Many clinics and therapy practices install Google Analytics, a Meta pixel or a chat widget without thinking twice, because every marketing guide says to. For US healthcare providers covered by HIPAA, that can create real risk. This guide explains HIPAA website tracking in practical terms: what the HHS guidance is about, where the risk usually sits on a clinic website, and how to measure marketing more safely. It is not legal advice; talk to your privacy officer or counsel about your specific setup.
Quick answer: HHS guidance says tracking technologies on websites of HIPAA-regulated entities can disclose protected health information to vendors in some situations. The highest-risk places are patient portals, appointment booking and forms that collect health details. Review what runs on those pages, remove or restrict third-party trackers there, use vendors that will sign a business associate agreement where needed, and document your decisions.
What the HHS guidance covers
The US Department of Health and Human Services Office for Civil Rights published guidance on the use of online tracking technologies by HIPAA covered entities and business associates, and updated it in March 2024 (HHS.gov). Parts of the guidance were later affected by a federal court decision, so the legal picture continues to evolve. What has not changed is the underlying concern: tracking tools can send information about people and their health-related activity to third parties.
Where the risk usually sits on a clinic website
| Area of the site | Typical risk |
|---|---|
| Patient portal and logged-in areas | High: pages relate directly to a patient’s care |
| Appointment booking and intake forms | High: can reveal that a person is seeking a specific service |
| Symptom or condition pages with forms | Medium to high, depending on what is collected and tracked |
| General pages like About or Careers | Lower, but review which tools run there |
Tracking scripts can capture page URLs, button clicks, form interactions and device details. On a booking page for a specific condition, that combination can be sensitive.
Common tools to review
- Advertising pixels such as Meta, TikTok or LinkedIn.
- Google Analytics and Google Tag Manager containers.
- Session recording and heatmap tools.
- Chat widgets and chatbots.
- Embedded booking or form tools from third parties.
- Call tracking that records or transcribes calls.
A practical review process
- Inventory. List every script and embed on the site and which pages it runs on. Tag Manager, your theme and plugins can all add scripts.
- Map sensitive pages. Identify portal, booking, intake and condition-specific form pages.
- Decide per tool. For each tool on sensitive pages: remove it, restrict it, or use a vendor that signs a business associate agreement (BAA) and supports the use.
- Check forms. Make sure form submissions go to a compliant system, not a plain email inbox, when they include health information.
- Document. Record what you changed and why, and review whenever you add a new tool.
Measuring marketing without oversharing
Clinics still need to know which channels bring patients. Safer options many practices use include:
- Keeping analytics on general marketing pages and excluding sensitive pages.
- Measuring bookings through your practice management system rather than a pixel.
- Server-side or privacy-focused analytics tools, used with care and proper agreements where needed.
- Asking “How did you hear about us?” at intake.
Do not assume a tool is safe because it says “HIPAA compliant” on its website. Check whether it will sign a BAA for your use case.
Don’t forget security and accessibility
A secure site matters too: keep WordPress, plugins and themes updated, use strong logins, and monitor for malware. Accessibility is part of a trustworthy healthcare site as well; the US Department of Justice has published guidance on web accessibility under the ADA (ADA.gov).
If you are building or redesigning a clinic site, see what parents need from a pediatric therapy website for structure and content.
How I can help
I audit clinic and therapy websites for the technical side of this: which scripts load on which pages, what forms send and where, and how Tag Manager is configured. I then make the agreed changes and set up measurement your privacy officer is comfortable with. I do not give legal advice; I give you a clear technical picture to review with your counsel. See my WordPress care and security services, or get in touch.
Frequently asked questions
Can a clinic use Google Analytics under HIPAA?
It depends on how and where it is used. Many practices keep it off sensitive pages or use alternatives. Review with your privacy officer, since Google Analytics is not typically covered by a BAA.
Is the Meta pixel allowed on healthcare websites?
Advertising pixels on booking, portal or condition-specific pages carry significant risk. Many healthcare organisations have removed them from those pages.
Does HIPAA apply to every therapist’s website?
HIPAA applies to covered entities and their business associates. Many therapists who bill insurance electronically are covered. Confirm your status with a qualified advisor.
Are website contact forms HIPAA compliant?
A standard contact form that emails health details to a regular inbox is generally not appropriate. Use a compliant form tool with a BAA for health information.
How can clinics track marketing safely?
Measure on non-sensitive pages, use your practice system for booking data, consider privacy-focused tools with proper agreements, and ask patients how they found you.
