By Mehdi HassanCan healthcare websites use Google Analytics or Meta Pixel under HIPAA?
Healthcare websites can't safely run standard Google Analytics or Meta Pixel on pages where visitor data could reveal health information, because neither vendor will sign a business associate agreement for those tools. Google states that Google Analytics isn't intended for HIPAA-regulated data and that it doesn't offer BAAs for the service. Meta doesn't sign BAAs for its pixel.
That doesn't mean a health company can't measure anything. It means tracking has to be chosen page by page, based on what the page reveals. This guide is part of our healthtech website design series, and it assumes you're a covered entity, a business associate or a health startup that wants to behave like one. Confirm your own status with counsel.
Why are tracking pixels a HIPAA risk on healthcare websites?
Tracking pixels are a HIPAA risk because they send more than a page view. A typical pixel can pass the page URL, the visitor's IP address, a device identifier, button clicks and sometimes form field values to a third party. On a page titled for a specific condition, or a booking flow for a named specialist, that combination can describe a person's health.
HHS's Office for Civil Rights published guidance on online tracking technologies that treated much of this data as protected health information. A federal court later vacated the part of that guidance covering some unauthenticated public pages, but the rest still stands, and authenticated pages such as patient portals are clearly in scope. The FTC has also acted against digital health companies that shared health data with ad platforms. The safe reading for a marketing team is simple: don't send health-related browsing to advertisers.
Which pages on a healthcare website are riskiest to track?
The riskiest pages are the ones where a visit or an input reveals something about a person's health or care. Rank your pages before you decide on tools.
Page type | Risk | What we recommend |
|---|---|---|
Patient portal or logged-in app | Highest | No third-party tracking at all |
Intake, symptom or booking forms | Very high | No pixels; BAA-covered tools only |
Condition and treatment pages | High | No ad pixels; privacy-first analytics |
Provider and location pages | Medium | Aggregate analytics; no ad retargeting |
Homepage, about, pricing for B2B | Lower | Standard analytics, cookie consent |
Careers, press, blog on general topics | Lowest | Standard analytics, cookie consent |
B2B health startups that sell to employers or payers often have only the lower rows. A direct-to-patient clinic or telehealth service usually has all of them, which changes the whole stack.
What does a HIPAA-compliant analytics stack look like?
A HIPAA-compliant analytics stack sends health-sensitive data only to vendors that sign a BAA, and sends nothing identifying to ad platforms. In practice, most health sites end up with one of three setups, depending on how much they advertise.
- Privacy-first analytics everywhere. A cookieless, aggregate tool on every page and no ad pixels. Simplest to defend, weakest for paid ads.
- Split by page risk. Standard analytics on low-risk pages, a BAA-covered analytics vendor on sensitive pages and no pixels near forms or portals.
- Server-side tagging with a BAA vendor. Events go to your own server first, identifiers are stripped, and only a BAA-covered vendor receives the rest before anything reaches ad platforms.
Pros
- Server-side tagging lets you control and strip every field before it leaves
- BAA-covered analytics vendors give you funnel data on sensitive pages
- Privacy-first tools reduce how much consent you need to ask for
Cons
- Server-side tagging is not compliant by itself; it only moves the problem if the receiver lacks a BAA
- BAA-covered analytics vendors cost more than free tools
- Paid campaigns lose some targeting and attribution detail
Whatever you choose, document it. Our website tracking plan template gives you a format for listing each event, where it fires and which vendor receives it.
How should you set up HIPAA analytics tracking on a website?
Set up HIPAA analytics tracking on a website by auditing what loads today, classifying pages by risk and then rebuilding the tag plan from zero. Starting from the existing setup tends to keep the old risks.
Inventory every script
Load each page type with the browser's network panel open and list every third-party request, including chat, heatmaps and fonts.
Classify pages by risk
Use the table above. Mark every page that names a condition, a provider, a booking step or a logged-in area.
Confirm BAAs
For each vendor that will receive data from sensitive pages, confirm in writing that it signs a BAA on your plan.
Rebuild the tag plan
Define the few events you actually need, such as form started and appointment requested, without field values or condition names.
Clean URLs and titles
Avoid putting conditions or patient details in query strings, and keep page titles general where tracking still runs.
Re-audit after every change
Any new widget or campaign tag goes through the same check before it ships.
Hypothetical example: tracking a telehealth booking without a pixel
For example, suppose a telehealth service runs search ads to a page about anxiety treatment. The old setup fired an ad pixel on the page and on each booking step.
The rebuilt setup keeps the ad platform's click ID in a first-party cookie only, fires a single anonymous conversion from the server when a booking completes, with no condition name, URL or form data, and sends detailed funnel events to a BAA-covered analytics vendor. Marketing still sees cost per booking by campaign. The ad platform never learns which page the person was reading. Your counsel should review the exact fields before launch.
Do health apps outside HIPAA still need to worry about tracking?
Yes. Health apps and wellness brands that aren't covered by HIPAA can still be in trouble for sharing health data with advertisers. The FTC enforces its Health Breach Notification Rule for many non-HIPAA health apps and treats undisclosed sharing of health data as an unfair or deceptive practice. Several US states have also passed consumer health data laws.
So the practical rule is the same either way: keep health signals away from ad platforms, say plainly in your privacy policy what you collect and get consent where the law requires it. Our guide to HIPAA compliant website design explains where HIPAA applies, and the FTC publishes its business guidance for health apps.
How do you keep measuring marketing without risky pixels?
You keep measuring by tracking outcomes, not people. Count form starts, completed requests and booked appointments as anonymous events, attribute them to campaigns with first-party data and accept less granular retargeting. For most budget decisions, campaign-level reporting is enough.
Our guide to conversion tracking for lead-gen websites covers event design in general, and if you're moving platforms at the same time, analytics continuity in a migration explains how to avoid gaps. Treat compliance review as part of each change rather than a one-time project.
