Does HIPAA apply to my marketing website?

It applies to covered entities and their business associates. If your practice is a covered entity, the question is whether your website collects or discloses protected health information. A static page with your hours doesn't. A booking form, patient portal, or intake form can.

Can I use Google Analytics on my practice website?

Google doesn't sign a business associate agreement for Google Analytics, so it shouldn't receive anything that qualifies as protected health information. Many practices use it only on pages with no patient input and configure it to avoid collecting identifiers. Ask your compliance advisor to confirm the setup.

Is a cookie consent banner enough?

No. A cookie banner is a privacy notice mechanism. It doesn't replace a HIPAA authorization or a business associate agreement where one is required.

Can I post patient testimonials?

Only with a signed HIPAA authorization from the patient for that specific use. The same goes for before-and-after photos and patient stories.

Is a free scan enough to say my site is compliant?

No. A scan can find tags and forms that need attention. Whether your site meets HIPAA depends on how your practice handles information, which includes agreements with vendors and your internal policies. A scan is a starting point for a conversation with your compliance advisor.

Guides · Legal & Compliance

HIPAA and Your Practice Website: Tracking, Forms, and Marketing

Where a practice website creates privacy exposure, what to check first, and what to ask your compliance advisor.

October 6, 2026 · 4 min read

This guide is general information, not legal advice. HIPAA rules and the guidance around them change, and your situation depends on facts we can't see. Review your setup with your privacy officer or a healthcare attorney.

The short version

Most HIPAA problems on practice websites come from two things: third-party tracking tools that send visitor data to advertising or analytics companies, and forms that send patient information somewhere unsecured. The fix is rarely dramatic. It starts with knowing what's actually running on your site.

When your website falls under HIPAA

HIPAA covers protected health information (PHI): information about a person's health, care, or payment for care that can identify them. If your practice is a covered entity, information a patient gives you through the website, like an appointment request that names a condition, can qualify.

What counts as PHI on a website is where the legal picture is still moving. In 2022, the Department of Health and Human Services' Office for Civil Rights issued guidance on online tracking technologies, and revised it in 2024. Later in 2024, a federal court in Texas vacated part of that guidance, the part that treated visits to certain public pages as PHI. Other parts, including how it applies to pages behind a login, weren't affected by that ruling. Because the rules may have developed further since this was written, confirm the current position with your counsel.

Separately, the Federal Trade Commission has taken enforcement action against health companies that shared sensitive data with advertising platforms, and plaintiffs have brought privacy lawsuits over tracking pixels on health sites. The practical conclusion hasn't changed: treat any tracker on a page where patients reveal health information as high risk.

Where the exposure usually is

Advertising pixels. Meta, TikTok, Google Ads, and similar tags can send page URLs, button clicks, and identifiers to the ad platform. A URL like /appointments/fertility-consultation tells the platform something about the visitor's health.
Analytics. Standard configurations can collect identifiers and detailed page paths. Whether that's a problem depends on the pages and the settings.
Session replay and heatmap tools. These record what visitors type and click. On a form page, that can capture the very information you're trying to protect.
Contact and intake forms. Check where submissions go. A form that emails the entry to an ordinary inbox, or a form-builder service without a business associate agreement, is a common gap.
Chat widgets. Messages typed into a chat box are submissions too. So are the vendor's transcripts.
Call tracking. Recorded calls can include health details. The vendor and the recordings need the same scrutiny.
Scheduling embeds and patient portals. These often run on a vendor's domain with its own trackers. Find out what they load.
Newsletter and email tools. A signup form that asks for condition or treatment turns a marketing list into something more sensitive.

How to audit your own site

Make an inventory. List every tool on the site: tag manager containers, pixels, analytics, chat, forms, scheduling, maps, fonts, video embeds. Your browser's developer tools (Network tab) show what loads on a page, and your tag manager shows what it fires.
Check sensitive pages first. Booking, intake, portal login, and condition-specific pages carry the most risk.
Follow every form. For each one, trace where the submission goes and who can read it along the way.
Check agreements. For any vendor that receives or can access PHI, confirm a business associate agreement is in place. If a vendor won't sign one, they shouldn't receive PHI.
Remove what you don't need. The easiest tracker to secure is the one you delete.
Document your decisions. Write down what you reviewed, what you changed, and why. If someone asks later, that record matters.

Marketing content has rules too

Testimonials, patient stories, and photos need a signed authorization for that use.
Replying to online reviews can't confirm that someone is a patient or discuss their care.
Patient lists shouldn't be uploaded to advertising platforms for targeting without checking with your compliance advisor first. Using patient information for marketing generally needs authorization.
Social media has the same restrictions on posting anything that identifies a patient, including photos with a recognizable person or visible details.

What to ask your compliance advisor

Which of our website tools could receive PHI, and do we have agreements covering them?
Should advertising tags run on booking and condition-specific pages?
How should we configure analytics so it doesn't collect identifiers?
Who reviews new marketing tools before we add them?
How often should we re-check the site?

Where to start this week

Run a scan to see what loads on your public pages.
List every form and where its submissions land.
Find out if you have a business associate agreement with each vendor that touches patient information.
Book time with your compliance advisor to go through the results.

Our free HIPAA Website Checker looks for tracking scripts, forms, and disclosures that may create exposure. It identifies what to review. It doesn't tell you that you're compliant. For help with the website itself, see our healthcare website development service, which includes HIPAA-compliant ad tracking and conversion measurement.

Common questions

Does HIPAA apply to my marketing website?: It applies to covered entities and their business associates. If your practice is a covered entity, the question is whether your website collects or discloses protected health information. A static page with your hours doesn't. A booking form, patient portal, or intake form can.
Can I use Google Analytics on my practice website?: Google doesn't sign a business associate agreement for Google Analytics, so it shouldn't receive anything that qualifies as protected health information. Many practices use it only on pages with no patient input and configure it to avoid collecting identifiers. Ask your compliance advisor to confirm the setup.
Is a cookie consent banner enough?: No. A cookie banner is a privacy notice mechanism. It doesn't replace a HIPAA authorization or a business associate agreement where one is required.
Can I post patient testimonials?: Only with a signed HIPAA authorization from the patient for that specific use. The same goes for before-and-after photos and patient stories.
Is a free scan enough to say my site is compliant?: No. A scan can find tags and forms that need attention. Whether your site meets HIPAA depends on how your practice handles information, which includes agreements with vendors and your internal policies. A scan is a starting point for a conversation with your compliance advisor.