HIPAA and tracking pixels in 2026: what medical practices can still use

Yes, you can still run most marketing pixels on the public pages of a medical website, but the safe zone is smaller than it was in 2023. A 2024 court ruling removed HHS's rule for public pages, yet login-gated pages still need a business associate agreement, and state health-data laws, FTC cases and wiretap demand letters now carry the real risk.

What did the 2024 court ruling actually change?

It removed one piece of HHS guidance, not all of it. On June 20, 2024, a federal court in the Northern District of Texas vacated the part of OCR's March 18, 2024 revised bulletin that treated an IP address plus a visit to an unauthenticated public page about health conditions or providers as protected health information. The court held HHS lacked statutory authority for that "proscribed combination."

The rest of the bulletin was not touched, and Holland & Knight warned providers to keep watching trackers on patient portals that require a login. On August 29, 2024, the American Hospital Association reported that HHS officially withdrew its notice of appeal, so the ruling stands.

One honest limit: HHS's own bulletin page returned an access error when I tried to read it, so this article relies on the law firm and trade-association summaries of it. Before you act, check the current text on hhs.gov with your counsel.

Which pages on your site are still off limits?

Pages behind a login are the clearest no-go zone. A vendor that handles protected health information has to sign a business associate agreement, and AmSpa states that neither Google Ads nor Facebook signs one. The same article notes that Google's documentation says its pixels should not be used in ways related to PHI.

For a med spa that means the patient portal, medical records, and anything like a skin-care reorder area where a logged-in patient's identity meets their treatment. AmSpa's advice for those sections is to confirm with your website vendor that no third-party trackers run there unless a BAA is in place. For public pages, the same article says that in the vast majority of cases you should be fine using pixels. That was written in October 2024, before most of the 2026 developments below.

Is HIPAA even your biggest tracking risk now?

For many aesthetic practices, no. Practices that are not HIPAA covered entities, and covered ones that advertise heavily, face a second set of rules. The FTC's first Health Breach Notification Rule case, against GoodRx on February 1, 2023, ended in a $1.5 million civil penalty. The FTC said the company shared medication and health-condition data with Facebook, Google and Criteo, and that it showed a HIPAA-style seal that falsely implied compliance.

In April 2024 the FTC finalized changes to that rule. It applies to vendors of personal health records that HIPAA does not cover, and a breach now includes an unauthorized disclosure, not only a hack. For breaches affecting 500 or more people, the FTC must be told no later than 60 days after discovery.

The pressure has kept building. Holland & Knight's August 2026 alert reports that the FTC, Utah and Los Angeles County sued Hims & Hers in July 2026, alleging treatment data and customer lists reached ad platforms through pixels, contrary to the company's privacy policy. The same alert says four companies settled FTC pixel cases in 2023 and 2024 with penalties from $100,000 to $7.8 million. These are allegations and settlements, not findings against any med spa.

What do state laws and demand letters add?

They add consent rules that HIPAA never had, and a plaintiff's bar that does not wait for a regulator. AmSpa's September 14, 2026 article describes a growing wave of demand letters and privacy lawsuits that cite the federal Wiretap Act, state medical privacy statutes and sometimes HIPAA. It says the theories remain unsettled and many cases settle before a court reaches the merits.

Washington's My Health My Data Act is the strictest template. The statute requires consent that is separate and distinct for sharing health data, apart from consent to collect it. It also says accepting a general terms-of-use agreement is not valid consent, and it bans geofences of 2,000 feet or less around in-person health care locations used to track patients or send health-related ads. Its collection and sharing rules applied from March 31, 2024 (June 30, 2024 for small businesses).

Here is how Holland & Knight summarizes the penalty exposure in other states.

Source: Holland & Knight, August 25, 2026. I have not checked each state statute individually, so confirm the penalty and cure terms for the state where your patients live.

What can a practice still run, page by page?

The table below is my practical read of the sources above, not legal advice. It sorts your site by how close each page sits to a named patient and a named treatment. The pattern is the same one the sources describe: the closer a page is to a specific person and a specific procedure, the less a third-party pixel belongs there.

Holland & Knight's 2026 alert lists audit priorities that fit this table: inventory every pixel, SDK and script, configure your consent tool so no non-essential tag fires before opt-in, check treatment, intake, booking and portal pages specifically, and get data-processing agreements from every vendor. It also says to reconcile your privacy policy with what your site actually does, because the Hims & Hers theory turns on a gap between the two.

Notice what this does to your reporting. Many agencies optimize on pixel data, and a practice that gates tags will see fewer conversions in the ad platform. Track booked consults in your CRM or scheduler and compare them to ad spend there. That is a better number anyway, as we cover in the post on what patients see when they ask AI to recommend a doctor, where visibility does not depend on a pixel at all.

How do you check where you stand?

Run a two-hour self-test before you call a lawyer. Open your booking page in a private browser window with the browser's developer tools on the Network tab, then load the page without clicking the cookie banner. List every request that goes to a domain you do not own. Anything from an ad platform that fires before consent is your first fix.

Repeat the test on one procedure page, your consult form after you type fake data, and your portal login. Write down the vendor, the page and whether you have a BAA or a signed data-processing agreement. Hand that list to your attorney and your web vendor together. It turns an open-ended compliance question into a checklist.

If you would rather see how patients and AI assistants find your practice without touching your site's tags, our free AI visibility audit runs your real procedure questions against five engines using only public sources. We also describe how we work with practices on the medical practices page.

Frequently asked questions