In this guide
- HIPAA protects protected health information (PHI) held by covered entities and their business associates.
- Tracking tags that send identifiers plus health context to vendors can create disclosures. Vendors that handle PHI need a business associate agreement (BAA).
- Work with compliance and legal. Default to less tracking, no ad pixels on authenticated or sensitive pages and vendors that sign a BAA where needed.
Health websites and apps in the United States carry special obligations. A marketing tag that is harmless on a shop can be a problem on a patient portal. This page explains the issues at a high level and the safer patterns. It is general information, not legal advice, and HIPAA applications depend on facts. Involve your privacy officer and legal counsel. See also personally identifiable information, data loss prevention and DORA and tracking vendors for the financial-sector equivalent.
The basics
- Covered entities are health plans, healthcare clearinghouses and most healthcare providers. Business associates handle PHI on their behalf.
- PHI is individually identifiable health information. An IP address or a cookie ID can become PHI when connected to a health context, such as a visit to a page about a condition or an appointment booking.
- A vendor that creates, receives, maintains or transmits PHI for you is generally a business associate and must sign a BAA.
Check your tracking in one pass
This is an example. Run the check on your own site to see where yours stands.
What regulators and courts said
In late 2022 the US Department of Health and Human Services published guidance on online tracking technologies used by regulated entities, which it later updated. In 2024 a federal court vacated part of that guidance, concerning tracking on certain public pages, after a challenge by hospital associations. The legal picture continues to develop. The core point remains: sending PHI to a vendor without a legal basis and, where required, a BAA is a risk. Ask counsel for the current position.
Safer patterns
| Situation | Safer approach |
|---|---|
| Patient portals and booking flows | No advertising pixels. Use only tools covered by a BAA, if any, and minimal analytics |
| Public information pages | Limit to privacy-friendly analytics; avoid sending identifiers with health topics to ad platforms |
| Forms | Never send field values to analytics or ad tools |
| Ad measurement | Aggregate measurement without personal identifiers, as advised by counsel |
| Server-side tracking | Use a container to strip fields and IP before data goes to vendors, with the host's agreement and your policy |
3 things to remember
Scroll and the points stack up.
HIPAA protects protected health information (PHI) held by covered entities and their business associates.
Tracking tags that send identifiers plus health context to vendors can create disclosures. Vendors that handle PHI need a business
Work with compliance and legal. Default to less tracking, no ad pixels on authenticated or sensitive pages and vendors that sign a
What a server container can and cannot do
A server container lets you control what leaves your systems: remove URL parameters, drop fields, anonymise the IP and allow only specific vendors. That supports minimisation. It does not make a vendor HIPAA-compliant and it does not replace a BAA with the vendors that touch PHI. Open Tracked's Anonymizer (every plan) can zero or remove the IP, and transformations can strip fields. We do not offer a business associate agreement on our published plans; if you need one, ask before you buy.
Checklist for a health site
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
Frequently asked questions
Is server-side tracking HIPAA compliant?
Not by itself. It helps control what is sent, but vendors that handle PHI need business associate agreements and your use must meet HIPAA.
Can I use Google Analytics or the Meta pixel on a health site?
Be very careful. Do not send PHI to vendors without a legal basis and a BAA where required. Ask your counsel.
What is a BAA?
A business associate agreement, a contract that sets out how a vendor handling PHI must protect it.
Does Open Tracked sign BAAs?
Not on its published plans. Ask before you buy if you need one.
What should I remove first?
Advertising pixels on authenticated and sensitive pages, and any field values or health terms sent in URLs.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Integrations · 6 min read