Hospital websites had a HIPAA problem because nobody owned the tags

The week

On December 1, 2022, the HHS Office for Civil Rights published a bulletin on the use of online tracking technologies by HIPAA covered entities and business associates. It said tracking code on authenticated pages, such as patient portals and telehealth platforms, generally has access to protected health information. It added that tracking on some unauthenticated pages, such as appointment schedulers or pages about specific conditions, could also involve PHI. Disclosures to tracking vendors therefore needed a permitted basis under the Privacy Rule, which in practice meant a business associate agreement or the patient’s HIPAA authorization. The bulletin followed reporting by The Markup in mid-2022 that found advertising pixels on many hospital websites and patient portals, and a growing wave of class actions against health systems.

The bulletin was guidance, and its reach on public pages was contested from the start. Its operational message was harder to dispute. A hospital’s website, scheduler and patient portal were part of its HIPAA footprint, yet in most health systems no single person was accountable for the code running on them. The work it created came down to three questions, usually answered in this order: who owns the web estate, what is actually running on it, and on what terms each vendor receives data.

Who owns the web estate

In many health systems the public website belonged to marketing. An outside agency built and maintained it, a digital team configured analytics, and a tag manager let staff add new scripts without a change request. The privacy office reviewed the notice of privacy practices posted on the site, not the code behind it. The patient portal usually sat with IT and the EHR team, but it often shared an analytics account or tag container with the public site.

That arrangement explains how pixels reached sensitive pages. Nobody decided to send appointment data to an advertising platform. A campaign manager added a pixel to measure conversions, the tag fired on every page by default, and nobody with privacy responsibility saw the configuration.

The fix was to give the whole web estate one accountable owner, usually a joint arrangement between the CIO’s organization and the privacy officer, with marketing as a customer. Concretely, that meant moving tag manager administrator rights out of agencies, requiring a ticket and privacy review before any new script goes live, and adding web properties to the system inventory that feeds the HIPAA risk analysis. It also meant agency contracts that prohibit adding third-party code without written approval.

The cost was speed. Marketing teams lost the ability to launch a tracked campaign the same afternoon. Organizations that set a service level for reviewing tag requests, such as a few business days for standard tools already approved, kept the new process from becoming a reason to work around it.

What is actually running

Most health systems could not say which third-party scripts ran on which pages. Tag managers load code dynamically. Agencies add pixels for campaigns and leave them in place. Chat widgets, scheduling plug-ins, video players and accessibility tools bring their own trackers. Some data flows are configured inside a vendor’s console and never appear in the page source.

A reliable inventory therefore had to come from observed behavior. Teams crawled the public site and, using test accounts, the portal. They recorded every outbound request and mapped each to a vendor, a purpose and the data it carried. Then they classified pages by sensitivity. A page about a specific service line, a provider search, a symptom checker, or a scheduling flow could reveal a condition when combined with an IP address or a cookie identifier. So could URLs carrying a department name or search terms, and form fields captured by session-replay tools.

The inventory had to be repeated, not filed. Sites change weekly, and a clean crawl in January says little about a campaign launched in March. Mature programs run automated scans on a schedule and on every release, and alert when a new domain appears in outbound traffic from a sensitive page. The output also served a second purpose: evidence for the risk analysis and for any regulator or plaintiff asking what the site did on a given date.

On what terms vendors receive data

OCR’s position was that a tracking vendor receiving PHI needs a business associate agreement, or the patient’s authorization. The major advertising platforms did not sign BAAs for their pixels. A cookie banner does not meet HIPAA’s authorization requirements, which call for specific elements and a signature. For those tools on PHI-bearing pages, the practical answer was removal.

That left a real business need. Health systems still had to know whether scheduling pages worked and which outreach brought patients in. The common responses were to switch to analytics vendors willing to sign BAAs, to move measurement server-side so the health system controls what is forwarded, and to strip identifiers and sensitive URL parameters before anything leaves its environment. Each option had trade-offs. BAA-ready tools often offered less advertising functionality. Server-side setups needed engineering capacity that marketing budgets had never paid for.

Contracts also had to change. Privacy and security teams began reviewing marketing technology agreements that never used to reach them, checking data use limits, retention, subprocessors and breach notice terms. Some health systems found agency contracts that allowed the agency itself to retain campaign data.

The legal uncertainty over public pages did not change this calculation much. Plaintiffs were already suing under state privacy and wiretap laws regardless of OCR’s view, and authenticated pages were clearly covered. Ownership, inventory and vendor terms were worth fixing under any court outcome, which made the project easier to fund. Counsel could track the litigation separately.

With hindsight

The legal picture shifted; the governance case held. In July 2023 OCR and the FTC sent joint letters to about 130 hospital systems and telehealth providers warning about tracking technologies. OCR revised the bulletin in March 2024. In June 2024 a federal court in Texas, in a case brought by the American Hospital Association, vacated the part of the guidance treating certain tracking on unauthenticated public pages as a disclosure of PHI. HHS dropped its appeal that August. The guidance on authenticated pages such as patient portals was not affected. Class actions over pixels continued under state law, and several health systems settled. Organizations that put web properties under named ownership and continuous scanning in 2023 found the same controls useful for the state consumer health privacy laws that followed. Counsel should advise on current exposure under those laws.