EXHIBIT 01
The guidance was vacated
In June 2024, a federal court vacated the HHS Office for Civil Rights guidance on online tracking technologies in AHA v. Becerra.
AHA v. BECERRA / N.D. TEX. / JUN 2024
The record
01 / The record
There is no clear federal rule on tracking technology and health information right now. There is, however, a live and expensive record of what happens when a hospital website ships tags it cannot fully account for.
EXHIBIT 02
The litigation did not stop
Advocate Aurora Health settled pixel litigation for 12.225 million dollars. Class actions over hospital website tracking continue regardless of the federal guidance question.
ADVOCATE AURORA HEALTH / SETTLEMENT / $12,225,000
EXHIBIT 03
Regulators are still writing letters
OCR and the FTC jointly sent roughly 130 warning letters to hospital systems and telehealth providers about tracking technologies on their websites and portals.
OCR + FTC / JOINT WARNING LETTERS / N ≈ 130
Net effect: no settled federal standard, ongoing litigation risk, and marketing teams who removed measurement tools after the initial guidance - and now cannot say with confidence what their site sends, to whom, and under what conditions.
The questions
02 / The questions
These are searched constantly, and most confident answers to them are wrong. The correct answer is almost always the same: it depends on configuration. An audit is how you find out what your configuration actually is.
Is Google Analytics HIPAA compliant?
It depends on how it is configured on the specific page, and what it is placed next to.
Is our Meta pixel sending patient data?
It depends on the pages it loads on and the parameters attached to each event.
Can we run call tracking under HIPAA?
It depends on the vendor agreement in place and what the number-swap script actually captures.
What does our consent banner actually block?
It depends on load order. A banner that blocks visually can still fire tags underneath it.
The audit
03 / The audit
The engagement produces a single artifact: a documented record of what your public site actually does - capable of standing up in front of legal, a regulator, or a plaintiff's attorney.
3.1
Full tag and pixel inventory
Every script and pixel loading on public pages, catalogued by vendor, trigger, and page context.
3.2
Pre / post-consent behavioral diff
What fires before a consent decision is made, and what changes after acceptance or rejection.
3.3
Third-party data-flow map
Where each request goes, and which identifiers, parameters, and page values travel with it.
3.4
Evidence-grade findings document
Timestamped, reproducible records your legal and privacy officers can review and act on directly.
3.5
Remediation priorities
Findings ranked by exposure, so engineering and marketing fix the highest-risk items first.
METHOD NOTE
The audit is a runtime capture on public pages only. No access to your patient portal, and no access to protected health information is required at any stage.
Who it is for
04 / Scope
04.1
Hospitals
High-traffic public sites with dozens of legacy tags accumulated across departments and campaigns.
04.2
Health systems
Multiple properties and marketing teams, each capable of adding a tag without central review.
04.3
Cancer centers
Highly sensitive condition and treatment pages that draw the most scrutiny from regulators and plaintiffs.
04.4
Multi-location specialty practices
Location and provider pages built by different agencies over time, rarely audited as a single system.
Field guides
06 / GUIDES
Working references for hospital and health system marketing teams - the questions we are asked in every engagement, answered the way we answer them in an audit. See also: use cases by buyer situation →
Is Google Analytics HIPAA compliant?
Why the default answer is no, what a BAA has to do with it, and what a defensible analytics setup requires.
Read the guide →HIPAA compliant tracking: the realistic stack
The BAA question applied to analytics, call tracking, automation, chat, forms, and CRM - category by category.
Read the guide →Healthcare pixel lawsuits: the record
The vacated guidance, the settlements, the warning letters - what is actually established and what to do about it.
Read the guide →What a website tracking audit covers
Runtime inventory, consent-state diffing, third-party data flows, and the deliverable legal can read.
Read the guide →HIPAA compliant CRM: what actually qualifies
The BAA at your plan tier, the CRM’s own tracking script, integration exposure, and the boundary with the clinical record.
Read the guide →HIPAA compliant forms: the intake stack
The form vendor is the visible question - the thank-you page, notification emails, and spam services are where intake data actually leaks.
Read the guide →The HIPAA compliant website, component by component
Hosting, forms, chat, analytics, embeds, pixels - what each component receives and what each one requires.
Read the guide →HIPAA compliant chat: bots, agents, transcripts
Chat transcripts are free-text health information. What live chat, scripted bots, and AI assistants each require.
Read the guide →Patient journey analytics without the privacy debt
Measuring search-to-appointment on a first-party, BAA-covered architecture instead of third-party pixels.
Read the guide →Work with the practice: healthcare analytics consulting
Runtime audits, measurement architecture, and service-line attribution - built by engineers, verified at runtime.
See the practice →05 / Next step
Bring your privacy officer. We will show you the record together.
The audit runs on your public pages only. No PHI access, no portal access, no disruption to your live site during capture.