Online tracking technologies and HIPAA
When analytics, pixels and session replay on a healthcare website or app become a HIPAA disclosure, what changed after the 2024 court ruling, and how to set tracking up safely.
Online tracking technologies and HIPAA at a glance
HIPAA doesn't ban analytics or tracking pixels, but a covered entity or business associate may not let a tracking vendor receive PHI without a valid Privacy Rule basis — commonly a BAA where the vendor acts as a business associate, or the patient's authorization where required. HHS guidance treats tracking on patient portals and logged-in apps as involving PHI. A 2024 court ruling (AHA v. Becerra) vacated the part of that guidance covering unauthenticated public web pages, and HHS dropped its appeal.
| Core rule | PHI may be disclosed only as the Privacy Rule permits (164.502(a)) |
|---|---|
| Logged-in portals and apps | Tracking there generally involves PHI (HHS guidance) |
| Public web pages | HHS's position vacated by a federal court in June 2024 |
| If a vendor gets PHI | A valid Privacy Rule basis — commonly a BAA or authorization; cookie banners are not HIPAA authorization |
| Non-HIPAA apps | FTC Health Breach Notification Rule may apply instead |
The rule underneath
Tracking technologies — analytics scripts, ad pixels, session replay, embedded chat or booking widgets — send information about a visitor to a third party. Under HIPAA that is a disclosure. If the information is PHI, the disclosure needs a valid Privacy Rule basis (164.502(a)) — commonly a BAA where the vendor acts as a business associate, or the individual’s authorization where one is required (164.508). Sharing PHI with an advertising vendor without either is not permitted.
What HHS says — and what the court changed
HHS’s guidance (first issued in December 2022, revised in March 2024) says that tracking on authenticated pages — patient portals, telehealth platforms, logged-in apps — generally has access to PHI. It also took the view that an IP address combined with a visit to an unauthenticated public page about a health condition or provider could be PHI.
In June 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated that second position, and HHS withdrew its appeal in August 2024. The rest of the guidance still reflects how HHS reads the rules.
A practical approach
We recommend:
- Inventory every script, pixel and SDK on your site and in your app, and what data each sends.
- Remove trackers from logged-in areas — portals, booking flows, intake forms, telehealth — unless the vendor signs a BAA and the use is permitted.
- Configure analytics on public pages to avoid collecting form inputs, URLs with patient details or user IDs.
- Don’t rely on cookie banners for HIPAA purposes; HHS says they are not an authorization.
- Check state laws and, for non-HIPAA apps, the FTC Health Breach Notification Rule.
Tools and services where this matters
- CRM and patient relationship management →Tool
- Online forms and patient intake →Tool
- Online scheduling →Tool
Scenarios
Related requirements
- Business associate agreements (BAAs) →§ 164.502(e)
- HIPAA authorization →§ 164.508
- PHI and ePHI →§ 160.103
- Minimum necessary →§ 164.502(b)
Frequently asked questions
Is Google Analytics HIPAA compliant?
No tool is HIPAA compliant on its own. The question is whether it receives PHI and, if so, whether the vendor will sign a BAA. Google states that it makes no representation that Google Analytics meets HIPAA requirements and does not offer a BAA for it, so keep PHI out of it.
Does a cookie banner make tracking OK under HIPAA?
No. HHS guidance says a website banner asking users to accept cookies is not a valid HIPAA authorization.
What about tracking on our public homepage?
After the 2024 ruling, HHS cannot treat an IP address plus a visit to an unauthenticated public page as PHI by that fact alone. Pages like a booking flow or a symptom checker still need care — and state laws may apply.