Consential Research

Consent, tracking and access on medical practice websites

Practical articles on website tracking under HIPAA, consent mechanics for medical sites, state consumer health data laws, and WCAG failures on practice websites.

Article title card reading Server-Side Tagging and HIPAA, from Consential Research
HIPAA and Tracking Server-Side Tagging and HIPAA: What Moving the Tag Actually Changes Moving a tag to a server you control does not change the destination. What Google's covered-products list and Meta's own terms actually say.
Article title card reading What a Session Replay Tool Records on a Practice Website, from Consential Research
HIPAA and Tracking What a Session Replay Tool Records on a Practice Website It does not film the screen, it reconstructs the page from its own data. The default masking mode protects the phone number and leaves the reason for visit in plain text.
Article title card reading Which Google Consent Mode Are You Running, from Consential Research
Consent Which Google Consent Mode Is Your Site Actually Running? Not a setting anyone picked. It is decided by how the tags were installed, and most sites are running both at once.
Article title card reading The Trackers We Find Almost Everywhere, from Consential Research
Research The Trackers We Find on Almost Every Practice Website Written from the detection rules our scanner uses and the sites we have run it against. What each is and why it is there.
Article title card reading Anatomy of a Pre-Consent Data Leak, from Consential Research
Research Anatomy of a Pre-Consent Data Leak: One Site, Request by Request A real practice site scanned in June 2026. Six trackers, seven cookies, no consent platform, score of zero.
Article title card reading What a Screen Reader Actually Announces, from Consential Research
Accessibility What a Screen Reader Actually Announces on a Practice Website Findings written as what a person hears rather than as rule violations, from real scans of real practice sites.
Article title card reading Why Accessibility Overlays Do Not Fix It, from Consential Research
Accessibility Why Accessibility Overlays Do Not Fix the Problem One line of JavaScript that makes a site accessible would be remarkable engineering. Why it is not one.
Article title card reading The WCAG Failures We Find Most, from Consential Research
Accessibility WCAG 2.1 AA on a Practice Website: The Failures We Find Most Not transcribed from the spec. Ranked by what actually appears on practice sites, including ours.
Article title card reading Website Accessibility, The Rule With a Date, from Consential Research
Accessibility Website Accessibility for Medical Practices: The Rule With a Date on It Most writing covers unpredictable ADA lawsuits. There is also a federal rule with named standards and fixed dates.
Article title card reading Call Tracking and Dynamic Number Insertion, from Consential Research
Consent Call Tracking and Dynamic Number Insertion on a Medical Site Three separate things happen under one label, carrying three different levels of exposure. Collapsing them is why this never resolves.
Article title card reading The Consent Gap in Embedded Forms, from Consential Research
Consent Embedded Scheduling and Intake Forms: The Consent Gap Nobody Checks A gate controls your page. An embedded form is somebody else's page inside yours, and your gate cannot reach into it.
Article title card reading Does a Practice Need a Do Not Sell Link, from Consential Research
State Law Does a Medical Practice Need a Do Not Sell or Share Link? Almost every practice answers with "we don't sell patient data." True, and not the question the statute asks.
Article title card reading Nevada and Washington Health Data Laws, from Consential Research
State Law Nevada and Washington Health Data Laws, Side by Side Two statutes that look like siblings and diverge on the one point that decides what a mistake costs.
Article title card reading Washington's My Health My Data Act, from Consential Research
State Law Washington's My Health My Data Act: What It Means for a Practice Website Applies by where your visitor is, not where you are. No small-business threshold. And private plaintiffs can sue directly.
Article title card reading Consumer Health Data Under State Law, from Consential Research
State Law Consumer Health Data Under State Law: A Practice Owner's Map Two families of state law reach a practice website. Most summaries collapse them, and the distinction is what decides your position.
Article title card reading The Five Places Tracking Tags Actually Load, from Consential Research
Consent WordPress and Elementor: The Five Places Tracking Tags Actually Load Removing a tag from the one place you know about is the most common way a practice concludes it fixed something.
Article title card reading Consent Mode Is Not Tag Blocking, from Consential Research
Consent Consent Mode Is Not Tag Blocking: Why the Difference Matters One instructs a script already running. The other decides whether it runs at all. Most sites do the first and were sold the second.
Article title card reading Consent Mode v2 for Healthcare Advertisers, from Consential Research
Consent Consent Mode v2 for Healthcare Advertisers: What Changes and What Doesn't Four signals, two of which most practices have never heard of. What each governs, and why it is not a compliance control.
Article title card reading The Meta Pixel Cases, What Was Actually Alleged, from Consential Research
HIPAA and Tracking The Meta Pixel Cases: What Was Actually Alleged Against Healthcare Sites The headlines collapsed a technical mechanism into a scandal. The mechanism is still running on a lot of practice sites.
Article title card reading Do You Need a BAA With Your Analytics Vendor, from Consential Research
HIPAA and Tracking Do You Need a BAA With Your Analytics Vendor? A Decision Tree Six questions in order settle it for any vendor. Most practices ask the last one first, which is why it never resolves.
Article title card reading Google Analytics on a Patient-Facing Site, from Consential Research
HIPAA and Tracking Google Analytics on a Patient-Facing Site: Where the Risk Actually Is Asked as a yes or no question. It has a contract answer, a page-by-page answer and a configuration answer instead.
Article title card reading The OCR Tracking Bulletin, After the Court Challenge, from Consential Research
HIPAA and Tracking The OCR Tracking Bulletin: What Survived the Court Challenge Issued, revised, partially vacated, then left alone. Most published advice froze at one point on that timeline and never moved.
Article title card reading What Counts as PHI on a Website, from Consential Research
HIPAA and Tracking What Counts as PHI on a Website? IP Addresses, URLs and Form Fields The eighteen-identifier list is the most quoted and most misread document in this area. Element by element, what is actually protected.
Article title card reading Does HIPAA Apply to Your Website, from Consential Research
HIPAA and Tracking Does HIPAA Apply to Your Website? The Tracking Question, Answered Two questions decide whether the rule reaches your site. Most practice owners only ask the first one.