HIPAA Tracking Technologies: What Pixels and Analytics Are Allowed in 2026
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-tracking-technologies
Last updated: October 20, 2026
HIPAA tracking technologies are scripts and tools, such as the Meta Pixel, Google Analytics, cookies, and tag managers, that collect visitor data on a website. They become a HIPAA problem when they send protected health information (PHI) to a vendor that has not signed a Business Associate Agreement (BAA). The rule is simple even when the technology is not. A tracking vendor that receives PHI on your behalf is a business associate, and HIPAA requires a signed BAA first (45 CFR §§ 164.502(e), 164.504(e)). Google says it offers no BAA for Google Analytics, and Meta's terms bar advertisers from sending it health information. So HIPAA tracking technologies that fire on a patient portal, a booking flow, or an intake form can turn an ordinary website into an impermissible disclosure. This guide explains when tracking becomes PHI, what the rules say in 2026, and how to find the leaks on your own site.
TL;DR: Quick answer
HIPAA tracking technologies break the rules when they send identity plus health context to a vendor with no BAA. That is an impermissible disclosure under 45 CFR § 164.502(a).
Google Analytics and the Meta Pixel cannot lawfully receive PHI. Google offers no BAA for Google Analytics, and Meta's Business Tools Terms bar health information.
In AHA v. Becerra (June 20, 2024), a federal court vacated one part of OCR's tracking guidance, about IP addresses on public pages. HHS has issued no replacement guidance. Trackers on patient portals, login pages, booking flows and apps can still expose PHI.
The cost is real. Advocate Aurora Health settled a tracking pixel class action for $12,225,000, and Novant Health settled one for $6,660,000. In 2026, courts approved class action settlements of $47.5 million for Kaiser and $12.5 million for Allina Health.
You can audit your own site with browser tools. A professional review can catch what a manual check misses, and it should document each fix.
Need help? We sell a client-side compliance review, plus BAA-covered managed hosting from $229 a month.
What are online tracking technologies?
Online tracking technologies are the small pieces of code that watch what a visitor does on a website and report it somewhere. HHS uses that exact phrase in its guidance. The HIPAA tracking technologies you will find on a healthcare site fall into a few common types:
Advertising pixels, such as the Meta Pixel and the Google Ads tag, which send visit data to ad platforms.
Analytics scripts, such as Google Analytics 4, which measure traffic and behavior.
Tag managers, such as Google Tag Manager, which load many other tags from one container.
Cookies and device identifiers, which tie repeat visits to the same person.
Session replay and chat tools, which can record what a visitor types, including form fields.
Each of these runs in the visitor's browser, which is why a review of them is called a client-side review. The host secures the server, but these scripts send data straight from the browser to a third party, often without the practice realizing it. Forms are their own topic; see HIPAA compliant forms.
When does tracking data become PHI?
PHI is health information that identifies a person, or reasonably could, under 45 CFR § 160.103. On a website, identity and health context combine fast. A pixel on a booking page can capture a visitor ID, the page URL, the provider chosen, and the appointment type in a single request. Together, that data says a known person sought care for a condition. That is PHI, and sending it to a vendor with no BAA is an impermissible disclosure under 45 CFR § 164.502(a). HIPAA tracking technologies do not have to name the patient to create the problem; an identifier plus a health-context page is enough. IP addresses and URLs are two of the 18 HIPAA identifiers, which is why this data counts.
The highest-risk pages are patient portals, anything behind a login, and booking and scheduling flows. Intake and contact forms that ask about symptoms are high risk too, as are condition pages that feed a booking funnel. A general blog read by an unknown visitor is a lower-risk case, which is exactly what the 2024 court ruling addressed.
The 2026 rules: OCR guidance and the AHA v. Becerra ruling
HHS OCR first published its tracking guidance on December 1, 2022 and revised it on March 18, 2024. The American Hospital Association sued. In AHA v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated one part of OCR's tracking guidance, known as the Proscribed Combination. That part said an IP address plus a visit to a public health information page is, by itself, protected health information. HHS appealed, then asked the Fifth Circuit to dismiss its own appeal. The appeal was dismissed on September 4, 2024, so that piece is gone. HHS has issued no replacement guidance.
What did not change is most of the rule. The rest of the guidance still applies. Trackers on patient portals, login pages, booking flows and apps can still expose PHI, and HHS says it is still evaluating its next steps. Trackers that capture form entries, appointment details, or anything a user types about their health still break the rules. HHS's own example still stands. A booking made on a clinic website can send the appointment details and the visitor's IP address to a tracking vendor. That vendor is a business associate, and a BAA is required.
The ruling also did nothing to stop class actions or state privacy laws like Washington's My Health My Data Act. The Federal Trade Commission (FTC) has warned health providers about tracking under its own authority. In July 2023, the FTC and HHS sent a joint letter to about 130 hospital systems and telehealth providers. In short, the HIPAA tracking technologies rules narrowed slightly for public pages and stayed firm everywhere patient data is involved. Membership sites carry the same risk. Our guide to whether Ghost CMS HIPAA compliant sites are possible shows where pixels on member-only pages leak.
Why Google Analytics and the Meta Pixel cannot be fixed
Some HIPAA tracking technologies problems are a settings issue. This one is a contract issue. Google says it does not offer a BAA for Google Analytics, and that HIPAA customers may use it only on pages that are not HIPAA-covered. Meta's Business Tools Terms, which cover the Pixel, bar advertisers from sending Meta health information at all. Without a BAA, no configuration, IP masking, or consent banner makes them lawful on a page that handles PHI. HHS says a cookie banner is not a valid HIPAA authorization. It also says a vendor's promise to strip or de-identify PHI after receiving it is not enough. The missing contract is the failure, not the data setting. We cover the analytics side in depth in whether Google Analytics is HIPAA compliant, and the agency angle in HIPAA compliance for marketing agencies.
What getting it wrong costs
The HIPAA tracking technologies that cause settlements are usually the ones nobody audited, because nothing visibly breaks. The bills are not small. The cases below are private class actions, not HHS penalties. In July 2024, a federal court in Wisconsin approved Advocate Aurora Health's $12,225,000 class action settlement. That suit covered tracking pixels on its websites, LiveWell app and MyChart patient portal. In June 2024, a federal court in North Carolina approved Novant Health's $6,660,000 class action settlement over tracking tools on its websites and MyChart portal.
Settlements over HIPAA tracking technologies kept coming in 2026. On July 14, 2026, a federal court in California gave final approval to Kaiser's $47.5 million class action settlement. It covers about 13.1 million people. The suit alleged that Kaiser placed code from third parties, such as Quantum Metric, Twitter and Adobe, on its website and mobile apps. On September 24, 2026, a federal court in Minnesota gave final approval to Allina Health's $12.5 million class action settlement. That suit alleged Allina used the Meta Pixel and Google Analytics on its web properties.
Pixels like these often start as routine marketing choices: someone adds a tag, and nobody checks what it sends. Pixels appear in our roundup of unintentional HIPAA violations for that reason. Beyond lawsuits, an impermissible disclosure can trigger the breach notification duties in 45 CFR §§ 164.400-414 and the penalty tiers in 45 CFR § 160.404. HIPAA also has criminal penalties for knowingly disclosing identifiable health information in violation of the law (42 U.S.C. § 1320d-6). Our guide to HIPAA violation consequences for employees explains them.
HHS's breach portal lists Kaiser's tracking disclosure, reported in April 2024, at 13.4 million people. That makes it one of the largest entries on the portal, as our healthcare data breach statistics show.
How to find the trackers on your own site
You can audit your own HIPAA tracking technologies in about 15 minutes. Open a booking or intake page in Chrome, press F12, and select the Network tab. Reload the page, then filter requests for "google-analytics," "googletagmanager," "facebook," and "doubleclick." Each match is a third party receiving data from that page. Submit a test form entry and watch for new requests that contain your test name or answers. Then open your tag manager and look for tags you do not recognize, because agencies, old plugins, and theme demos all leave trackers behind.
This finds the obvious leaks. It will not catch everything. Scripts can load only on some devices, or pass data through chained tags and server-side proxies that a manual check misses. That gap is why a second, professional check can be worth it. The tracker check is also just one step of a fuller HIPAA website audit. For the rest of the site, work through our HIPAA compliant website checklist.
Safer ways to measure traffic
Replacing risky HIPAA tracking technologies does not mean flying blind. Self-hosted analytics such as Matomo keep visitor data on your own server, so no third party receives it. Some vendors built for healthcare offer a BAA. Piwik PRO says it signs a BAA on its Enterprise plan. Freshpaint, a tracking layer that controls what data each ad or analytics tool receives, says it offers a BAA. We checked both on October 20, 2026. Cookieless, count-only tools collect little identity data, which lowers the risk on public information pages. Server logs answer basic traffic questions with data you already hold. Whichever you choose, get the BAA answer in writing before the tag goes live.
Get help with a client-side review
If your site takes bookings, intake details, or any patient information, the settlements above show the cost of waiting. Ask about our client-side compliance review if you want help checking your HIPAA tracking technologies. HIPAA Compliant Hosting sells this review, so weigh that as a disclosure. We still publish the manual check above. A practice that finds its own pixel problem this week is better off than one that waits for a demand letter. Whoever does the review, keep a written record of each tracker you found and how you fixed it.
HIPAA tracking technologies are the browser side. The server side needs a host that signs a BAA. Our HIPAA compliant hosting runs on single-tenant AWS, and we sign the BAA within 24 hours of signup, before patient data moves. Every plan includes a web application firewall, encryption at rest and in transit, tested encrypted backups and six-year audit logging. Our guide to HIPAA audit logs explains what those logs should record. Managed plans start at $229 a month, billed monthly with no long-term contract. Our BAA covers the servers and services we run, so each tracking vendor that receives PHI still needs its own BAA.
Frequently asked questions
Are tracking pixels HIPAA compliant?
Not when they send PHI to a vendor without a BAA. A pixel on a public page with no patient data is lower risk after the 2024 ruling. A pixel on a portal, booking flow, or intake form that captures identity plus health context is an impermissible disclosure.
Is the Meta Pixel allowed on a healthcare website?
Not on pages that handle PHI. Meta's Business Tools Terms bar advertisers from sending Meta health information. Without a BAA, the Pixel cannot lawfully receive patient data. Keep it off portals, booking flows, and forms; even on public pages, weigh state privacy laws, FTC risk and class actions.
Did the 2024 court ruling make website tracking legal again?
Only partly. AHA v. Becerra vacated one part of OCR's guidance. That part said an IP address plus a visit to a public health information page is, by itself, PHI. HHS asked the Fifth Circuit to dismiss its own appeal, which was dismissed on September 4, 2024. HHS has issued no replacement guidance. Trackers on patient portals, login pages, booking flows and apps can still expose PHI, and class actions continue.
What is a client-side compliance review?
An audit of the HIPAA tracking technologies that run in a visitor's browser: scripts, cookies, pixels, forms, and third-party tools. It finds where a site sends PHI to vendors without a BAA. A useful review records each finding and fix, so you can show the work in your HIPAA risk analysis.
Which analytics can healthcare websites use?
Self-hosted tools like Matomo, BAA-backed vendors such as Piwik PRO (Enterprise plan) or Freshpaint, cookieless count-only tools on information pages, and server log reports. Confirm BAA coverage in writing before deploying any of them.
Recap: HIPAA tracking technologies
To recap, HIPAA tracking technologies are the pixels, analytics, and tags that watch your visitors. They are fine on pages with no patient data and a violation the moment they send identity plus health context to a vendor with no BAA. Google Analytics and the Meta Pixel cannot be fixed for PHI pages, because Google offers no BAA and Meta's terms bar health data. The 2024 ruling narrowed the rule for public pages only, and HHS has issued no replacement guidance. Map where patient data flows, pull trackers off every page that touches PHI, replace them with BAA-covered or self-hosted tools, and document the result.
This article is general information, not legal advice. Details reflect the HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164) and the OCR tracking guidance after American Hospital Association v. Becerra. Court records and the published terms of Google, Meta, Piwik PRO and Freshpaint were checked on October 20, 2026. Confirm your obligations with qualified legal counsel.
Sources
HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
45 CFR § 164.502 (uses and disclosures of PHI): ecfr.gov
45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov
FTC and HHS: Warning to hospital systems and telehealth providers on online tracking
45 CFR § 164.504 (business associate contracts): law.cornell.edu
45 CFR § 160.404 (civil money penalty tiers): law.cornell.edu
42 U.S.C. § 1320d-6 (wrongful disclosure, criminal penalties): law.cornell.edu
Google: HIPAA and Google Analytics
Piwik PRO: Pricing and BAA FAQ
Freshpaint: FAQ (BAA)
AHA v. Becerra, N.D. Tex. No. 4:23-cv-01110: district court docket
AHA v. Becerra appeal, Fifth Circuit No. 24-10775: appeal docket
In re Advocate Aurora Health Pixel Litigation, E.D. Wis. No. 2:22-cv-01253: docket (judgment July 10, 2024)
In re Novant Health, Inc., M.D.N.C. No. 1:22-cv-00697: docket (final approval June 17, 2024)
Doe v. Kaiser Foundation Health Plan, Inc., N.D. Cal. No. 3:23-cv-02865: docket (final approval July 14, 2026)
Ahlers v. Allina Health System, D. Minn. No. 0:24-cv-03674: docket (final approval September 24, 2026)
HHS OCR: Breach portal (Kaiser Foundation Health Plan, submitted April 12, 2024)