US Regulators Target Tracking Pixels on Health Sites

What Changed

In December 2022, the Office for Civil Rights at the US Department of Health and Human Services (HHS) issued a bulletin on tracking technologies. It said hospitals and other organizations covered by HIPAA, the federal health privacy law, could breach it by using pixels and cookies that send patients' information to third parties, even on public web pages. Under that view, tracking vendors would need HIPAA agreements with providers, or patients would have to authorize the tracking. Almost every provider used tools from Google and Meta on its public site, and class actions against providers followed.¹

A court narrowed the bulletin. In June 2024, a federal court in Texas ruled that HHS had exceeded its authority and vacated key parts of it, including the position that data such as IP addresses collected on public, unauthenticated pages counts as health information. HHS withdrew its appeal that August.² The ruling concerned public pages, not pages behind a patient login.¹

Beyond HIPAA

Many health and wellness apps and sites aren't covered by HIPAA, and other rules reached them. In February 2023, the Federal Trade Commission brought its first case under its Health Breach Notification Rule against GoodRx, a prescription discount and telehealth company. It alleged that GoodRx had shared the health information of millions of users with advertisers without their authorization. GoodRx agreed to pay a $1.5 million penalty and was barred from sharing that information with third parties for most advertising.³

Washington went further. Its My Health My Data Act, the first US privacy law focused on health data outside HIPAA, applies to most businesses from March 31, 2024.⁴ It requires opt-in consent, given separately, before collecting consumer health data and before sharing it, unless the processing is necessary, and it limits geofencing around places where people receive in-person health care.⁵ Health data includes inferences: the state attorney general said buying toiletries isn't health data, but inferring from such purchases that a specific person is pregnant is.⁶

Why It Mattered

Health is where tracking pixels became a legal liability, not just a measurement question. A page view on a condition page, an appointment confirmation or a search on a clinic's site can reveal health information, and sending it to an ad platform can break federal or state law.

For health, wellness and pharma marketers, that is a stricter version of the gap elsewhere on this timeline: some conversions can't be sent to ad platforms without specific consent, or at all.