Skip to content
The tracking code on a behavioral health practice’s website is a legal decision because it controls what information about people seeking care leaves the practice and who receives it. Regulators and plaintiffs’ attorneys have increasingly treated that flow as the practice’s responsibility, even when someone else installed the code. Leaving a default in place is still a choice, and the owner is the one who carries it.
I know how most owners hear that. The Meta pixel and the Google tag feel like marketing settings, something a web developer or an agency switched on years ago so the ads would work. Nobody sat in a meeting and voted to send appointment data to Facebook.
That’s exactly the problem. Nobody decided. It happened by default, and a default is still a decision.
How did a marketing setting turn into a legal decision?
It comes down to what tracking code can see on a behavioral health website. A tag installed to measure ads also reports which pages a visitor viewed, what they clicked, and identifiers tied to their device. On a site about anxiety treatment or substance use care, that combination can describe a person looking for help.
Here’s how it usually happens. A practice launches a website, and the developer adds Google Analytics because every site has it. An agency comes in to run ads and adds the Meta pixel, because that’s how the platform measures results, and the ad platform’s own setup screens walk you right into it. Years go by. Two vendors later, nobody remembers who put what where.
It’s like a pothole on the road out of town. You hit it once, then you start steering around it without thinking, and after a while you don’t see it at all. It takes someone driving that road for the first time to say, “Whoa, what is that?”
This is common, and it’s been common for a long time. A study published in PNAS Nexus in December 2025 followed 1,201 U.S. hospitals from 2012 through 2023 and found that 66 percent of the sample used pixel tracking. The same researchers linked pixel use to a higher chance of a data breach, a 46 percent relative increase.
Those are hospitals with legal departments and compliance officers. If it happened to them, it can happen to a 20-person group practice that has neither.
“If your website sends patient data to an ad platform, odds are nobody at your practice decided it should. It happened by default, and a default is still a decision the owner carries.”
What does a tracking pixel actually send from a behavioral health website?
More than most owners would guess: the address of each page a visitor views, the buttons they click, activity on forms, and identifiers like IP address and browser cookies that connect one visit to the next. A page address like /eating-disorder-treatment/ tells the receiving platform what the visitor was reading about, and a submitted form can tie that to a name.
The U.S. Department of Health and Human Services spelled this out in its guidance on online tracking. The HHS Office for Civil Rights bulletin states that “tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI,” meaning protected health information. That covers patient portals, logged-in scheduling, and anything else behind a password.
Public pages are a more contested question, and I want to be straight with you about that. In June 2024, a federal court in Texas vacated part of that HHS guidance, the part treating an IP address plus a visit to a public page about a health condition as enough on its own to trigger HIPAA. HHS notes the ruling on the bulletin itself. The rest of the guidance is still posted, and the ruling didn’t address the FTC or state privacy laws.
So here’s the honest version. Some of this is settled, some of it is being argued in court, and none of it is a green light. We go deeper on the specifics in Is the Meta Pixel HIPAA Compliant? and Why Is Website Tracking a HIPAA Risk for Behavioral Health Practices?
Who is treating website tracking as a legal issue?
Two groups every practice owner should pay attention to: federal regulators and plaintiffs’ attorneys. HHS and the Federal Trade Commission have warned providers directly, the FTC has taken action against mental health companies over sharing data with advertising platforms, and class actions over tracking technology have ended in multimillion-dollar settlements.
In July 2023, the FTC and HHS sent a joint letter to roughly 130 hospital systems and telehealth providers warning them about tools like the Meta pixel and Google Analytics. Melanie Fontes Rainer, then Director of the HHS Office for Civil Rights, said in the announcement: “Although online tracking technologies can be used for beneficial purposes, patients and others should not have to sacrifice the privacy of their health information when using a hospital’s website.”
The FTC has also acted on companies in our corner of the world. In March 2023, it announced that BetterHelp would pay $7.8 million to settle FTC charges that it revealed consumers’ email addresses, IP addresses, and health questionnaire information to platforms including Facebook for advertising purposes. In April 2024, it announced a proposed order against Cerebral, charging that the company provided sensitive information of nearly 3.2 million consumers to third parties through tracking tools on its website and apps.
Then there are the private lawsuits. As reported, Advocate Aurora Health’s $12.225 million settlement in a pixel tracking case received final approval in 2024, and Novant Health settled a patient class action for $6.66 million that same year. Sutter Health’s $21.5 million settlement over alleged disclosures of patient information to third parties received final court approval in March 2026, according to the court-approved settlement notice.
You might be reading this thinking it’s a hospital problem. I’d push back on that. The tracking code works exactly the same way on a 15-clinician practice’s website. The only difference is who has a general counsel on speed dial.
“The tracking code on a 15-clinician practice’s website works exactly the way it works on a hospital’s. The difference is the hospital has a general counsel to call.”
Who is responsible for website tracking if an agency installed it?
You are. Even when an agency or developer installed the tracking, the responsibility sits with the practice. If the practice is a HIPAA covered entity, as practices that bill insurance electronically are, the obligation to protect patient information stays with the practice. Vendors that handle that information take on duties of their own as business associates, and those duties sit alongside the practice’s.
HHS is direct about this. Its bulletin says a tracking vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.” Skipping the agreement leaves the relationship in place and the protections out.
I’ll be the first to admit this one is uncomfortable to write, because agencies like ours are the ones in that sentence. Agencies install tags. It’s part of the job. That’s exactly why we think an owner should know what’s on the site, in writing, and why we’d rather you ask us hard questions than assume we’ve got it handled.
We break down who carries which responsibility in Who Is Responsible if a Practice Website Leaks Patient Data?, and the basics of the paperwork in What Is a Business Associate Agreement and When Do You Need One?
How does website tracking connect to what ad platforms learn from your leads?
Tracking and lead quality both decide what an ad platform learns, which is why this month picks up right where September left off. In September I wrote about why your ads keep finding the wrong people when they learn from every form fill. The obvious next question from any owner is whether sending a better signal back creates a HIPAA problem. That depends entirely on what gets sent.
The line we hold at Beacon is simple. Your ads can learn from what you count. What you count should never carry a person’s name, how to reach them, or what they came looking for.
In practice, that comes down to three rules:
- Tracking stays off booking, intake, and patient portal pages. Those are the pages where a visitor is acting as a patient or a prospective patient.
- No names, email addresses, phone numbers, conditions, page addresses, or form content go to an ad platform. None of it, in any form.
- What the platform receives is a generic event. Something like “an appointment request happened.” The only other thing that travels with it is the visitor’s IP address, and it’s hashed before it leaves.
Hashing scrambles a piece of data into a string of characters before it leaves your site. It’s a real protection, and it’s one layer. The FTC’s own technology staff wrote in July 2024 that hashing on its own “still creates a unique signature that can track a person or device over time.” That’s why the bigger protection is everything that never gets sent at all. A hash should never be the reason someone feels comfortable sending a name or an email address.
Stephanie’s piece this Thursday walks through how server-side conversion tracking handles this, and why pulling the pixel out entirely creates a different problem.
What should a practice owner do about website tracking this week?
Start with one request to whoever manages your website: a written list of every tag on it, what each one sends, and which pages it fires on. That list answers most of the questions that matter, and it puts the decision back where it belongs, with the owner.
Here’s what I’d ask, in writing:
- What tags are on our site right now, and who added each one? Every pixel, every analytics script, every chat widget.
- What does each one send, and to whom? Page addresses, form activity, identifiers. Ask for specifics.
- Do any of them fire on booking, intake, or portal pages? If yes, ask to have them removed.
- What exactly reaches an ad platform from our site, and what gets hashed or stripped out before it goes?
- Which of our vendors have signed business associate agreements? And which ones touch patient information without one?
You don’t need to understand the code to ask those questions. You need someone who can answer them plainly. If nobody can, that tells you something too.
One caution. Don’t rip everything out in a panic. Pull every tracking tag and you lose the ability to see which marketing is working, and you’re right back to guessing which marketing filled your schedule. There’s a way to measure that keeps names, contact details, and what someone was looking for out of the data, and we’ll get into what that looks like, and what it costs, later this month.
“You don’t need to understand the code. You need someone who can tell you, in writing, what your website sends and where it goes.”
Why does website tracking matter more in behavioral health?
A single page visit can reveal more on a behavioral health website than almost anywhere else. Someone reading about eating disorder treatment, addiction recovery, or a teen anxiety program at two in the morning is telling the website something deeply private, often before they’ve told anyone in their life. Every owner I know would protect that person in a session, and the website deserves the same standard.
Think about what it took for that person to land on your page. Weeks of wondering. Maybe a search they cleared from their history afterward. They’re trusting you before they’ve ever met you.
When the FTC announced its Cerebral order in April 2024, then FTC Chair Lina M. Khan described the company as “revealing their most sensitive mental health conditions across the Internet.” That’s the line that stays with me. Our field asks people to trust us with the hardest thing in their lives, and the first place they test that trust is the website.
“Our field asks people to trust us with the hardest thing in their lives. The first place they test that trust is the website.”
I’m not writing this to scare anybody. Every owner I know would want to see what their website sends. That’s the whole point. You can’t fix what nobody’s shown you, and once you’ve seen the pothole, you can’t unsee it.
Connection is what brings someone to your practice, and connection runs on trust. That trust starts long before the first phone call. It starts with what your website does with someone’s curiosity when they think nobody’s watching.
I’ll leave you with this one: When was the last time anyone at your practice looked at what your website sends out, and who did you ask?
Frequently asked questions
Is the Meta Pixel HIPAA compliant?
No practice should treat the Meta Pixel as HIPAA compliant. HIPAA compliance belongs to the practice, and the pixel’s exposure depends on which pages it fires on and what it sends. HHS guidance says tracking on logged-in pages generally has access to protected health information, which is why tracking belongs off booking, intake, and portal pages.
Did the 2024 court ruling make website tracking safe?
The June 2024 ruling in American Hospital Association v. Becerra vacated one part of HHS’s tracking guidance, covering IP addresses combined with visits to public pages about health conditions. The rest of the guidance remains posted, including its examples about patient portals and appointment booking, and the ruling did not address FTC rules or state privacy laws.
A cookie consent banner does not count as HIPAA authorization. The HHS tracking bulletin states that website banners asking visitors to accept or reject tracking technologies “do not constitute a valid HIPAA authorization.” State privacy laws set their own consent rules, and those rules vary from state to state.
Should a practice remove all tracking from its website?
Removing every tag protects privacy but also removes the practice’s ability to see which marketing produces clients. A more balanced approach keeps tracking off booking, intake, and portal pages and sends ad platforms only generic events with no names, contact details, conditions, or page addresses. Under Beacon’s standard, an ad platform receives a generic conversion event and a hashed IP address, and nothing else.
This article is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
