Insights · Field note · Growth and AI visibility
Privacy-respecting analytics for regulated practices
A medical, legal or financial practice can measure what it needs without sending visitor behavior to advertising platforms. Regulators now expect it to.
Regulated practices handle sensitive inquiries, and the tracking technology on their websites is under specific regulatory attention. The U.S. Department of Health and Human Services has published guidance on the use of online tracking technologies by HIPAA covered entities, treating certain transmissions of visitor data to third parties as disclosures. Privacy-respecting analytics measures sessions, pages, sources and conversions without third-party cookies or data sent to advertising platforms, captures inquiries with consent and retention, and documents the data flows for the privacy program. It covers what decisions require; the surveillance precision it gives up was never lawful to rely on.
In detail
What the evidence shows.
What regulators have said
HHS guidance addresses tracking technologies on websites and apps of covered entities and business associates, including the circumstances in which information collected through them is protected health information. Other regulators and state laws apply similar reasoning to other sensitive categories. The practical effect is that a tag sending page visits and identifiers to an advertising platform from a health-related page is a compliance event, not a marketing default.
What can still be measured
Sessions, pages, sources, referrers and conversions through cookieless, first-party analytics. Inquiries by source through form, booking and call attribution that does not require recording. Cost per qualified inquiry by source. Share of voice and citations, which involve no visitor data at all. Everything a budget decision needs.
What is removed
Third-party tags that send visitor behavior to advertising and social platforms without a lawful basis. Session recording and heatmaps on sensitive pages. Chat and scheduling widgets whose vendors have not been reviewed. Consent banners that are theater rather than choice. The tag inventory finds them; the removal record documents what changed.
Doing it properly
With the privacy lead and counsel: applicability, lawful basis, consent where required, retention, an accurate notice, and data flow documentation for the records. The privacy and consent checklist covers the steps; see privacy-respecting analytics and lead capture.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days