online tracking technologies, revised in March 2024. It raised concerns about pixels sending health-related information to third parties.
2. A court narrowed the guidance in 2024
On June 20, 2024, a federal court in Texas ruled that part of the guidance exceeded HHS’s authority and vacated it: the position that connecting a visitor’s IP address with a visit to an unauthenticated public webpage about health conditions triggers HIPAA.
“We’d rather give up a little tracking precision than put a family’s information somewhere it doesn’t belong. You can measure admissions without sending health details to an ad platform.” — Jake Gorman, COO
3. HHS dropped its appeal, but the rest still applies
HHS withdrew its appeal in August 2024. The vacated portion was narrow; tracking on authenticated pages, such as patient portals, and disclosures of protected health information still carry HIPAA obligations.
4. Forms and admissions pages need special care
Pages where people submit names, insurance, diagnoses or appointment details are high-risk. Avoid sending that information to advertising platforms through pixels or tags.
5. Substance use records have extra protection
Federal rules at 42 CFR Part 2 add confidentiality protections for substance use disorder treatment records from covered programs, beyond HIPAA.
6. State laws and lawsuits still matter
Healthcare organizations continue to face lawsuits over tracking technologies under state privacy and wiretap laws, even after the 2024 ruling. Compliance isn’t only about HIPAA.
“When we audit a new site, tracking is one of the first things we look at. A lot of providers don’t know what their pixels are sending until someone shows them.” — Zach Gross, CEO
7. Vendors should sign agreements where appropriate
Analytics, call tracking, chat and CRM vendors that handle protected health information should sign business associate agreements. Many ad platforms won’t, which means they shouldn’t receive protected information.
8. Privacy-conscious tracking is possible
Options include limiting data collection, server-side tagging that strips sensitive data, privacy-focused analytics tools, and measuring conversions without sharing health details.
9. Audit regularly
Inventory every tag, pixel and script on your site, map what data each collects, and review it whenever your site or tools change. MGMT Digital offers custom reporting and tracking built for behavioral health. Call (866) 248-4857.
FAQ
Are tracking pixels allowed on healthcare websites?
They can be used carefully, but pixels shouldn’t send protected health information to third parties without proper safeguards. Avoid them on patient portals and sensitive forms.
What did the court rule in AHA v. Becerra?
In June 2024, a federal court vacated the part of HHS’s guidance saying HIPAA applies when tracking connects an IP address to a visit to a public health-related webpage. Other parts of the guidance remain.
Does HIPAA apply to my treatment center’s website?
HIPAA applies to protected health information you collect and share, including on forms, portals and through vendors. Public informational pages carry less HIPAA risk but may still raise state law issues.
What is 42 CFR Part 2?
It’s a federal regulation that adds confidentiality protections for substance use disorder treatment records from covered programs.
Can I still run Google Ads conversion tracking?
Often, yes, if configured to avoid sending protected health information. Work with your agency and legal counsel to review your setup.