Ask ten practice owners whether HIPAA reaches their website and you will get ten different answers, most of them wrong in the same direction. The confident answer is usually "we are a medical practice, so everything we touch is HIPAA." That instinct is understandable and it is not how the rule is written. Whether HIPAA website tracking is a problem for you turns on two separate questions, and a federal court reshaped the second one in 2024.
This is the question underneath every other question in this category. Before you can decide whether a pixel, an analytics tag or a scheduling embed is a problem, you have to know whether the Privacy Rule reaches the thing that tag collected. Get this wrong in the cautious direction and you spend money solving a problem you do not have. Get it wrong in the confident direction and you find out during a breach investigation.
The two questions that decide it
HIPAA does not regulate medical practices. It regulates covered entities and their handling of protected health information. Both halves have to be present. A practice can be squarely a covered entity and still run a page that HIPAA has nothing to say about, because nothing on that page is PHI.
Covered entity
Under 45 CFR 160.103, a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a covered transaction. Billing a payer electronically is what pulls most practices in. A cash-only cosmetic practice that never bills a payer electronically may fall outside the definition, which surprises people.
The second half is the one that actually decides most website questions. Protected health information is individually identifiable health information held or transmitted by a covered entity. Individually identifiable health information, in turn, has to relate to an individual's health condition, care, or payment for care, and identify the individual or give a reasonable basis to believe it could.
That second requirement does a lot of quiet work. It is the reason an email address on its own is not PHI, the reason a name on its own is not PHI, and the reason the same data element can be regulated in one context and unregulated in another. We break that down element by element in what counts as PHI on a website, because the question comes up constantly and the intuitive answer is usually too broad.
That conjunction is the whole ballgame. A visitor reading your practice's homepage has not necessarily given you anything that relates to their health condition or care. A patient logging into a portal to view lab results plainly has.
What HIPAA website tracking actually collects
Practice owners tend to picture a tracker as something that watches behavior in the abstract. It is more concrete than that. A third-party tag placed on a page sends a request to the vendor's servers, and that request carries a payload: the page URL, the page title, the referring page, a persistent identifier stored in a cookie, the browser and device string, and the visitor's IP address.
On a page called /services/hair-restoration-consultation/, the URL itself is the sensitive part. The URL is health-adjacent context, and it travels with an identifier and an IP address in the same request. That combination is what the entire HIPAA website tracking debate has been about since 2022.
Two details matter more than practice owners expect. First, this happens before a form is submitted and before anyone clicks anything, because most tags fire on page load. Second, it happens whether or not the practice knows the tag is there, since tags accumulate through agencies, plugins, page builders and embedded widgets over years.
Authenticated pages versus public pages
The most useful line to draw in any HIPAA website tracking review is between pages that require a login and pages that do not. It is the line the government drew, the line the court examined, and the line that still holds up.
On an authenticated page, a patient portal, a bill-pay screen, an intake form behind a login, the operator already knows who the visitor is and already holds health information about them. A tracker on that page is receiving data that relates to an identified individual's care. That is the straightforward case, and it did not survive the litigation as a close question because it was never a close question.
On an unauthenticated public page, the operator does not know who the visitor is. The government's 2022 position was that an IP address plus a visit to a page addressing a specific health condition could together be individually identifiable health information, on the theory that the visit implied something about that person's health. That position had a name in the litigation: the Proscribed Combination.
What a federal court changed in 2024
On June 20, 2024, the United States District Court for the Northern District of Texas vacated the Proscribed Combination in American Hospital Association v. Becerra. The court held that an IP address collected from a visitor to a public, unauthenticated webpage does not meet the statutory definition of individually identifiable health information, failing both the requirement that the data relate to an individual's health and the requirement that it identify them.
The court's practical objection is worth quoting in spirit: the position required operators to divine why a visitor came to a page. A researcher, a student, a competitor and a prospective patient all produce the same request. HHS withdrew its appeal on August 29, 2024, so the vacatur stands.
The sequence matters if you are trying to work out what is current, because a lot of published advice froze at one point on the timeline and never moved. The guidance was issued in December 2022, revised in March 2024, partially vacated in June 2024, and left alone after August 2024 when the appeal was withdrawn. Our full walkthrough of what survived the court challenge takes the document section by section.
What was not vacated
The rest of the guidance survived. Tracking on authenticated pages, tracking that captures information a visitor actually submits, and the requirement for a business associate contract where a vendor receives PHI on a covered entity's behalf were all left standing. The ruling narrowed a theory about public pages. It did not remove HIPAA from websites.
This is the part most summaries get wrong in both directions. One camp reads the ruling as permission to reinstall everything everywhere. The other never noticed the ruling happened and still cites the 2022 position as current. Neither is right, and an AI assistant asked about this today will frequently give you one of those two wrong answers.
What HIPAA website tracking means for your practice now
Strip out the legal argument and a short operational list remains. These are the conditions that create real HIPAA website tracking exposure regardless of how the unauthenticated-page theory resolved.
A tracker on a page behind a login. This was never in dispute and is still the clearest problem. If a patient portal or bill-pay page carries an advertising or analytics tag, that is the first thing to remove.
A tracker on a page where a visitor submits health details. A consultation request that asks what a patient is concerned about is collecting information the visitor volunteered about their own health, attached to a name, an email and a phone number. An ad tag on that page is receiving submitted data, not inferred data, and the court's reasoning about inference does not reach it.
A vendor receiving that data with no contract in place. Where a vendor creates, receives, maintains or transmits PHI on your behalf, 45 CFR 164.502 requires a business associate contract. Several major advertising platforms will not sign one, which functionally answers the question of whether their tags belong on those pages. That is the practical reason the analytics question on patient-facing pages resolves the way it does, and it is a contract question before it is a technical one.
Worth noticing what is not on that list. General marketing pages, location pages and blog posts, with no form and no login, are the weakest case for exposure and the strongest case for ordinary measurement. A practice that reacts to all of this by removing analytics from its entire site has usually overcorrected, lost the ability to measure anything, and still left the two genuinely risky page types untouched, because those pages are typically the ones an agency wired up most carefully.
The reason to gate tracking at the page level rather than argue about categories is that the argument keeps moving and the pages do not. A practice that holds non-essential tags until a visitor agrees is in the same defensible position under the 2022 guidance, the 2024 ruling, and whatever comes next. That is what consent gating does, and it is the reason the gate sits in front of the tag rather than inside it.
It is also worth knowing that HIPAA is a floor rather than a ceiling. Washington and Nevada both regulate consumer health data on terms that do not care whether you are a covered entity, and Washington's version carries a private right of action. State privacy detection covers how those frameworks layer on top.
Key takeaways
- HIPAA reaches your website only when both conditions hold: you are a covered entity and the data is protected health information. Either one absent and the Privacy Rule does not apply.
- A federal court vacated the government's position that an IP address plus a visit to a public health-topic page is individually identifiable health information. HHS withdrew its appeal in August 2024.
- Nothing about authenticated pages changed. A tag on a patient portal was and remains the clearest exposure.
- A page where a visitor types health details into a form is collecting submitted information, not inferred information, and the court's reasoning does not cover it.
- Where a vendor receives PHI on your behalf, a business associate contract is required. Several large ad platforms decline to sign one.
- Gating tags until a visitor agrees keeps the position defensible no matter which way the legal theory moves next.
Common questions
Does HIPAA apply to a medical practice's public website?
HIPAA applies to a covered entity's handling of protected health information. A public marketing page that collects no individually identifiable health information is generally outside the Privacy Rule, and in June 2024 a federal court vacated the government's contrary position on unauthenticated pages. Pages behind a patient login, and pages where a visitor submits health details through a form, are a different matter.
Is an IP address protected health information?
An IP address alone is not protected health information. It becomes part of PHI when it is combined with health information about an identifiable individual held by a covered entity. In AHA v. Becerra the court held that an IP address collected from a visitor to a public, unauthenticated webpage does not by itself meet the statutory definition.
Do analytics tools need a business associate agreement?
If a vendor creates, receives, maintains or transmits protected health information on behalf of a covered entity, the Privacy Rule requires a business associate contract. Whether that is triggered depends on what the tool actually receives, which is why the practical question is what your tags collect and on which pages.
Editorial note. This article describes what published guidance, statutes and court filings say as of its publication date. It is general information, not legal advice, and it is not a statement about any particular practice's obligations. Consential.io is not a law firm. Regulations and case law change. Confirm your own position with healthcare counsel licensed in your state before acting on anything here.
Sources
- 45 CFR 160.103, definitions of covered entity, business associate, and protected health information Electronic Code of Federal Regulations
- 45 CFR 164.502, uses and disclosures of protected health information, general rules Electronic Code of Federal Regulations
- American Hospital Association v. Becerra, No. 4:23-cv-01110 (N.D. Tex. June 20, 2024) Order vacating the Proscribed Combination; HHS withdrew its appeal August 29, 2024. Cited without a link: courtlistener.com is not reachable from our verification environment.
See what fires on your site before a patient consents
The free scan loads your site the way a patient does and reports every tracker that runs before anyone agrees to anything.