The rule: no Meta pixel or Google Analytics where patients book, type or log in
HHS, which enforces HIPAA, put it plainly:
"Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules." (HHS OCR: Online tracking bulletin)
Sending protected health information (PHI) to a vendor needs a signed business associate agreement (BAA) and a Privacy Rule permission, or the patient's HIPAA authorization (same page). The two vendors most clinics use don't offer that:
"Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." (Google Analytics Help)
Meta's terms make you promise not to send data that "includes or is based on, directly or otherwise, health information" (Meta Business Tools Terms, effective November 3, 2025).
Which clinic pages are the problem?
| Page | HIPAA risk with Meta pixel or Google Analytics | Source |
|---|---|---|
| Patient portal, telehealth (after login) | Tags "generally have access to PHI" | HHS |
| Online booking, symptom checker (no login) | "May have access to PHI": an email or reason for the visit sent to the vendor is a disclosure | HHS |
| Portal login or sign-up page | What the patient types there is PHI | HHS |
| Service or condition pages | HHS's guidance here was vacated in 2024 (next section), but Google still says pages "related to the provision of health care services" are "more likely to be HIPAA-covered" | Google Analytics Help |
| Hours, location, job openings | Not PHI, so HIPAA doesn't regulate it | HHS |
HHS's own example is the everyday case:
"if an individual makes an appointment through the website of a covered health clinic for health services and that website uses third party tracking technologies, then the website might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor. In this case, the tracking technology vendor is a business associate, and a BAA is required." (HHS OCR)
What did the 2024 court ruling change?
Only the public-page part. On June 20, 2024, a federal court in Texas vacated the guidance where it said HIPAA applies when a tracker connects an IP address with a visit to a public page about specific health conditions or providers (HHS OCR). HHS dropped its appeal in August 2024, so the ruling stands (reported by McDermott Will & Emery, 2024). As of November 2026, HHS's page still carries the court's note and says HHS "is evaluating its next steps" (same page). The rules for booking pages, forms, portals and login pages still stand, and Meta's terms still ban health information whatever HIPAA says.
Does a cookie banner or privacy policy make it legal?
No.
"Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization." (HHS OCR)
A line in your privacy policy isn't enough either, and neither is a vendor's promise to strip or de-identify PHI after receiving it (same page).
How to track a clinic website safely
- List every page and mark the portal, login, booking, forms and symptom tools.
- Take the Meta pixel, Google Analytics and any session-recording script off those pages. Google says customers "should not set Google Analytics tags on HIPAA-covered pages" (Google Analytics Help).
- Keep tags only on pages that don't relate to anyone's care, and agree that list with your lawyer, as Google advises (same page).
- If you need booking data for ads, HHS describes one route: a vendor that signs a BAA receives the data, de-identifies it, and passes only de-identified data on (HHS OCR).
- Put tracking in your HIPAA Security Rule risk analysis. OCR says it is prioritizing Security Rule compliance in tracking investigations (same page).
If PHI already went to a vendor with no BAA, HHS presumes a breach unless you can show a low probability the PHI was compromised, and breach notice rules apply (same page).
Does HIPAA apply to my practice?
It applies to covered entities. A clinic is covered if it transmits health information electronically in a standard transaction, such as billing insurance (HHS OCR, note 28). A cash-only practice may fall outside HIPAA but not outside the law: the FTC Act and the FTC's Health Breach Notification Rule may apply (same page, note 44). The FTC's first case under that rule was against GoodRx, for sharing health information with Facebook, Google and others: a $1.5 million civil penalty and a ban on sharing health data for advertising (FTC, 2023).
Canada
HIPAA is a US law. Google says it is typically not relevant to customers operating only outside the US (Google Analytics Help). Canadian clinics answer to federal and provincial privacy laws instead. Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia have health privacy laws declared substantially similar to PIPEDA (Office of the Privacy Commissioner). Meta's ban on health information applies in both countries.
Example
A physio clinic with Google Analytics on every page
The tag also sits on the booking page, where patients pick a "reason for visit". Fix: remove it from booking and forms; keep it on hours and careers pages.
A dental office running Meta ads
It wants the pixel to fire when someone books a cleaning. That sends appointment data to Meta. Fix: no pixel on the booking flow; count bookings in the practice's own system and send only de-identified totals through a vendor that signs a BAA.
A cash-only med spa
It may not be a HIPAA covered entity, but FTC rules may still apply, and Meta's health-data ban does. Same setup: no tags where clients type.
Different for you?
- A dental office answering calls with AI: AI receptionist for a dental office.
- A med spa running ads: Med spa ads rules.
- Counting booked patients from ads: Tracking a lead from Google Ads to a booked job.
- Budgeting a compliant rebuild: Small business website cost.
- You want the site set up this way for you: Website Agent.