See Our Blogs

A HIPAA-ready marketing agency signs a business associate agreement whenever its work touches protected health information and knows every tag on the practice’s website. It keeps tracking off booking, intake, and portal pages, sends ad platforms no contact or health details, gives each person a unique login, and removes its access cleanly at the end.

Why do unique logins matter when an agency manages your accounts?

Unique logins matter because a shared login makes every action impossible to trace to one person. The HIPAA Security Rule lists unique user identification as a required implementation specification at 45 CFR 164.312(a)(2)(i): “Assign a unique name and/or number for identifying and tracking user identity.”

That rule governs systems that hold electronic protected health information. Beacon’s working standard applies the same principle to every ad account, analytics property, CRM, and website login an agency touches, because a practice owner should be able to see who did what, and when, without guessing.

Account security matters because hacking dominates the breach numbers. The HHS Office for Civil Rights report to Congress on 2024 breaches counted 663 breach reports affecting 500 or more people in calendar year 2024, and 534 of them (81%) were hacking or IT incidents.

What should an agency know about the tracking on your website?

An agency should be able to list every tag firing on the practice’s website, what each tag sends, and where it goes. HHS guidance on online tracking states that “Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI,” and that tracking on unauthenticated appointment or symptom-checker pages “may have access to PHI in certain circumstances.”

A federal court in Texas vacated part of that guidance in June 2024, so the status of general public pages is contested. The conservative expectation avoids that question: tracking stays off booking, intake, and portal pages, and no names, contact details, or health information go to an ad platform in any form. FTC technology staff wrote that hashes “can still be used to identify users.”

The same care applies to analytics. Google’s Analytics help page on HIPAA says Google “does not offer Business Associate Agreements in connection with this service,” so an agency using it should say how protected health information stays out.

What else belongs in a HIPAA-ready agency relationship?

A business associate agreement belongs in the relationship when the agency creates, receives, maintains, or transmits protected health information for the practice. An agency answering web inquiries, storing call recordings, or managing a CRM with patient details likely fits that description. An agency that only buys ads may not, and it should say plainly which it is. What Is a Business Associate Agreement and When Do You Need One? covers the basics.

Patient lists should never go to ad platforms in any form. When the engagement ends, the agency should remove every login it held and confirm that in writing. OCR Director Paula M. Stannard put the principle simply in an August 2025 settlement announcement: “A HIPAA risk analysis is essential for identifying where ePHI is stored and what security measures are needed to protect it.” Agency access belongs in that analysis.

What does this checklist not cover?

This checklist does not cover whether a specific practice, agency, or tool meets HIPAA requirements. Compliance is the covered entity’s obligation, and no agency or vendor can make a practice compliant on its behalf. Clinical documentation, EHR configuration, and staff training sit outside the marketing relationship and outside this page.

The page also leaves out rules outside HIPAA. Substance use disorder programs covered by 42 CFR Part 2, practices subject to state health privacy laws, and practices facing Federal Trade Commission rules on health data have obligations this list does not address. The court ruling mentioned above is described only as HHS reports it, and nothing here predicts how any pending case will end.

This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

Does every marketing agency need to sign a BAA?

Not necessarily. HHS describes a business associate as a party that creates, receives, maintains, or transmits protected health information for a covered entity. An agency that never touches that information may not qualify. An agency that handles inquiries, call recordings, or CRM records usually does.

Should an agency upload patient lists to Facebook or Google?

Beacon’s working standard is no. A patient list tells an ad platform that each person on it receives care from the practice, and FTC technology staff wrote that hashing does not make such data anonymous. A practice should ask any agency whether it has ever uploaded one.

What should happen to agency access when a contract ends?

The agency should remove its own users from every account, return ownership of ad accounts and analytics properties to the practice, and confirm the removal in writing. The practice should then review each account’s user list itself. Unique logins make that review possible, because every remaining user has a name attached.

How Beacon handles the form data and tracking on its clients’ websites is explained in What’s Actually Behind Your Practice’s Contact Form?

There is no single right number of attempts to reach a new lead. Each practice should set its own written follow-up rhythm with its clinical leadership. A reasonable starting point is four or five contacts over about five business days, starting fast and ending with a final attempt that leaves the choice with the person.

Why doesn’t one follow-up cadence fit every practice?

One follow-up cadence can’t fit every practice because the people reaching out differ. Beacon runs a written cadence for its own agency leads, but a business buyer is in a different position from a person contacting a therapist for the first time.

A prospective client may be calling from work, unsure about starting care, or in real distress. Too few attempts miss people who couldn’t pick up; too many feel like pressure at a vulnerable moment. The right rhythm depends on each practice’s population, staffing and clinical judgment.

Paul Batalden, founding board chair of the Institute for Healthcare Improvement, adapted a colleague’s saying into the line “Every system is perfectly designed to get the results it gets.” A practice with no written rhythm gets whatever each staff member does that day.

What might a practice’s follow-up rhythm look like?

A practice’s follow-up rhythm might look like the table below, Beacon’s suggested starting point for clinics to adapt. Beacon’s published goal for the first response, explained in How Fast Should a Practice Respond to a New Inquiry?, is five minutes.

Texts and automated calls need consent. An FCC rule published in March 2024 notes that, under the Telephone Consumer Protection Act, “certain types of calls and texts may only be sent with the prior express consent of the called party,” and people can revoke it. Record consent on the inquiry form and in the CRM.

What if an inquiry suggests someone may be at risk?

An inquiry that suggests someone may be at risk leaves the routine follow-up rhythm immediately. If a form, voicemail or message mentions self-harm, suicidal thoughts or another urgent safety concern, it goes straight to the person clinical leadership has designated, under the practice’s own protocol.

That protocol is a clinical decision covering business hours, evenings and weekends. Front desk and intake staff need to know how to recognize these messages and who to hand them to, including when that person is unavailable. Clinical leadership also decides what crisis resources appear in after-hours greetings and automatic replies. A marketing follow-up rhythm should never decide how quickly a person at risk hears back.

What should a voicemail or text to a new lead say?

A voicemail or text to a new lead should give a first name, the practice name and a callback number, and stop there. It should never mention symptoms, a diagnosis or the reason the person reached out. HHS guidance on leaving messages for patients says covered entities “should take care to limit the amount of information disclosed on the answering machine.”

Those messages usually land on a personal phone. The CDC’s National Center for Health Statistics reported in June 2025 that 78.7% of adults lived in wireless-only households in late 2024. If the practice name signals a type of treatment, a first name and number may be enough.

What does this answer not cover?

This answer covers follow-up with people who make a routine new inquiry. It does not set clinical protocols for inquiries that suggest risk; those belong to licensed clinical staff and the practice’s own policies. It does not cover marketing to people who never inquired, and referral-only or waitlisted programs may need a different rhythm.

This page is general information, not legal advice. Consent rules, state privacy laws and HIPAA obligations change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

What happens after day five?

After day five, active outreach stops unless the person asked the practice to keep trying. Every attempt stays logged by time, channel and outcome, and the inquiry reopens whenever the person reaches back out. Records are kept only as consent, the practice’s privacy policy and applicable law allow.

What if a lead asks the practice to stop contacting them?

If a lead asks the practice to stop, the practice stops on every channel and records the request. FCC rules let people revoke consent to texts and automated calls, and callers must honor those requests within set time limits. The FCC revises these rules, so review the written rhythm when it does.

The larger follow-through question is covered in Are You Ghosting Your Own Leads?

Practices stop following up after one attempt because the process ends there. The first call gets logged as “contacted,” no one owns the second attempt, no written cadence says what comes next, and inquiries sit in separate phone, form and email queues. Ownership and process cause it, and a named owner, clear status rules and one shared list fix it.

Why does follow-up stop when no one owns it?

Follow-up stops when no one owns it because each person assumes someone else made the next call. The front desk believes intake has it, intake believes the front desk called back, and the owner is in session. Without one name attached to each inquiry, the first attempt becomes the last one by default.

Turnover makes this worse. In a May 2026 MGMA Stat poll of medical group leaders (303 responses), 28% reported higher staff turnover than in 2025, and MGMA noted that front-desk and entry-level administrative roles remain among the most common churn points. When follow-up lives in one person’s habits, it leaves when that person does. Who Should Own Lead Follow-Up in a Behavioral Health Practice? explains how to name an owner and a backup.

How does the word “contacted” end follow-up too early?

The word “contacted” ends follow-up too early when staff apply it after any attempt, including a voicemail. Once an inquiry shows “contacted,” it drops off the list of people still waiting, even though no one has spoken with the person. Beacon has observed that the first call to a new inquiry often reaches voicemail, and that one attempt gets logged as “contacted.”

A missing written cadence adds to the problem. If nothing on paper says how many attempts to make, on which channels and over how many days, each staff member decides alone, and a busy afternoon decides for them. The management scholar W. Edwards Deming said it plainly at a February 1993 seminar: “A bad system will beat a good person every time.”

What fixes follow-up that stops after one attempt?

A practice fixes follow-up that stops after one attempt by changing the process around the people doing it. Two more causes usually sit underneath: inquiries arrive by phone, form and email with no single list, and the person answering the phone is also checking in clients. Practice leaders across medicine are watching the phones too: in a December 2025 MGMA Stat poll, 22% of medical practice leaders named phone access their top patient access focus for 2026.

What does this answer not cover?

This answer covers why follow-up with new inquiries stops after a single attempt and the process changes that fix it. It does not cover clinical triage, crisis response or whether the practice can clinically serve a given person. Those decisions belong to licensed clinical staff and the practice’s own policies.

It also does not set the exact number of attempts or the wording of messages, and it does not address consent rules for texts or automated calls, which the practice should confirm with its counsel. Practices that admit only by referral, or that keep a closed waitlist, may need a clear referral path instead of added follow-up. Results depend on staffing, inquiry volume and how consistently the new process is used.

Frequently asked questions

Should the front desk own new-inquiry follow-up?

The front desk can own new-inquiry follow-up only when the role has protected time for it. A person who is also checking in clients and answering the main line will reasonably help the person standing in front of them first. Beacon’s working standard is a named owner with follow-up time blocked on the schedule, plus a backup.

When should an inquiry be marked “contacted”?

An inquiry should be marked “contacted” only after a staff member has spoken with the person or traded messages back and forth. Every other outcome, including a voicemail, an unanswered text or a wrong number, should be logged as an attempt with its date, time and channel, so the inquiry stays on the list.

The wider follow-through problem, and what it reveals about a practice’s intake system, is the subject of Are You Ghosting Your Own Leads?

To measure response time, a practice records three timestamps for every new inquiry: when the call or form arrived, when staff made the first contact attempt, and when the first two-way conversation happened. The gaps between them give two numbers, speed to first attempt and speed to conversation. Review both every week and test them with a secret-shop inquiry.

What should a practice timestamp for each new inquiry?

A practice should timestamp three moments for each new inquiry: the arrival (the call time or the form submission time), the first contact attempt by staff, and the first two-way conversation with the person. Arrival to first attempt is speed to first attempt. Arrival to conversation is speed to conversation. Both belong on the same record.

The third timestamp matters because a phone call often reaches no one. In a secret shopper study published in Community Mental Health Journal in April 2026, researchers attempted to contact 183 psychiatric providers listed in an insurer directory in Puerto Rico, and approximately 47% of the calls were answered. A practice that logs only its callbacks can look fast on paper while prospective clients are still waiting to speak with a person.

Why track speed to first attempt and speed to conversation separately?

Speed to first attempt and speed to conversation measure different things, so each needs its own column. Speed to first attempt shows how quickly staff act. Speed to conversation shows how quickly a prospective client actually talks with someone. Beacon’s published standard, explained in How Fast Should a Practice Respond to a New Inquiry?, is a response within five minutes, three minutes ideal.

A voicemail belongs in the attempt column. Federal secret shopper guidance draws a similar line: in CMS technical guidance for Marketplace health plans, a voicemail greeting during regular business hours is one of the outcomes that, logged on each of three contact attempts, defines a provider as nonresponsive. Beacon has observed that the first call to a new inquiry often reaches voicemail, and that one attempt gets logged as “contacted.” Two separate columns keep that gap visible. The weekly review should show the median for each number, the five slowest inquiries and every inquiry that still has no conversation.

How can a practice secret-shop its own response time?

A practice can secret-shop its own response time by posing as a new inquiry and timing each step. Regulators use the method too. Announcing a settlement that followed a secret shopper survey of a health plan’s listed mental health providers, New York Attorney General Letitia James said in August 2025, “New Yorkers seeking mental health care deserve timely, accurate information.” A monthly test takes five steps:

1. Agree on the test with the practice owner in advance, then use a phone number and email address the staff will not recognize.
2. Submit the website form and note the exact time.
3. Call the main line once during business hours and once after hours, noting whether a person answers.
4. Record when the first callback, text or email arrives, and what it says.
5. Compare those times with the CRM record, then cancel any appointment offered.

What does this answer not cover?

This answer covers how a practice measures the time between a new inquiry and a real conversation. It does not set a clinical standard for how soon someone should be seen, and it does not cover crisis response, clinical triage or level-of-care decisions. Those belong to licensed clinical staff and the practice’s own policies.

It also does not cover which phone system, CRM or call tracking product to choose. If a tool stores inquiry details, the practice should confirm its privacy terms, including any business associate agreement, with privacy counsel; this is general information, not legal advice. Programs that admit only by referral may measure different moments, and the staffing needed to hit the standard varies by practice. Nothing here guarantees a booking rate.

Frequently asked questions

Where does response time data live in a practice?

Response time data usually lives in four places: the phone system’s call log, which shows inbound and missed call times; call tracking reports; form notification emails or the form tool’s entry log; and the CRM, where staff record attempts and outcomes. Beacon recommends pulling all four into one weekly list.

How should after-hours inquiries be counted?

After-hours inquiries should keep their real arrival time so the record stays honest. Beacon recommends reporting them in a separate column and also measuring from the next opening time, which shows whether the first-morning callback happens fast. High after-hours volume makes the case for extended coverage or an answering service.

Measurement is the first step in the broader follow-through fix described in Are You Ghosting Your Own Leads?

Behavioral health leads go cold faster because the person reaching out may be in a hard stretch, is encouraged to contact several practices at once and can book with whichever one offers a real conversation first. A practice cannot count on that moment lasting. A fast, human first response with an actual appointment time keeps more leads warm.

Why do people seeking behavioral health treatment contact several practices at once?

People seeking behavioral health treatment contact several practices at once because reaching one that answers and has an opening is hard. In a secret shopper study published in The American Journal of Managed Care in September 2025, callers reached only 2,152 of 6,657 directory-listed providers, and appointments were available with 321 of those providers (14.9%).

That study covered social workers, marriage and family therapists and counselors listed in Pennsylvania marketplace plans, and the mean wait for an offered appointment was 33.2 days. A July 2024 study in JAMA of psychiatric prescribers listed in Medicaid networks in four large cities found that only 18 percent of sampled clinicians “were reachable, accepted Medicaid and offered an appointment,” Weill Cornell Medicine reported.

Senior author William Schpero, PhD, assistant professor of population health sciences at Weill Cornell Medicine, said that “even among psychiatrists listed as participating in Medicaid, actual access to care is apparently quite low.” Against odds like these, calling several practices is a reasonable strategy.

Why does the first practice to respond often get the appointment?

The first practice to respond often gets the appointment because people seeking care are told to keep going until someone can see them. NAMI’s guide to finding a mental health professional advises getting at least three names and numbers, booking an appointment even when the wait is long and then calling the second and third numbers on the list.

The same guide adds, “You can always cancel your first appointment if you find someone who can help you sooner.” A practice that returns an inquiry two days later may be calling someone who already has a time on another practice’s calendar.

That urgency separates behavioral health from most purchases. A homeowner collecting roofing quotes can usually wait a week for a callback without much changing. NAMI tells anyone who feels they can’t wait weeks or months for help to see a primary care doctor as soon as possible. Beacon treats the readiness behind every inquiry as something that can pass.

How can a practice keep behavioral health leads from going cold?

A practice keeps behavioral health leads from going cold by making the first response fast, human and concrete. Beacon’s published standard is a response within five minutes of a new inquiry, three minutes ideal. That response should come from a person who can offer an actual appointment time rather than a promise to call back later.

Meeting that standard starts with decisions only the owner can make. Someone has to own new inquiries during every business hour, the calendar has to hold open new-client slots each week, and inquiries that arrive after hours need a named owner for the next business day.

Practices do fall short of it. A Beacon audit of a client’s inquiries found leads that were never returned at all. The broader reasons leads stall are covered in Here’s Why Your Leads Aren’t Turning into Clients.

What does this answer not cover?

This answer covers why outpatient behavioral health inquiries lose momentum and what an owner can change about the first response. It does not cover clinical triage, crisis response or level-of-care decisions, which belong to licensed clinicians and to the practice’s own protocols.

The access figures come from specific settings: marketplace plans in Pennsylvania and Medicaid networks in four large cities. They show how hard it can be to reach a clinician in those settings and say nothing about how any single practice performs. The roofing comparison is illustrative and does not rest on measured data from other industries.

This answer also does not apply in the same way to referral-only programs or practices that keep a deliberate waitlist. Nothing here promises a specific number of booked clients.

Frequently asked questions

Is a fast response enough to keep a behavioral health lead warm?

Speed alone may not keep a behavioral health lead warm. The person may already have other appointments on hold, as NAMI’s guidance recommends, so the first response should include an actual appointment time with a suitable clinician. A fast call that ends with a promise to follow up leaves the lead where it was.

Does a waitlist make behavioral health leads go cold?

A waitlist can make behavioral health leads go cold when it is the only thing offered at first contact. NAMI advises people to book an appointment anyway and keep calling other practices, so a waitlist spot may not hold the person. Offering a specific date, even a later one, gives them something concrete.

What these cold leads cost an owner is laid out in The Lead You Never Called Back Is Still on Your Balance Sheet.

An unreturned inquiry costs a practice twice: the marketing money spent to generate it, and the expected revenue from a client who never books. Cost per inquiry is monthly marketing spend divided by monthly inquiries. Lost value is expected sessions per new client, times average reimbursement per session, times the share of inquiries that normally become clients.

What is a new client worth to a behavioral health practice?

A new client is worth the revenue from every session that client attends. The working figure is expected sessions per new client multiplied by average reimbursement per session. A practice can pull both numbers from the past year of its own EHR or billing reports, split by payer where the mix varies.

Session rates vary widely by payer. A study published in Health Affairs Scholar in September 2024 found that cash pay rates “for a typical session averaged $143.26, compared to $82.77 in Medicaid,” based on psychotherapist directory listings collected in late 2023. The authors noted they did not have data on commercial prices.

That spread is the reason to use the practice’s own payer mix. A mostly Medicaid practice and a mostly self-pay practice will put very different values on the same lost inquiry, and commercial plan rates vary again.

Why is one inquiry worth less than one full client?

One inquiry is worth less than one full client because not every inquiry books and not every new client stays. The expected value of an inquiry is a client’s revenue multiplied by the share of inquiries that normally become clients. For example, a practice that converts 40 percent of its inquiries should count 40 percent of a client per inquiry.

Sessions per client also shift over time. Describing national psychotherapy trends from 2018 to 2021, Mark Olfson, MD, MPH, a professor of epidemiology and psychiatry at Columbia University Mailman School of Public Health, said, “A decrease in the fraction of patients with just one or two psychotherapy visits further suggests there was a decline in early drop-out.”

For a single practice, early drop-out and no-shows shrink the expected session count. Using the practice’s own average, including clients who came only once, keeps the estimate honest.

What does the full calculation look like?

The full calculation puts two numbers side by side: the marketing spend already sunk into each inquiry and the expected revenue that inquiry carried. The table below is an illustrative example with round numbers chosen to show the method. The figures are not benchmarks and do not describe any real practice.

At that pace the example practice loses $57,000 a year in wasted spend and expected revenue. Unreturned leads do happen: a Beacon audit of a client’s inquiries found leads that were never returned. Why the first response carries so much of the budget is covered in The First Phone Call Is Your Whole Marketing Budget.

What does this answer not cover?

This answer covers a revenue-based way to estimate what an unreturned inquiry costs a practice. It does not measure profit. Clinician pay, overhead and billing costs come out of every session, so owners who want a margin view should apply their own margin to the expected value.

It leaves out referral value, returning clients and the human cost to a person who reached out and heard nothing. It is also not accounting, tax or valuation advice, and owners should review these numbers with their accountant before using them in financial planning.

The dollar figures in the example are round numbers chosen to show the method. The only published figures here are the session rates from the cited study, which reflect late 2023 directory listings and may differ from what a given practice is actually paid.

Frequently asked questions

What if a practice doesn’t know its conversion rate?

A practice that doesn’t know its conversion rate can estimate it from one recent month: count every inquiry, then count how many of those people attended a first session. The rough share is enough to start the calculation, and repeating the count each month makes the estimate more reliable.

Should cost per inquiry be calculated by channel?

Cost per inquiry can be calculated by channel by dividing each channel’s spend by the inquiries that channel produced. Paid search, directory listings and referral programs can cost very different amounts per inquiry, and running the numbers separately shows which unreturned inquiries were the most expensive to lose.

The owner-level case for treating these losses as money on the books is in The Lead You Never Called Back Is Still on Your Balance Sheet.

Many prospective patients don’t call back because reaching out once took real effort, and a missed return call asks them to find that effort again. Stigma, no privacy at work and phones that screen unknown numbers all add friction. Consented texting, clear caller ID, discreet voicemails and repeat attempts bring more of them back.

Why is calling back so hard for a prospective patient?

Calling back is hard for a prospective patient because reaching out at all can take real effort. NAMI’s guide to finding a mental health professional says the step of finding a mental health professional “sometimes feels like a challenging one,” and it suggests that people who are reluctant to call ask a friend or family member to call for them.

Stigma adds weight. In a NAMI and Ipsos poll released in March 2026, almost half of the 2,153 full-time employees surveyed said they worry they would be judged for sharing potential mental health challenges with their colleagues. Megan Delp, director of workplace mental health at NAMI, said in the release that “real barriers persist in the form of stigma and fear of retaliation or lost opportunities.” Someone carrying that worry has already pushed past it once to fill out a form. A second call is the same obstacle again, with less momentum behind it.

What gets in the way when a practice returns the call?

Two obstacles get in the way when a practice returns a prospective patient’s call. The person may be at work and unable to talk openly, and the practice’s number may look like any other unknown caller.

Privacy at work is the first. A return call that rings at a desk or in an open office asks the person to discuss something private within earshot of coworkers, the same colleagues almost half of the NAMI poll respondents worried would judge them.

The phone itself is the second. The Federal Trade Commission’s guidance on blocking unwanted calls describes call labeling that flags calls as “spam” or “scam likely,” along with Do Not Disturb settings that send calls straight to voicemail. A practice number the person never saved can land in either place.

Both obstacles can grow as the callback slips. Someone who reached out on a lunch break may be at a desk, in a meeting or driving when the return call comes.

What can a practice do to make the second contact work?

A practice makes the second contact work by letting the prospective patient answer on their own terms. That means a text option for people who have agreed to receive texts, a caller ID the person can recognize, a voicemail that reveals nothing private and more than one attempt before an inquiry is closed.

Add an optional text-consent checkbox to the inquiry form so someone at work can reply without speaking. Ask the phone provider whether outbound calls can display the practice name, and call from the number printed on the website. Keep the voicemail script neutral, with nothing that hints at why the person reached out.

Then plan every attempt after the first. Beacon has observed that the first call to a new inquiry often reaches voicemail, and that one attempt then gets logged as “contacted.” The wider set of reasons inquiries stall is covered in Here’s Why Your Leads Aren’t Turning into Clients.

What does this answer not cover?

This answer covers routine follow-up on new, non-urgent inquiries to an outpatient behavioral health practice. It does not cover clinical screening, triage, crisis response or how licensed staff should assess a new patient. Those decisions belong to clinicians and to the practice’s own protocols.

It also does not cover the rules for calling, texting or leaving messages, including consent requirements under federal and state telemarketing laws and privacy obligations under HIPAA. This is general information, not legal advice; talk to your privacy counsel before changing how the practice contacts prospective patients.

It does not set a follow-up schedule or predict how many inquiries a given practice will recover. The behavioral points come from the named sources; Beacon’s observations come from its own work with practices. Results depend on staffing, hours, payer mix and local demand.

Frequently asked questions

Should a practice text a prospective patient who hasn’t called back?

A practice can text a prospective patient who has agreed to receive texts, usually through a checkbox on the inquiry form. Keep the message short, name the practice, include a callback number and leave out anything clinical. Consent rules vary by state and channel, so confirm the approach with privacy counsel first.

What should a voicemail to a new inquiry say?

A voicemail to a new inquiry should give the staff member’s first name, the practice name, a direct callback number and the hours someone will answer. It should say nothing about why the person reached out, because someone else may hear the message on a shared phone, a car speaker or a family voicemail box.

The owner-level math on what these missed callbacks cost is in The Lead You Never Called Back Is Still on Your Balance Sheet.

Google Analytics is risky on a behavioral health website because of how Google Analytics and HIPAA fit together: Google does not offer a business associate agreement for the product and tells HIPAA-regulated customers not to use it in ways that create HIPAA obligations for Google. Its default setup also records page addresses, page titles, and form activity.

What does Google say about using Google Analytics under HIPAA?

Google’s position is direct. Its help page on HIPAA and Google Analytics states that Google “does not offer Business Associate Agreements in connection with this service” and that customers “must refrain from using Google Analytics in any way that may create obligations under HIPAA for Google.” The same page says authenticated pages “are likely to be HIPAA-covered” and should not carry Google Analytics tags.

Google’s warning matters because these tools are everywhere on health websites. A peer-reviewed study by Rutgers Business School researchers, published in December 2025, examined US hospital websites from 2012 to 2023 and found that “66% of the sample employed pixel tracking,” and that third-party pixel use significantly increased data breach risk. The study covered hospitals, and the same analytics and advertising tags can run on any practice website.

Which Google Analytics fields create exposure on a practice website?

Google Analytics creates exposure through the fields it sends automatically on every page, plus optional features a practice or its web developer may have switched on years ago. Google documents the automatic ones in its lists of automatically collected events and parameters:

• Page URL and path, including query parameters such as ?service=adhd-testing
• Page title and the referring page
• Form start and submit events, with form names and destinations
• A cookie-based client ID that recognizes a returning browser
• User-ID, if enabled, which links activity across sessions and devices
• Google Signals, which associates data with signed-in Google users

Google says Google Analytics 4 does not log or store IP addresses, but the visitor’s browser still sends each event straight to Google. On a practice website, a URL like /anxiety-therapy/book combined with a returning-browser ID can describe why someone came.

What should a practice do instead?

A practice should start by finding every place Google Analytics runs, then remove it from patient portals, booking pages, intake forms, and any page where someone can be identified as seeking care. Many practices have never looked. Hilal Atasoy, an associate professor at Rutgers Business School who led the study, said: “Sometimes organizations may not even be questioning every single use of tracking pixels. It’s kind of part of the whole data analytics suite.”

Next, turn off Google Signals, leave User-ID off, and check URLs and page titles for condition names. For measurement that still feeds ad platforms, Beacon’s standard is a server-side setup, under a signed agreement with the tracking provider, that removes names, contact details, and health information, hashes the visitor’s IP address, and forwards only a generic conversion, as explained in What Is Server-Side Conversion Tracking and Why Does Healthcare Need It?

What does this answer not cover?

This answer describes how Google Analytics collects data and what Google says about HIPAA. It does not decide whether a particular website meets HIPAA or any other law. This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

The law on public pages is contested. HHS guidance on online tracking technologies was partly vacated by a federal court in Texas in June 2024, for public pages that connect an IP address to a visit about a health condition. The guidance still says tracking on user-authenticated pages “generally” has access to PHI, and it treats its appointment-booking example as a disclosure of PHI. FTC rules, state privacy laws, and 42 CFR Part 2 are outside this page’s scope.

Frequently asked questions

Can a practice keep Google Analytics on its blog?

Possibly. Google’s guidance says authenticated pages and pages related to providing care are likely to be HIPAA-covered and should not carry Google Analytics tags. A general blog post sits further from care than a booking page, but its URL, title, and cookie data still travel to Google. Beacon’s standard keeps tracking off booking, intake, and portal pages.

Does IP masking make Google Analytics safe?

IP masking alone does not solve the problem. Google says Google Analytics 4 already does not log or store IP addresses, yet page URLs, page titles, form events, and cookie identifiers still reach Google. The exposure on a practice website usually sits in those fields, not only in the IP address.

Are there analytics tools that sign a BAA?

Some analytics and tracking providers do sign business associate agreements. Read what the agreement covers, which data and services it applies to, and who else receives the data before relying on it. What Is a Business Associate Agreement and When Do You Need One? explains the basics.

The difference between client-side and server-side tracking is where website data is processed. Client-side tracking runs vendor code in the visitor’s browser and sends data straight to each vendor, such as Meta or Google. Server-side tracking sends events to a server first, where rules can remove identifying and health details before anything is forwarded.

How does client-side tracking work on a practice website?

Client-side tracking works by loading a vendor’s script, such as the Meta Pixel or a Google tag, in every visitor’s browser. When a page loads or a button is clicked, the browser sends that event directly to the vendor. The practice’s website never sees or edits that data, so whatever the tag collects is what the vendor receives.

Each additional tag adds another vendor. As Maria Zhang, a doctoral candidate at Rutgers Business School and co-author of a study on hospital pixel tracking, put it: “The problem with third-party pixel tracking is that hospitals are sharing patients’ information with so many vendors.”

Defaults decide most of what gets collected. A 2026 study for the ACM Internet Measurement Conference compared Meta Pixel configurations on about 18,000 health-related websites and a control group from 2017 to 2024. It found that features collecting button clicks, page metadata, and first-party cookie identifiers reached adoption rates of up to 98.4%, “largely driven by the Pixel’s default settings.”

How does server-side tracking work?

Server-side tracking moves the collection step off the visitor’s browser. The website sends events to a server container, and that server decides what goes to each ad or analytics platform. Google’s documentation says a server container “runs on a server that you control,” and that only the operator has access to the data “until you choose to send it elsewhere.”

For a behavioral health practice, that control point is where identifying details come out. Beacon’s server removes names, emails, phone numbers, and device or cookie identifiers, along with condition, service, and form detail and any page address that names a condition. The IP address is hashed, and only a generic conversion, such as “appointment request,” goes on.

Hashing is one layer, so contact details are removed outright. Staff in the FTC’s Office of Technology wrote in July 2024 that “hashes aren’t ‘anonymous’ and can still be used to identify users.” The mechanics for paid media are covered in what server-side conversion tracking is and why health practices need it.

How do client-side and server-side tracking compare side by side?

Client-side and server-side tracking can both report conversions, but they handle data very differently at each step. The table below compares the two setups on the points a practice owner or office manager is most likely to ask about first.

One caution belongs with the table. A server can forward identifying data as easily as it can remove it, so a poorly configured server moves the same exposure to a new location. The protection comes from the removal rules on it and the agreements with whoever runs it.

What does this comparison not cover?

This comparison explains how the two tracking methods move data. It does not decide whether a specific practice’s setup meets HIPAA, FTC rules, state privacy laws, or 42 CFR Part 2 for substance use disorder programs. This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

The status of tracking on public pages is contested. HHS guidance on online tracking technologies says tracking on user-authenticated pages “generally” has access to PHI, and in June 2024 a federal court in Texas vacated the part covering certain public pages. The guidance treats its appointment-booking example as a disclosure of PHI, and Beacon’s standard keeps tracking off booking, intake, and portal pages under either method.

Frequently asked questions

Does server-side tracking make a website HIPAA compliant?

No. Server-side tracking is a method of routing data, and HIPAA compliance remains the practice’s obligation as the covered entity. A server that forwards names, email addresses, full URLs, or health details, hashed or not, creates the same exposure as a browser pixel.

Can a practice run both methods at the same time?

Technically yes. Keeping the browser pixel alongside a server setup means the client-side data flow still exists. Beacon’s standard for client paid media is server-side conversion tracking in place of client-side ad pixels, under a signed business associate agreement with the tracking provider.

Who usually sets up server-side tracking?

A developer, an agency, or a tracking provider usually builds and maintains it, because it involves a server, tagging rules, and platform connections. The practice’s role is to approve which events are sent, confirm what is removed or hashed, and keep the signed agreements on file.

When a practice website leaks patient data, HIPAA places the primary obligation on the practice as the covered entity, even if an agency or web vendor built the site. Vendors that handle protected health information (PHI) are business associates with direct duties of their own, and those duties sit alongside the practice’s own obligations.

Who is the covered entity, and who is a business associate?

The covered entity is the practice, when it is a provider that HHS describes as transmitting information electronically in a standard transaction, such as insurance billing. A business associate is a vendor that creates, receives, maintains, or transmits PHI on the practice’s behalf. The HHS Office for Civil Rights (OCR) bulletin on online tracking says a tracking vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.”

OCR’s July 2025 settlement with a behavioral health provider began with a website exposure caused by a technical mistake: a coding error in a discontinued patient portal pilot left discharge summaries for 35 people publicly accessible online. The provider paid $225,000 and agreed to a two-year corrective action plan.

“An accurate and thorough HIPAA risk analysis can minimize the exposure of ePHI from both malicious actors and inadvertent errors.” Paula M. Stannard, Director of the HHS Office for Civil Rights, in that settlement announcement

What does a business associate agreement transfer to the vendor?

A business associate agreement (BAA) sets the vendor’s permitted uses of PHI and its duty to protect and report. It adds a second party with obligations, and the practice’s own obligations stay in place. OCR’s fact sheet on business associate liability lists what vendors answer for directly, including “Impermissible uses and disclosures of PHI” and “Failure to provide breach notification to a covered entity or another business associate.”

The practice still has to act on what it knows. Under 45 CFR 164.504(e)(1)(ii), a covered entity that knew of a pattern of a vendor’s material breach is out of compliance unless it took reasonable steps to cure it or, if those failed, ended the contract where feasible.

Beacon’s earlier post, What Is a Business Associate Agreement and When Do You Need One?, covers when a BAA is required.

Who notifies patients when a vendor causes the leak?

The practice notifies patients, because HHS’s Breach Notification Rule summary places that duty on covered entities. They notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. They also notify the Secretary, and prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. Breaches affecting fewer than 500 people can be reported to the Secretary annually.

A business associate that has a breach must notify the covered entity without unreasonable delay and no later than 60 days from discovery. For a practice owner, the practical question is whether each website vendor would report a tracking problem quickly, and whether the contract says how fast.

What does this answer not cover?

This page describes how HIPAA divides responsibility between a practice, its agency, and its web vendors. It does not address who pays for a breach, whether a practice can recover costs from a vendor, or how insurance responds, which turn on contracts and state law.

This page also does not cover practices that are not HIPAA covered entities, substance use disorder programs under 42 CFR Part 2, or duties under FTC and state privacy laws, which can apply on separate terms. It does not assess any specific website or predict the outcome of any pending case. No vendor or tool makes a practice compliant; the obligation stays with the practice.

This page is general information about how HIPAA assigns responsibility for website data and what regulators have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

Is a web developer always a business associate?

Under HHS’s definition, a web developer is a business associate only if it creates, receives, maintains, or transmits PHI for the practice. A developer who builds a brochure site with no forms or tracking may not be. One who hosts intake forms or manages tags that capture patient information likely is.

Does a signed BAA protect the practice if the vendor makes a mistake?

A signed BAA gives the practice contractual promises and makes the vendor’s duties explicit. The practice’s obligations as covered entity remain, including breach notification to patients. Under 45 CFR 164.504(e), the practice must also act if it knows of a pattern of material breach by the vendor.

What should a practice ask its agency about website tracking?

Beacon’s working standard is to ask for a written list of every tag on the site, what each sends, and which pages it fires on. The agency should also confirm that tracking stays off booking, intake, and portal pages, exactly what reaches an ad platform and what is hashed or removed first, and which vendors have signed BAAs.

The case for treating these choices as the owner’s decision is made in The Tracking Code on Your Website Is a Legal Decision.