Skip to content
No practice should treat the Meta Pixel as HIPAA compliant. The pixel is code, Meta’s terms tell businesses not to send it health information, and Meta Pixel HIPAA exposure depends on where the code fires and what it sends. HHS’s Office for Civil Rights treats tracking on patient portals and booking pages as disclosing protected health information.
What is the Meta Pixel, and what does it send to Meta?
The Meta Pixel is tracking code a practice adds to its website. Meta’s developer documentation describes it as “a snippet of JavaScript code that allows you to track visitor activity on your website.” It reports page views and other events to Meta so ads can be measured and optimized.
The code itself has no compliance status. What matters is the data that travels with each event: the page address, what the visitor clicked or submitted, and identifiers such as IP address and browser cookies. On a behavioral health site, that bundle can describe a person looking for care.
The pixel is common in health settings. A study published in PNAS Nexus in December 2025 examined 1,201 U.S. hospitals from 2012 through 2023 and found that 66% of the sample used pixel tracking.
Does Meta sign a business associate agreement for the pixel?
A practice should not plan on a business associate agreement from Meta for the pixel. Meta’s business terms assume Meta should not receive health information at all. A federal court order in In re Meta Pixel Healthcare Litigation (N.D. Cal., Dec. 22, 2022) quotes those terms: businesses agree they will “not share Business Tool Data . . . that [they] know or reasonably should know . . . includes health, financial information or other categories of sensitive information.”
HIPAA expects a business associate agreement (BAA) before protected health information (PHI) goes to a vendor. The HHS Office for Civil Rights (OCR) bulletin on online tracking says a tracking vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.” If a tracking vendor will not sign one, OCR describes using a different vendor that signs a BAA and passes along only de-identified information.
When does the Meta Pixel create a HIPAA problem for a practice?
OCR’s guidance places the clearest exposure where a person is identifiable as a patient or someone seeking care. The bulletin says tracking on user-authenticated pages, such as patient portals, “generally” has access to PHI. Its example of a visitor booking an appointment or entering symptoms concludes that “the regulated entity is disclosing PHI to the tracking technology vendor.”
The status of public pages is contested. On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the part of OCR’s guidance treating an IP address plus a visit to a public page about a health condition as enough to trigger HIPAA. OCR’s bulletin notes the ruling.
“When consumers visit a hospital’s website or seek telehealth services, they should not have to worry that their most private and sensitive health information may be disclosed to advertisers and other unnamed, hidden third parties.” Samuel Levine, then Director of the FTC’s Bureau of Consumer Protection, in a July 2023 joint FTC and HHS release
What does this answer not cover?
This page explains how the Meta Pixel relates to HIPAA for a practice owner making a decision. It does not assess any specific site, because the pages carrying the pixel, the events it sends, and whether a portal exists all change the picture.
This page does not analyze rules outside HIPAA. The FTC Act, state consumer health privacy laws, and 42 CFR Part 2 for substance use disorder programs can apply even where HIPAA does not. It does not walk through ad platform setup or predict the outcome of any pending lawsuit.
This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Frequently asked questions
Can a setting in Meta make the pixel HIPAA compliant?
No setting shifts HIPAA obligations to Meta. Compliance belongs to the practice as the covered entity. OCR’s bulletin says it is insufficient for a tracking vendor to agree to remove or de-identify PHI after receiving it, so the question is what data leaves the practice’s site.
Is the Meta Pixel safe on a practice’s public blog pages?
The HIPAA status of public pages is contested after the June 2024 AHA v. Becerra ruling, and the FTC Act and state privacy laws can still apply. A pixel on a condition page still tells Meta what a visitor read. For client paid media, Beacon uses server-side conversion tracking in place of client-side pixels.
Who should decide whether the pixel stays on the site?
The practice owner decides, because the practice carries the HIPAA obligation even when an agency installed the pixel. Beacon’s standard keeps tracking off booking, intake, and portal pages and sends Meta only a generic conversion event and a hashed IP address, with no names, contact details, conditions, page addresses, or form content.
The case for treating tracking as an owner-level choice is made in The Tracking Code on Your Website Is a Legal Decision.
