Is your Meta Pixel a HIPAA problem?

Most practice websites have a Meta Pixel on them. Usually an agency added it years ago so ads could be measured, and nobody has looked at it since. Then the owner reads a headline about a hospital being sued over tracking and wonders if they have the same problem.

The honest answer is: it depends on where the pixel fires and what it sends.

What a pixel actually does

A tracking pixel is a small script from an ad platform. When a page loads, it tells the platform that this browser visited this address. Depending on how it's set up, it can also send button clicks, form field contents, and details that let the platform match the visit to a person's account.

On a clothing site that's routine. On a page titled "Book your anxiety consult", the address alone says something about the person's health.

What HHS has said

In December 2022 the HHS Office for Civil Rights (OCR), which enforces HIPAA, published a bulletin on online tracking technologies. It updated it in March 2024. The core message: a practice covered by HIPAA can't let a tracking vendor receive protected health information unless HIPAA allows the disclosure, which in practice means the vendor has signed a Business Associate Agreement or the patient has given a valid authorization. A cookie banner isn't an authorization.

The bulletin treats pages behind a login, such as patient portals, as the clearest case. It also covers public pages where a visitor shares information tied to their care, such as an appointment request form.

What the 2024 court ruling changed

The American Hospital Association challenged the bulletin. In June 2024 a federal court in Texas ruled in American Hospital Association v. Becerra that OCR had gone too far on one point. The court vacated the part of the guidance that treated an IP address combined with a visit to a public, unauthenticated health page as protected health information on its own. HHS later dropped its appeal.

That ruling was narrower than some headlines made it sound. It dealt with simply browsing public pages. It did not say trackers are fine on portals, booking forms or intake forms, and it did not remove the need for a Business Associate Agreement when a vendor receives protected health information.

HIPAA isn't the only rule

Two other things matter, including for practices that think HIPAA doesn't reach them.

• The FTC. In 2023 the Federal Trade Commission took action against GoodRx and BetterHelp for sharing consumers' health information with advertising platforms, including Facebook. GoodRx agreed to a $1.5 million civil penalty and BetterHelp was ordered to pay $7.8 million toward consumer refunds. Both were barred from sharing health data for advertising. The FTC has since updated its Health Breach Notification Rule to make clear it covers health apps and similar services outside HIPAA.
• State law and private lawsuits. Several states have passed their own health privacy laws, and patients have brought lawsuits over website tracking under state privacy and wiretap laws. These don't depend on HIPAA at all.

Where the risk is highest on a practice site

1. Patient portals and anything behind a login.
2. Booking, scheduling and appointment request pages.
3. Intake, contact and "ask a question" forms where people describe why they're coming in.
4. Pages for a specific condition or treatment, especially sensitive ones such as mental health, reproductive health, addiction or weight loss.
5. Embedded third-party tools, such as a scheduling widget, that load their own trackers.

What to check this week

• List every tracker on your site and the pages each one fires on. Our free Tracker Scan gives you a first pass in a few seconds.
• Look at what loads through your tag manager, not just what's in the page code.
• For each vendor that could receive patient information, ask whether they will sign a Business Associate Agreement. Meta does not offer one for its standard advertising tools.
• Remove ad pixels from booking, intake and portal pages. Measure inquiries another way, using aggregate numbers that don't identify anyone.
• Write down what you found and what you changed, and share it with whoever handles compliance for your practice.

You can still measure your marketing

Taking a pixel off your booking page doesn't mean flying blind. You can still count inquiries by channel, use tracked phone numbers, and report on which campaigns led to bookings, without telling an ad platform who booked. That's how we set up reporting and attribution for practices.