This article is part of our Therapy Practice Marketing Guide: how clients find a therapist, how to market ethically and privately, and how to choose the right help. Want to know where your practice's site stands? Get a free 20–30 page website audit within 24 hours.
On a therapy website, keep tracking pixels and third-party tags off any page where a visitor logs in, books, fills in a form or types about their health. The exception is a vendor that has signed a business associate agreement (BAA), where the disclosure is permitted. HHS guidance says tracking on those pages can involve protected health information. Google says it does not offer BAAs for Google Analytics.
The rules shifted in 2024 when a federal court vacated part of HHS's tracking guidance. But the core obligations remain, and the FTC has brought separate actions against health companies, including online therapy provider BetterHelp, for sharing health data with advertisers. This guide explains where things stand as of October 2026 and what to turn off.
It is part of our Therapy Practice Marketing Guide. It is not legal advice. Confirm your setup with a HIPAA compliance advisor.
Key Takeaways
- HIPAA applies to you if you are a covered entity, which for providers means you transmit health information electronically in standard transactions such as insurance billing.
- In June 2024 a federal court vacated the part of HHS's guidance about IP addresses on unauthenticated public pages; the rest of the bulletin still stands.
- Tracking on logged-in pages, booking flows and forms that collect health details is still covered by HIPAA when you are a covered entity.
- A cookie consent banner is not a valid HIPAA authorization, according to HHS.
- The FTC fined BetterHelp $7.8 million and GoodRx $1.5 million for sharing health data with ad platforms.
What a tracking pixel is
HHS describes a tracking technology as "a script or code on a website or mobile app used to gather information about users or their actions." Common examples on therapy sites:
- Meta (Facebook) pixel and Conversions API.
- Google Analytics and Google Ads tags.
- TikTok, LinkedIn, Pinterest or Snapchat pixels.
- Session replay tools that record clicks and typing.
- Chat widgets and embedded booking tools that load their own scripts.
HHS notes these tools often send data directly to the vendor and can keep tracking people after they leave your site.
Does HIPAA apply to you?
Not every therapist is a HIPAA covered entity. HHS explains on its covered entities page that health care providers, including psychologists, are covered "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard," such as electronic insurance claims.
If you bill insurance electronically, or a billing service does it for you, you are very likely covered. A cash-only practice may not be. Even then, the FTC Act still prohibits deceptive privacy practices, and your ethics code and state law still require confidentiality. Treat client data as sensitive either way.
HHS guidance and the June 2024 court ruling
HHS's Office for Civil Rights issued a bulletin on tracking technologies. Then, on 20 June 2024, the U.S. District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra.
As of 29 October 2026, the HHS bulletin page opens with a note about the ruling. It says the court issued an order "declaring unlawful and vacating a portion of this guidance document." Specifically, the court vacated it to the extent it said HIPAA obligations are triggered when technology connects "(1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers." The note says HHS "is evaluating its next steps."
According to law firm Quarles & Brady, HHS withdrew its appeal on 29 August 2024.
What still stands
The rest of the bulletin remains on the HHS site. Key points:
- Logged-in pages. Tracking on user-authenticated pages, such as a client portal or telehealth platform, "generally ha[s] access to PHI." Vendors that receive it are business associates and need a BAA.
- Booking and forms. HHS says trackers on an unauthenticated page where people "schedule appointments" may collect PHI, such as an email address or the reason for seeking care. In that case HIPAA applies.
- Login and registration pages. Credentials or registration details entered there are PHI if trackers collect them.
- Banners are not authorization. HHS states that website banners asking users to accept cookies "do not constitute a valid HIPAA authorization."
- Privacy policy is not enough. Telling people in a privacy policy that you share data does not make the disclosure permitted.
The court ruling narrowed one theory about public pages. It did not make pixels safe on booking flows, intake forms or portals.
FTC actions: BetterHelp and GoodRx
The FTC enforces the FTC Act against unfair and deceptive practices, including by health companies.
- BetterHelp. The FTC alleged the online counseling service shared email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest for advertising, after promising privacy. The FTC gave final approval on 14 July 2023 to an order banning BetterHelp from sharing health data for advertising and requiring it to pay $7.8 million.
- GoodRx. In February 2023 the FTC announced its first action under the Health Breach Notification Rule, alleging GoodRx shared medication and health condition data with Facebook, Google and others. The proposed order included a $1.5 million civil penalty.
The Health Breach Notification Rule
The FTC's business guide to the Health Breach Notification Rule says the rule covers non-HIPAA entities such as personal health record vendors and health apps. HIPAA-covered entities like doctors' offices are not covered by it. The FTC finalized changes on 26 April 2024 clarifying that it applies to health apps and that a breach includes an unauthorized disclosure, not just a hack. In September 2026 the FTC withdrew its 2021 policy statement on health apps as unnecessary, but the rule itself remains.
For most therapy practices, the lesson from these cases is about advertising pixels, not the rule's paperwork: sharing health-related data with ad platforms draws enforcement.
What to turn off
Start with an inventory. List every script on your site, then work through this table.
| Where | Pixels and ad tags | Analytics |
|---|---|---|
| Client portal and telehealth pages | Off | Off unless vendor signs a BAA |
| Booking widget and scheduling pages | Off | Off unless vendor signs a BAA |
| Contact and intake forms | Off | Off unless vendor signs a BAA |
| Thank-you page after a form | Off, it reveals someone just reached out | Off unless vendor signs a BAA |
| Specialty pages (anxiety, trauma) | Remove or ask counsel | Ask counsel |
| General pages (careers, office hours) | Lower risk; ask counsel | Lower risk |
Google's own HIPAA and Google Analytics help page says Google "does not offer Business Associate Agreements in connection with this service." It tells HIPAA-regulated customers not to expose PHI to Google, says authenticated pages "are likely to be HIPAA-covered," and says customers should not set Google Analytics tags on those pages.
Other common risks:
- Ad conversion tags that fire when a form is submitted.
- Embedded booking widgets that load third-party trackers inside the iframe.
- Session replay that records what people type.
- Chat widgets where visitors may describe symptoms.
Safer ways to measure
You can still learn what works without sending client data to ad platforms:
- Ask on intake. "How did you hear about us?" is the most reliable source data for a small practice.
- Count inquiries, not people. Track the number of form submissions or calls per month in your own system.
- Use privacy-focused analytics configured to avoid identifiers, and only on pages without health details. Confirm with the vendor whether it will sign a BAA if you need one.
- Use a vendor that signs a BAA for any tool that touches forms, booking or the portal.
- Separate marketing from clinical tools. Your marketing stack should never see diagnoses, notes or appointment details.
For the wider privacy picture, see What Therapists Need to Know About Website Privacy and Data Protection and Is Your Therapy Website HIPAA-Compliant?.
Next step
Removing pixels is step one. Step two is choosing forms and scheduling tools that are built for health data. Read HIPAA-Compliant Contact Forms, Intake and Scheduling for Therapists next, and see our website security services if you want help with the cleanup. To find out which trackers your site loads today, get a free 20–30 page website audit within 24 hours.
Frequently asked questions
Can I use the Meta pixel on my therapy website?
Keep it off booking pages, forms, thank-you pages and any logged-in area. HHS guidance says trackers there can collect PHI, and Meta's pixel is an ad tool. Ask a compliance advisor before using it on any page.
Did the 2024 court ruling cancel the HHS tracking guidance?
No. The court vacated one part about IP addresses on unauthenticated public pages. The HHS page still carries the rest of the bulletin, including the rules for logged-in pages, booking flows and forms.
Is Google Analytics HIPAA compliant?
Google says it makes no representation that Google Analytics satisfies HIPAA and does not offer BAAs for it. It tells HIPAA-regulated customers not to send PHI and not to tag authenticated pages.
Does a cookie banner make tracking okay?
Not under HIPAA. HHS says cookie banners do not constitute a valid HIPAA authorization.
I don't bill insurance. Does any of this apply to me?
HIPAA may not apply if you never transmit standard electronic transactions, but the FTC Act, state privacy laws and your ethics code still do. The FTC's BetterHelp case shows that sharing therapy-related data with advertisers draws enforcement regardless.
