Tracking Pixels on Telehealth Sites After the FTC Orders

Treat every tag, pixel and SDK on a telehealth site as a potential disclosure of health information to a third party, and decide page by page whether it may run. On pages where a visitor is a patient or is seeking care, such as intake, scheduling, the patient portal, checkout for a prescription, or a condition-specific landing page, sending identifiers plus what the visitor did to an advertising platform has produced FTC orders, HIPAA exposure and state-law liability. No pixel vendor's settings make that question go away, and no tool is safe under HIPAA simply because of its configuration; it depends on what data it receives, where, and under what agreement.

This describes the rules and cases for operators. Your counsel should review your site's specific data flows.

Which laws reach a telehealth site's tracking code?

• HIPAA, if the practice is a covered entity. Information collected on a covered entity's site can be protected health information, and disclosing it to a tracking vendor without a business associate agreement or the patient's authorization can be an impermissible disclosure. Most advertising platforms will not sign a BAA.
• Section 5 of the FTC Act, for unfair or deceptive practices, which applies regardless of HIPAA status. Sharing health data contrary to your privacy promises is deceptive; sharing it for advertising without affirmative consent has been charged as unfair.
• The FTC Health Breach Notification Rule (16 CFR part 318), for health apps and services not covered by HIPAA. Since the amendments effective July 29, 2024, a "breach of security" expressly includes unauthorized disclosures, not only hacks. See the Health Breach Notification Rule.
• State consumer health data laws, led by Washington's My Health My Data Act (RCW 19.373), which requires consent before collecting or sharing consumer health data beyond what is necessary for the requested service, and is enforceable by private lawsuits through the state consumer protection act. See the My Health My Data Act.

What were the FTC cases about?

• GoodRx (February 2023). The FTC's first enforcement under the Health Breach Notification Rule. The FTC alleged GoodRx shared users' prescription and health condition information with advertising platforms such as Facebook and Google, contrary to its privacy promises, and did not give breach notice. GoodRx paid a $1.5 million civil penalty, according to the FTC's 2024 rule notice (89 FR 47028).
• Premom (Easy Healthcare, May 2023). An ovulation app that shared health data with third parties including Google and AppsFlyer; a $100,000 civil penalty under the same rule.
• BetterHelp (2023). The FTC charged that the online therapy company shared email addresses, IP addresses and answers to health questions with platforms including Facebook and Snapchat for advertising, after promising to use health data only for limited purposes. The final order banned sharing health data for advertising and required $7.8 million for consumer refunds.
• Cerebral (April 2024). The FTC and the Justice Department alleged the telehealth company disclosed consumers' health information to third parties for advertising through pixels and similar tools, and used deceptive cancellation practices. The order required more than $7 million: about $5.1 million in refunds and a $10 million civil penalty suspended after a $2 million payment.
• Monument (April 2024). An alcohol use disorder treatment service charged with sharing health information with advertising platforms without consent. The order banned sharing health data for advertising, with a $2.5 million civil penalty suspended because of inability to pay.

The pattern across all five: tracking tools on pages that reveal a health condition, a treatment or a prescription, sending identifiers to advertising platforms, contradicting what the privacy policy said.

What did the court ruling on OCR's guidance change?

HHS's Office for Civil Rights issued guidance in 2022, updated in 2024, on online tracking technologies used by HIPAA-covered entities. In American Hospital Association v. Becerra (N.D. Tex., June 20, 2024), the court vacated the part of the guidance that treated a visit to an unauthenticated public web page, combined with the visitor's IP address and the page's health topic, as protected health information. It did not change the rules for authenticated pages such as patient portals, or for pages where a visitor schedules care, completes intake or otherwise becomes a patient. It also did nothing to the FTC Act, the Health Breach Notification Rule or state law, which apply regardless of HIPAA.

How do you decide where tags may run?

Sort every page into one of four zones and set a rule for each.

• Zone 1: general pages. Home page, about, careers, general blog posts. Marketing tags may be acceptable, subject to consent rules and state law. Condition-specific pages need a closer look.
• Zone 2: condition and treatment pages. A landing page for a specific condition or drug tells an advertising platform something about the visitor's health. Under Washington's law, inferring health status is collecting consumer health data. Use first-party analytics only, or get consent that meets the strictest state you serve.
• Zone 3: intake, scheduling and checkout. No third-party advertising tags. First-party analytics only, under a BAA where HIPAA applies.
• Zone 4: patient portal and app. No third-party advertising tags or SDKs. Analytics only from vendors under a BAA, configured not to receive identifiable health data they do not need.

Server-side tagging and conversion APIs move the data path; they do not change what is disclosed. Apply the same zone rules to them.

How do you run a tracking audit?

1. Crawl the site and app with a browser that records every outbound request, logged in and logged out.
2. List every third party that receives data, the pages it loads on, and the parameters it receives (URLs, form field names, event names, hashed emails).
3. Compare with the privacy policy, the consent banner, and your BAAs.
4. Remove or reconfigure anything that sends health-revealing data where the zone rules say it should not.
5. Rename events: an event called "ozempic_purchase" or "anxiety_intake_complete" discloses the health information in its name.
6. Repeat on every site release and at least quarterly.

Are email lists and custom audiences different?

Uploading a list of patients or leads to an advertising platform to build a custom or lookalike audience is a disclosure, even when the emails are hashed. Hashing hides the address from a casual reader; the platform matches the hash to an account, which is the point. The FTC's BetterHelp complaint involved email addresses shared with Facebook for advertising. A list of people who completed an intake for a specific condition tells the platform who has that condition. Treat audience uploads as Zone 3 data: not without authorization under HIPAA where it applies, and not without the consent state law requires.

How should the privacy policy and banner read?

• What the site actually does, in plain terms: which categories of tools run, on which kinds of pages, and what they receive.
• That health information from intake, checkout and patient pages is not shared for advertising, if that is true. If it is not true, fix the site rather than the policy.
• For Washington consumers, a separate consumer health data privacy policy linked from the homepage, as RCW 19.373.020 requires.
• A consent mechanism that honors the strictest state you serve, records the choice, and actually stops the tags when a visitor declines. Test it by declining and confirming that no tag loads.

The FTC's cases turned on gaps between what companies promised and what their code did. A policy that is accurate is the cheapest protection available.

Can you still measure advertising?

Yes, with less precision. Options include aggregate conversion counts reported without health details, first-party analytics under a BAA, consented measurement where state law allows, and offline measurement of new patients by channel. Expect lower attribution and plan budgets around blended return rather than per-click data.

Website tracking review is part of our Telehealth Policies & Consent Kit ($1,950). See the advertising claims checklist and pricing.