Tracking pixels and patient privacy: what medical practice websites need to know
For years, the standard advice for any business website was simple: install the Facebook (Meta) pixel, add Google Analytics, track everything. For medical practices in the US, that advice has turned into a real compliance headache.
Here’s what changed, and how to keep measuring your marketing without putting patient privacy at risk.
The problem in plain English
Tracking pixels and tags are small pieces of code that send information about what visitors do on your site to companies like Meta and Google. That’s how ad platforms know who clicked an ad and booked an appointment.
On most websites, that’s fine. On a medical website, the information can be sensitive. A visit to a page about a specific condition, a submitted appointment form, or activity inside a patient portal can reveal something about a person’s health. If that data, tied to an IP address or other identifier, gets sent to an ad platform, it can be a privacy problem.
What regulators have said
In late 2022 the US Department of Health and Human Services published guidance warning HIPAA-covered practices about tracking technologies, and updated it in 2024. A federal court later struck down part of that guidance relating to public web pages, but the core message stands: be very careful with tracking on authenticated pages like patient portals and anywhere visitors share health information.
The Federal Trade Commission has also taken action against health companies for sharing sensitive data with advertisers. And a number of hospitals and health systems have faced class action lawsuits over pixels on their sites.
We’re not lawyers, and the rules continue to shift. But the direction is clear enough to act on.
Practical steps for your website
- Know what’s on your site. Make a list of every tracking script, pixel and third-party tool. Tools like Google Tag Assistant or a browser extension can help. You might be surprised what’s there
- Keep tracking off sensitive areas. No ad pixels on patient portals, intake forms, symptom checkers or pages where people enter health details
- Be careful with form data. Make sure what someone types into a form doesn’t get passed to ad or analytics platforms
- Look at server-side or privacy-focused options. Some setups let you send only limited, non-identifying conversion data to ad platforms, or use analytics tools designed for healthcare
- Check your vendors. If a tool handles protected health information, you generally need a Business Associate Agreement (BAA) with them. Many popular marketing tools won’t sign one
- Update your privacy policy so it accurately describes what you collect and share
- Use a consent banner where appropriate, and make sure it actually controls what loads
Can you still run ads?
Yes. Many practices still run Google and Meta ads successfully. The difference is in how conversions are measured. Instead of firing a pixel on every page and form, you might track a non-sensitive event (like a click on a “Book now” button), use call tracking with a healthcare-friendly provider, or import conversions in a limited, privacy-safe way.
You’ll get a bit less detail. But you’ll still know which campaigns bring patients in, without the risk.
Where to start
Do an audit of your tracking this month. Remove anything you don’t need. Move anything sensitive out of the reach of ad platforms. Then talk to your compliance advisor about the rest.
We help medical practices set up marketing and tracking with patient privacy in mind. If you’d like us to check what’s running on your site, book a free call.
This post is general information, not legal advice. Speak with a healthcare attorney or compliance professional about your specific situation.
