Skip to content
The website tracking HIPAA risk for a behavioral health practice centers on pages where a tag can see someone acting as a patient or prospective patient: a portal login, a booking, or an intake form. HHS guidance treats portal and booking tracking as disclosing protected health information. Public-page tracking is contested but can reveal a condition to ad platforms.
What does a tracking tag see on a behavioral health website?
A client-side tracking tag runs in the visitor’s browser and reports to its vendor. On a behavioral health site it can see the page address (a path such as /anxiety-treatment/), clicks on “Request an appointment,” form activity, the visitor’s IP address, and cookies that link one visit to the next. The page topic itself can disclose a condition, and a form submitted on that page ties it to a name.
The HHS Office for Civil Rights (OCR) bulletin on online tracking describes a tag collecting a “reason for seeking health care” when someone books an appointment, and calls that disclosing protected health information (PHI) to the vendor.
Researchers have also linked pixels to breaches. A PNAS Nexus study published in December 2025 of 1,201 U.S. hospitals found pixel use raised breach probability by at least 1.4 percentage points, a 46% relative increase.
Which rules besides HIPAA apply to website tracking?
Website tracking can draw enforcement from the FTC, state law, and private lawsuits, even where HIPAA’s reach is contested. The FTC’s health information guidance, updated in August 2024, states that “The FTC Act’s obligations apply to HIPAA-covered entities and business associates.”
The FTC has acted against mental health companies, announcing proposed orders requiring BetterHelp to pay $7.8 million in March 2023 over sharing health information with advertising platforms, and Cerebral to pay about $7 million in April 2024 in a case that included sharing sensitive data through tracking tools.
“When a person struggling with mental health issues reaches out for help, they do so in a moment of vulnerability and with an expectation that professional counseling services will protect their privacy.” Samuel Levine, then Director of the FTC’s Bureau of Consumer Protection, in the FTC’s BetterHelp announcement
Washington’s My Health My Data Act covers consumer health data, including mental health status, outside HIPAA. Patients have also filed class actions over pixels on provider patient portals.
What reduces website tracking risk for a practice?
A practice reduces website tracking risk by knowing what fires where and keeping contact and health details away from ad platforms. Beacon’s working standard has four steps:
- Audit every tag on the site and record what each one sends.
- Remove tracking tags from patient portals, booking pages, and intake forms.
- Send ad platforms only a generic event, such as “appointment request,” with no contact details, condition, page address, or form content. Hash any identifier that travels, like an IP address.
- Hold a signed business associate agreement with any vendor that receives PHI.
OCR’s bulletin describes a similar option: a vendor under a BAA that will “de-identify online tracking information that includes PHI and then subsequently disclose only de-identified information to tracking technology vendors.” Hashing alone does not make contact details anonymous. FTC technology staff wrote in July 2024 that hashes “can still be used to identify users,” so Beacon never sends contact details. Its server-side tracking, under a signed BAA, strips contact and health details and hashes IP addresses.
What does this answer not cover?
This page explains why website tracking creates exposure for behavioral health practices and what reduces it. It does not tell any practice whether its own site complies with HIPAA, 42 CFR Part 2, or state law, because that depends on its pages, tags, vendors, and contracts. No tool or vendor makes a practice compliant. The page does not compare tracking methods, cover mobile apps or telehealth platforms, or predict the outcome of any pending case.
This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Frequently asked questions
Did the AHA v. Becerra ruling make public pages safe to track?
The June 2024 ruling in American Hospital Association v. Becerra vacated the part of OCR’s guidance treating an IP address plus a visit to a public page about a health condition as enough to trigger HIPAA. The rest of OCR’s bulletin, including its portal and booking examples, remains posted, and the ruling did not address FTC or state law.
Is a cookie consent banner enough to allow tracking?
OCR says no. Its bulletin states that “Website banners that ask users to accept or reject a website’s use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.” State privacy laws set their own consent rules, which vary by state.
Does 42 CFR Part 2 apply to every practice that treats substance use?
Not necessarily. 42 CFR Part 2 covers a program that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral, and that is federally assisted. The regulation lists federal funds, a federal license, certification, or registration, and tax-exempt status as forms of federal assistance.
The owner-level case for treating these choices deliberately is in The Tracking Code on Your Website Is a Legal Decision.