Insights · Question
Does HIPAA apply to our marketing website?
It can, and the question is now a live one. The US Department of Health and Human Services has published guidance on the use of online tracking technologies by HIPAA covered entities and business associates, treating certain transmissions of visitor data from health-related pages to third parties, such as advertising and analytics platforms, as potential disclosures of protected health information. Whether and how it applies to a specific site is a determination for counsel. What is not in doubt is the practical response: inventory every tag, remove what sends visitor behavior to third parties without a lawful basis, implement cookieless measurement, and document the data flows.
In more detail
The reasoning.
The exposure is highest for appointment, condition, symptom and treatment pages, patient portals and any page where the visitor’s identity can be combined with health-related browsing. Practices in mental and behavioral health are under particular attention.
Privacy-respecting measurement covers what decisions require: sessions, sources, inquiries by source, cost per qualified inquiry, share of voice. The surveillance precision given up was never lawful to rely on.
See privacy-respecting analytics for regulated practices, the privacy and consent checklist for practice websites, HIPAA readiness and the medical and dental groups security edition.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days