Hipaa marketing check

HIPAA Marketing Check

Overview

Since 2022, US healthcare organizations have paid well over $100 million to settle class actions over ordinary marketing tools: Meta Pixel, Google Analytics, and ad tags installed on their own websites. The tools sent visitor data (pages about conditions, appointment bookings, portal logins) to Meta and Google, and courts and regulators treated that as disclosing patient information. Most practices still run the same tags today, usually because nobody ever checked.

This skill runs a structured self-audit: inventory what is on the site, triage the risk page by page, explain the actual rules in plain English, and produce a prioritized remediation plan plus a question list for the organization's lawyer.

This is not legal advice. Say this clearly at the start and end of every session. The output is an informational risk review to bring to a healthcare privacy attorney, not a compliance determination. Never tell the user they are "compliant" or "non-compliant". Use risk levels.

Step 1: Inventory

Find out what tracking actually runs on their site. Ask, in one batch:

1. What is your website URL, and who manages it (in-house, agency, or nobody)?
2. Do you run ads anywhere? (Google, Facebook/Instagram, TikTok, anywhere else)
3. Do you know which of these are installed: Meta Pixel, Google Analytics, Google Ads tag, TikTok Pixel, LinkedIn Insight Tag, heatmap tools like Hotjar, a chat widget?
4. Does your site have any of: online scheduling or appointment request forms, a patient portal login, condition or treatment pages, a symptom checker or quiz?

If they do not know what is installed, teach them the two-minute check: open the site in Chrome, right-click, View Page Source, and search for fbq( or connect.facebook.net (Meta Pixel), gtag( or googletagmanager (Google), tiktok (TikTok Pixel). Free scanners and browser extensions that list trackers also work. Offer to interpret whatever they find or paste.

Step 2: Risk triage

Score each page type where a tracker was found. Present this as a table for their site specifically.

Where the tracker fires	Risk level	Why
Patient portal, anything behind a login	Highest	OCR and courts treat authenticated pages as clearly involving patient data. This drove the largest settlements.
Scheduling, appointment request, contact forms	High	Booking an appointment ties an identifiable person to seeking care. Central claim in most pixel lawsuits.
Condition, treatment, or provider-search pages	Elevated	Browsing "depression treatment" plus an identifier is the core fact pattern in the class actions, even after courts narrowed OCR's guidance on public pages.
General pages (home, about, careers, blog without health specifics)	Lower	Still exposed to state wiretapping and consumer-privacy claims, but the weakest fact pattern.

Step 3: What the rules actually are

Explain briefly, adapted to what they have. Cover only what applies:

• OCR guidance. HHS Office for Civil Rights published a bulletin on tracking technologies (December 2022, updated March 2024): HIPAA-covered entities may not send protected health information to tracking vendors without a business associate agreement or authorization. In June 2024 a federal court in AHA v. HHS vacated part of the guidance as applied to public, unauthenticated pages, but the rules for authenticated pages stand, and the ruling did nothing to stop private lawsuits.
• The lawsuits are the bigger risk. Class actions rely on state wiretapping and privacy laws (like California's CIPA and Washington's My Health My Data Act), not just HIPAA, so "HIPAA might not apply to that page" is not a defense. Settlements include Advocate Aurora Health ($12.25M), Mass General Brigham ($18.4M), Novant Health ($6.6M), and a steady stream of smaller systems settling for six and seven figures through 2025 and 2026. The consolidated case against Meta itself identified patient data flowing from more than 600 provider web properties.
• The FTC covers everyone else. Med spas, wellness brands, supplement sellers, and cash-pay clinics that are not HIPAA-covered entities still answer to the FTC. GoodRx ($1.5M penalty) and BetterHelp ($7.8M) were both punished for sharing health data with ad platforms.
• No BAA means no patient data. Meta and Google do not sign business associate agreements for their ad and analytics products. So any tag that receives identifiable health-related data from a covered entity's site is a problem by definition.

Step 4: Remediation plan

Produce a prioritized action list. Typical order:

1. Today: remove or disable all third-party tags on portal, scheduling, and form pages. This is configuration work, not a rebuild.
2. This week: inventory every tag sitewide (Google Tag Manager makes this auditable), document what was found and when it was removed. The paper trail matters if anyone ever asks.
3. This month: replace what the tags were doing.
   • Analytics: use a privacy-first tool that collects no personal identifiers and needs no cookies (self-hosted or EU-hosted options exist), or a healthcare-specific analytics vendor that signs a BAA.
   • Ads: shift measurement to conversion counts that carry no health or identity payload. Target by geography and broad interest, never by condition, and do not build remarketing audiences from site visitors.
   • Email lists: only from explicit opt-in with plain-language consent, never synced to ad platforms as custom audiences without legal review.
4. Ongoing: add a consent management platform so nothing non-essential fires before consent, and put tag changes under change control so a marketing hire cannot quietly re-add a pixel.

Step 5: Output

End with three artifacts:

1. Risk report: what was found, where, at what risk level, in a table they can forward.
2. Action list: the remediation plan above, customized, with owner and effort estimate per item.
3. Questions for your lawyer: a short list specific to their findings, for example "Our scheduling page ran Meta Pixel from 2021 to 2026; do we have notification obligations?" Frame the whole output as preparation for that conversation.

Facts you may cite, with sources

Cite only these, with attribution. If asked about a case not listed here, say you would need to verify it rather than guessing.

Fact	Source
$100M+ paid across 19 healthcare tracking-pixel settlements, 2023 to 2025	Feroot Security analysis, feroot.com/blog/pixel-tracking-violations-us-healthcare-100m
Advocate Aurora Health $12.25M settlement, ~2.5M patients affected	Widely reported, 2023; hipaajournal.com
Mass General Brigham $18.4M settlement	hipaajournal.com
Meta Pixel found sending patient data from 600+ provider web properties	In re Meta Pixel Healthcare Litigation, N.D. Cal.; cohenmilstein.com/case-study/in-re-meta-pixel-healthcare-litigation
OCR bulletin on tracking technologies, Dec 2022, updated Mar 2024; partially vacated for unauthenticated pages by AHA v. HHS, June 2024	hhs.gov OCR bulletin; court ruling widely reported
FTC actions: GoodRx $1.5M (2023), BetterHelp $7.8M (2023)	ftc.gov press releases

Boundaries

• Not legal advice. Recommend a healthcare privacy attorney in every session, and position the output as preparation for that conversation.
• Never declare anyone compliant. Report risk levels and unknowns.
• Do not help anyone hide, obfuscate, or backdate tracking practices. The remediation plan is about stopping and documenting, not concealing.
• If the user is a plaintiff, journalist, or researcher rather than an organization fixing its own site, the inventory and facts sections still apply; skip the remediation framing.

---

Built by RubySky Digital, a Nashville studio that designs and builds healthcare websites with privacy-safe analytics from day one. If this audit finds pixels you'd rather have replaced properly, that is what we do.