Is Your Website's Tracking HIPAA-Compliant?How to Check in 5 Steps

Your website's tracking is not HIPAA-compliant if a third-party tool receives patient information without a signed business associate agreement (BAA). Google does not offer a BAA for Google Analytics. Meta's terms prohibit sending it health information. This guide explains which pages carry risk, what the rules say in October 2026, and how to check your own site in five steps.

Website tracking and HIPAA at a glance

• The rule: a practice may not disclose protected health information (PHI) to a tracking vendor without a BAA or the patient's HIPAA authorization.
• Main guidance: the HHS Office for Civil Rights (OCR) bulletin, issued December 1, 2022 and updated March 18, 2024.
• What changed: on June 20, 2024, a federal court vacated one part of that bulletin.
• Highest-risk pages: patient portals, booking forms, symptom checkers, and portal login pages.
• Google Analytics: Google offers no BAA for it.
• Cookie banners: HHS says a cookie banner is not a valid HIPAA authorization.
• Time to check your site: about 30 minutes for a first pass.

What counts as tracking on a medical website?

A tracking technology is code that collects information about visitors and often sends it to another company. HHS names four common types: cookies, tracking pixels, session replay scripts, and fingerprinting scripts.

Most practice websites carry several of these. Common examples are Google Analytics, Google Ads tags, Meta Pixel, TikTok Pixel, and heatmap tools that record sessions.

Tracking is very common in healthcare. A 2023 Health Affairs study examined 3,747 US hospital websites. It found that 98.6% sent visitor data to at least one third party. The median home page made 16 third-party data transfers.

When does website tracking violate HIPAA?

Tracking violates HIPAA when it sends PHI to a vendor that has no BAA and the patient has not signed a HIPAA authorization. PHI here means information that identifies a person and relates to their health, care, or payment.

HHS gives clear examples in its bulletin. A tracker receives PHI when a patient books an appointment and the tracker captures their email address or reason for the visit. The same applies when a patient types symptoms into an online tool, or enters login details on a portal page.

Three shortcuts do not work, according to HHS:

• A cookie banner. Asking visitors to accept cookies is not a HIPAA authorization.
• A privacy policy. Telling patients about tracking does not permit the disclosure.
• A vendor promise to strip data. It is not enough for the vendor to de-identify PHI after it receives it.

Which pages on your website carry the most risk?

Risk depends on what a visitor does on the page. Sort every page on your site into one of four groups.

The third row is where most practices get confused. The next section explains why.

What did the 2024 court ruling change?

The ruling removed one specific rule and left the others in place. In American Hospital Association v. Becerra, a Texas federal court ruled on June 20, 2024. It vacated the HHS position that an IP address plus a visit to a public health page triggers HIPAA.

HHS withdrew its appeal on August 29, 2024. As of October 2026, the bulletin still carries a note that HHS is "evaluating its next steps."

Three things did not change:

1. The guidance on logged-in pages still stands.
2. The guidance on forms, booking tools, and login pages still stands.
3. Google's own policy still tells HIPAA-regulated customers not to place Analytics tags on HIPAA-covered pages. Google says public pages about health care services are "more likely to be HIPAA-covered."

How do you check your website? The Webpatch Tracker Check

The Webpatch Tracker Check is our five-step process for finding trackers that touch patient information. You need a browser and about 30 minutes. Step 2 uses Blacklight, a free scanner from The Markup.

1. 1

   Map your pages

   Sort your pages into the four groups in the table above. List every page with a form, a booking tool, a chat widget, or a login.

2. 2

   Scan the site

   Enter your address in Blacklight. It reports ad trackers, third-party cookies, session recording, keystroke capture, and data sent to Facebook, TikTok, X, and Google.

3. 3

   Test your forms by hand

   Open a booking page in Chrome. Press F12 and open the Network tab. Fill the form with fake details. Search the requests for facebook.com/tr, google-analytics.com, doubleclick.net, and analytics.tiktok.com.

4. 4

   Match each vendor to a BAA

   List every vendor found on a high-risk page. Mark whether you hold a signed BAA with each one. Include booking, chat, form, and video tools.

5. 5

   Fix and record

   Remove trackers with no BAA from high-risk pages. Add the findings to your HIPAA risk analysis. Repeat the scan every quarter and after every site change.

What to gather before you start

• Admin access to Google Tag Manager, if you use it
• A list of every marketing and analytics tool your practice pays for
• The name of the company that built or maintains your website
• Your signed BAAs
• Your latest HIPAA risk analysis

What should you do if you find a problem?

Remove the tracker from the high-risk page first, then decide what replaces it. You have three options.

• Remove it

  Take ad pixels off booking forms, portal pages, and symptom tools. This is the fastest fix.

• Switch vendors

  Use an analytics tool that signs a BAA, or one you host yourself so no third party receives the data.

• Filter the data

  HHS describes one more route. A vendor with a BAA, such as a customer data platform, de-identifies the data before it reaches other tools.

Then talk to your privacy officer or a healthcare attorney. HHS says a disclosure of PHI to a vendor with no BAA is presumed to be a breach. The practice must then show a low probability that the PHI was compromised, or notify patients. That decision needs legal advice.

What has poor tracking cost healthcare organizations?

Published costs run from $1.5 million to $47.5 million. They come from federal regulators and from patient lawsuits.

Regulators have also warned providers directly. In July 2023, the FTC and HHS sent a joint letter to about 130 hospital systems and telehealth providers. The letter named Meta Pixel and Google Analytics.

OCR says its own priority is the Security Rule. Investigators want to see that a practice identified its trackers, assessed the risk, and reduced it. Step 5 of the Webpatch Tracker Check creates that record.

How Webpatch helps

Webpatch is a technology company that works with healthcare practices. We build websites, manage their security, and handle HIPAA compliance for the site, including which trackers run on which pages. We also run SEO and AEO, so the practice stays visible in Google and in AI answers without tracking that puts patient data at risk.

We can run the Webpatch Tracker Check on your current site and fix what it finds.

We are not a law firm. We handle the technical side and work alongside your privacy officer or attorney.

This article is general information, not legal advice. Rules can change. Confirm current requirements with HHS or a healthcare attorney.