HIPAA Tracking Technologies: Pixels, Analytics and the OCR Bulletin After AHA v. Becerra

Short answer: HIPAA tracking technologies are pixels, tags, session replay scripts and SDKs that send user data to third parties. If they receive PHI from a covered entity or business associate, the vendor needs a BAA or another Privacy Rule permission must apply. A 2024 court ruling narrowed OCR's guidance for public pages, but portals and apps remain squarely in scope.

Related guides:

• How to build a HIPAA compliant website
• FTC Health Breach Notification Rule
• What is considered PHI under HIPAA?

Key takeaways

• The OCR bulletin still stands in part. A federal court vacated one specific theory about public webpages. The rest of the guidance remains on HHS's website.
• Authenticated pages and apps are the clearest risk. OCR says tracking on patient portals and on regulated entities' mobile apps generally has access to PHI.
• No BAA, no PHI. Before PHI reaches a tracking vendor, you need a business associate agreement or another permission, such as a valid HIPAA authorization.
• Promises to strip identifiers are not enough. OCR says a vendor agreeing to remove or de-identify PHI after receipt does not make the disclosure permissible.
• Outside HIPAA, other rules may apply. Health apps not covered by HIPAA should look at the FTC Health Breach Notification Rule and state health privacy laws.

What are tracking technologies under HIPAA?

A tracking technology is a script or code on a website or mobile app that gathers information about users or their actions.

That is the definition OCR uses in its bulletin, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. In practice it covers:

• Advertising and social pixels, such as the Meta pixel or other conversion tags that fire on page views and form events.
• Web analytics tags that log page paths, referrers, search terms and device details.
• Session replay scripts that record clicks, scrolls and sometimes typed form input.
• Tag managers that load other tags, often without an engineering review.
• Mobile SDKs for analytics, attribution, crash reporting or push messaging.

OCR notes that many of these tools send data directly to a third-party vendor. If that data is PHI, HIPAA governs the disclosure. Our guide to what counts as PHI covers the identifiers involved.

What does the OCR tracking technologies bulletin say?

The bulletin explains how the HIPAA Privacy, Security and Breach Notification Rules apply when covered entities and business associates use tracking technologies.

OCR first issued it in December 2022, a date confirmed in the July 2023 joint letter from OCR and the FTC to companies using tracking on websites and apps. OCR then revised it, and the court refers to the "HHS Bulletin of March 18, 2024" in its June 20, 2024 opinion. The current bulletin draws a line between page types:

Context	What the bulletin says
User-authenticated pages, such as patient portals and telehealth platforms	Tracking generally has access to PHI and must only use and disclose it as the Privacy Rule permits
Unauthenticated pages	Tracking on many of these pages does not have access to PHI, with exceptions such as appointment scheduling or symptom checker pages
Regulated entities' mobile apps	Information collected generally is PHI, including device and advertising IDs when combined with identifying information
Apps not offered by or for regulated entities	Not covered by HIPAA, though the FTC Act and the FTC Health Breach Notification Rule may apply

The bulletin also says website banners asking users to accept or reject tracking do not constitute a valid HIPAA authorization. It tells regulated entities to address tracking technologies in their risk analysis and risk management processes, and says OCR is prioritizing Security Rule compliance in its tracking investigations.

What did the court vacate in AHA v. Becerra?

The court vacated one theory: that HIPAA obligations are triggered when an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers.

In American Hospital Association v. Becerra, No. 4:23-cv-01110-P in the Northern District of Texas, the court called this the "Proscribed Combination." On June 20, 2024, it declared that part of the March 18, 2024 bulletin unlawful, holding it was promulgated in clear excess of HHS's authority under HIPAA, and vacated it. Three points stand out:

1. The holding is narrow. It turns on the statutory definition of individually identifiable health information. The court did not reach the hospitals' other arguments.
2. The rest of the bulletin was not vacated. A footnote says the vacatur does not limit the legal operability of other guidance in the document.
3. No injunction. The court denied a permanent injunction and granted declaratory relief and vacatur instead.

HHS filed a notice of appeal and then withdrew it. The American Hospital Association reported that HHS withdrew its notice of appeal on August 29, 2024. As of October 2026, the bulletin page on HHS.gov carries a note describing the vacated portion and stating that HHS is evaluating its next steps. We have not found a replacement bulletin.

What still clearly applies after the ruling?

Everything outside the vacated IP address plus public page theory still reflects OCR's stated position, and the underlying HIPAA rules apply regardless of any guidance.

Five points matter most:

• Authenticated pages. Patient portals, telehealth sessions, intake flows behind a login and billing pages are where OCR says tracking generally has access to PHI. The court's ruling did not address authenticated pages.
• Mobile apps offered by covered entities or their business associates. OCR treats information collected in these apps as generally PHI.
• Public pages where users enter information. Appointment scheduling and symptom checker pages can capture PHI, such as an email address with a reason for care. Login and registration pages also sit in this category in the bulletin. Treat these as higher risk.
• A permissible basis before disclosure. Under 45 CFR 164.502, you may disclose PHI to a business associate only with satisfactory assurances, which 45 CFR 164.504(e) requires to be documented in a business associate contract. Without that, or another permission such as an authorization, the disclosure is impermissible.
• De-identification promises. The bulletin states that it is insufficient for a tracking vendor to agree to remove PHI from the information it receives, or to de-identify PHI before the vendor saves it.

The bulletin also says an impermissible disclosure of PHI to a tracking vendor is presumed to be a breach of unsecured PHI unless a low probability of compromise is demonstrated.

Which tracking vendors need a BAA?

Any tracking vendor that will create, receive, maintain or transmit PHI on your behalf needs a BAA before that happens, whatever the tool category.

This planning aid works by tool category, not named vendor. Confirm BAA availability in writing for each vendor and product tier.

Tool category	What it may receive on PHI pages	If the vendor signs a BAA	If it will not
Advertising or social pixel	Page URLs, event names, form fields, IP and device IDs	Disclose only what the BAA and the Privacy Rule permit	Remove from authenticated pages, apps and PHI-capturing forms
Web analytics	Page paths, search terms, IP, device details	Configure to the minimum necessary	Remove from PHI pages or route through a BAA-covered intermediary
Session replay	Clicks, page content, possibly typed input	Mask all form fields and patient data views	Do not run on portals, apps or forms
Tag manager	Whatever the tags it loads collect	Treat each loaded tag as its own vendor	Lock down who can publish tags
Mobile SDK	Device and advertising IDs, in-app events	Limit events and parameters	Remove from regulated apps or obtain authorizations
Customer data platform	Raw events from your properties	Can de-identify before sending data onward	Not an option for PHI

The last row reflects an option the bulletin describes. If a tracking vendor will not sign a BAA, a regulated entity can use a customer data platform vendor that signs a BAA, de-identifies the PHI and passes only de-identified information onward. The bulletin adds that, without a business associate relationship, you cannot disclose PHI to the vendor without individuals' authorizations.

How do you audit tags on a healthcare website or app?

Inventory every tag and SDK, map which pages and screens it runs on, inspect what it actually sends, then match each data flow to a BAA or authorization.

Repeat this checklist whenever marketing or product teams change tags:

• Inventory. List every pixel, analytics tag, session replay script, tag manager container and mobile SDK, including tags loaded by other tags.
• Map pages and screens. Classify each one as authenticated, PHI-capturing public page (scheduling, symptom checker, login, registration) or general public page.
• Inspect traffic. Use browser developer tools or a proxy to capture what each tag sends. Look for URLs with condition or provider names, form values, email addresses, user IDs and advertising IDs.
• Check settings. Review automatic event collection, form capture, URL query strings and session replay masking.
• Match to a permission. For each vendor receiving PHI, record the signed BAA or the authorization relied on. Cookie banner consent does not count as a HIPAA authorization.
• Fix or remove. Disable the tag on PHI pages, strip parameters, move to a BAA-covered tool, or remove it.
• Assess past exposure. If PHI already went to a vendor without a permission, involve counsel and run your breach risk assessment.
• Update the risk analysis. Record tracking technologies as an ePHI risk under 45 CFR 164.308(a)(1) and add change control for new tags.

In our experience, tags added outside engineering cause the biggest gaps, so include tag publishing rights in access reviews.

What if your company is not covered by HIPAA?

If you are neither a covered entity nor a business associate, HIPAA likely does not govern your tracking, but other federal and state rules may.

The OCR and FTC joint letter says companies not covered by HIPAA still have an obligation to protect against impermissible disclosures of personal health information under the FTC Act and the FTC Health Breach Notification Rule, even if a third party built their website or app. The rule at 16 CFR Part 318 excludes HIPAA covered entities and business associate activities, and defines a breach of security to include acquisition resulting from an unauthorized disclosure. See our FTC Health Breach Notification Rule guide for who it covers.

State laws can also apply to consumer health data. One example is covered in our Washington My Health My Data Act guide. Get advice before relying on an exemption.

How SecureSlate helps

SecureSlate helps HealthTech teams keep tracking decisions inside a governed HIPAA program. Built-in HIPAA support, with multi-framework control mapping to SOC 2, ISO 27001 and HITRUST, links tracking controls to your wider program, and custom controls let you add tag audits and tag change approvals. Vendor risk management tracks each analytics and advertising vendor with its BAA status, risk management records tracking technologies as ePHI risks, and access reviews cover who can publish tags. Code security and secrets detection help catch exposed keys in app code, while audit management, the trust center and security questionnaire automation help you show customers how you handle tracking.

FAQ

Is the Meta pixel allowed on a healthcare website under HIPAA?

It depends on where it runs and what it receives. If it receives PHI from a regulated entity, OCR's position is that a BAA or another permission is required. The vacated portion concerned only IP address plus visit data on unauthenticated public pages.

Did the court strike down the whole OCR tracking bulletin?

No. The court vacated only the combination of an IP address with a visit to an unauthenticated public page about specific health conditions or providers. It stated that other guidance in the document was not limited by the vacatur.

Does a cookie consent banner count as HIPAA authorization?

No. The bulletin says banners asking users to accept or reject tracking do not constitute a valid HIPAA authorization.

Is it enough if the analytics vendor says it strips identifiers?

No. The bulletin says it is insufficient for a tracking vendor to agree to remove or de-identify PHI after receiving it. You still need a BAA and an applicable Privacy Rule permission, or individuals' authorizations.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.