Tracking pixels and HIPAA: what practices should know before running ads

The Meta Pixel and Google tags help ads find patients, but on the wrong pages they can send health information to ad platforms. Where the rules stand and how to set up ads safely.

The AdLivo Team3 min read

Online ads work better when the ad platform can see what happens after the click. That's what tracking code does: the Meta Pixel, Google tags, and similar snippets on your website report back that someone visited a page, filled out a form, or booked an appointment. The platform uses that to show your ads to more people like the ones who booked.

For most businesses, that's routine. For a medical practice, it raises a harder question: what exactly is being sent, and is any of it health information about a patient?

This article is general information, not legal advice. For decisions about your own website, talk with your compliance officer or a healthcare attorney.

Why this became a big deal

In December 2022, the HHS Office for Civil Rights (OCR) published guidance on online tracking technologies, updated in March 2024. It said that tracking code on a HIPAA-covered entity's website can disclose protected health information to companies like Meta and Google, and that doing so without a business associate agreement or patient authorization can violate HIPAA.

At the same time, a wave of class-action lawsuits and news reports showed hospital and health-system websites sending appointment details, conditions searched, and form contents to ad platforms.

In June 2024, a federal court in Texas (American Hospital Association v. Becerra) set aside one part of that guidance: the idea that simply visiting a public page about a condition, combined with an IP address, is protected health information. Other parts were not affected. In particular, tracking on pages behind a login, such as a patient portal, and tracking that captures what someone typed or booked, still carry real risk. State privacy laws and the FTC's rules for health information add their own requirements.

The practical takeaway hasn't changed much: be deliberate about which pages carry tracking code and what that code sends.

Pages that carry the most risk

Think about what a page reveals about the person who uses it:

  • Patient portal and anything behind a login. No ad tracking here. Ever.
  • Appointment request and booking pages. The fact that someone booked with an orthopedic surgeon, plus their name or email, is exactly what the guidance worries about.
  • Intake and contact forms. If the form asks about symptoms or reasons for the visit, tracking code that captures form fields can send that text along.
  • Bill pay pages. These confirm someone is a patient.
  • Condition and treatment pages. After the 2024 ruling these carry less risk on their own, but caution is still reasonable, especially when the page includes a symptom checker or a form.

General pages, like your home page, a physician's bio, or your locations page, are lower risk.

A safer way to measure ads

You can still run measurable ads without sending patient information to ad platforms. The common approaches:

  1. Keep tracking code off sensitive pages entirely. Load ad tags only on general marketing pages, and audit the site so templates don't add them everywhere by default.
  2. Measure clicks and calls, not patients. Count that someone clicked an ad and reached your site, or called a tracked number, without sending what they did afterward.
  3. Don't send form contents. Turn off any "automatic advanced matching" or form-field capture features in your ad tags, which can scoop up names, emails, and phone numbers.
  4. Use server-side or privacy-focused tools carefully. Some vendors filter data before it reaches the ad platform and will sign a business associate agreement. Read what's filtered, not just the marketing claims.
  5. Audit after every website change. A new plugin or template can quietly add tracking back to pages you had cleaned up.

Questions to ask whoever runs your website and ads

  • Which pages on our site load the Meta Pixel, Google tags, or other third-party scripts?
  • Is any tracking code on the patient portal, booking, intake, or bill pay pages?
  • Are form fields, names, emails, or phone numbers sent to any ad platform?
  • Do we have business associate agreements with any vendor that receives data from those pages?
  • When did someone last check, and how?

If nobody can answer these quickly, that's the place to start.

How AdLivo handles it

AdLivo was built around this problem. Ads run in your own Google and Facebook accounts, and nothing about patients goes to Google or Meta, so no business associate agreement is needed. AdLivo measures results at the ad level, such as spend, clicks, and requests, without sending patient details to either platform. The page-by-page audit above is still worth doing for any other tags already on your site.