Healthcare Marketing Pixels After the HHS Bulletin and AHA v. Becerra

HIPAA pixel tracking risk did not end when a Texas court vacated part of HHS's tracking-technology bulletin in June 2024. The ruling removed one scenario only: an IP address paired with a visit to a public, unauthenticated page about a condition or provider. HHS's position on logged-in portals and mobile apps stands, and private lawsuits and FTC enforcement continue. The safest design is first-party, server-side collection that filters PHI before any third-party destination.

Who this is for: marketing operations, web teams, privacy officers and architects at providers, payers and digital health companies. You get a plain reading of the bulletin and the ruling, the 2024–2026 litigation picture, FTC precedents, a design that holds up, and a remediation checklist. The healthcare hub links the related guides.

What the HHS bulletin said

HHS's Office for Civil Rights (OCR) issued its bulletin on online tracking technologies in December 2022 and a revised version on 18 March 2024. The revised version said it does not have the force and effect of law and is not meant to bind the public 1. Its positions, as summarised by McDermott Will & Emery 3:

• Logged-in pages (patient portals, telehealth, appointment management): tracking technologies there generally have access to PHI and must be configured to use and disclose it only as the Privacy Rule allows.
• Public pages: usually not PHI, but pages that take appointment requests or symptom-checker input can involve PHI, for example when an email address or reason for care is entered.
• Mobile apps: information an app collects is generally PHI.
• Disclosures to a tracking vendor still need a Privacy Rule basis: a business associate agreement where the vendor acts for you, or an authorization for marketing uses.
• The "Proscribed Combination": an IP address plus a visit to a public page about a specific condition or provider, treated as PHI 1.

What AHA v. Becerra vacated, and what stands

In American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex., Fort Worth), the court issued its Opinion & Order and a Final Judgment on 20 June 2024. It declared the Proscribed Combination unlawful because HHS exceeded its authority under HIPAA, vacated it under 5 U.S.C. section 706, and denied the permanent injunction 12.

The reasoning is narrow. Individually identifiable health information must relate to a person's health, care or payment, and must identify the person or give a reasonable basis to identify them. The court held that an IP address plus a public-page visit fails both prongs because it depends on an "unknowable" element: the visitor's subjective reason for visiting 1. It did not hold that a tracker on any page is safe, and it did not address logged-in pages. The court added that the judgment does not limit the legal operability of anything else in the 18 March 2024 bulletin 2. Because the injunction was denied, HHS could in principle still revise its guidance or pursue rulemaking 5, but it withdrew its appeal on 29 August 2024 4.

The ruling does not affect FTC enforcement or private wiretapping class actions 3. Read it as a limit on one HHS theory, not a licence. Our HIPAA marketing rules explainer covers authorizations and exceptions.

The private-litigation landscape, 2024–2026

• Meta's 10-Q for the quarter ended 30 June 2026 names In re Meta Pixel Healthcare Litigation among putative class actions filed starting 7 June 2021, says several Meta motions to dismiss were denied in whole or in part, and reports a jury finding of liability on one California Invasion of Privacy Act claim in Frasco v. Flo Health, where plaintiffs seek $5,000 in statutory damages per class member. Meta states that potential damages are uncertain 6.
• Class certification is not automatic. In the separate Meta Pixel Tax Filing Cases, the court denied certification on 30 March 2026 6; Holland & Knight reports the decision turned on proof of standing and individualised issues 7.
• Hospital settlements are modest per person. Fairchild Medical Center (California) offered about 1,000 class members $25 each plus a one-year CyEx Privacy Shield Pro membership, with a final approval hearing set for 15 October 2026 (outcome not checked). Boone Health (Missouri) offered portal users a $20 claim, with a fairness hearing set for 1 December 2026 8. Duke University Health System agreed to about $3.74 million for MyChart and app users, with preliminary approval in March 2026 9. Each defendant denies wrongdoing; settlements are not findings.
• The pattern: exposure scales with class size, and outcomes turn on what was sent, to whom, and with what consent.

FTC actions and the Health Breach Notification Rule

The FTC polices health data that HIPAA does not reach.

• GoodRx (1 February 2023): the first Health Breach Notification Rule enforcement. GoodRx agreed to a $1.5 million civil penalty after the FTC alleged it shared prescription and condition information with Facebook and Google despite promises not to; the proposed order bars sharing health data for advertising 10.
• BetterHelp (final order 14 July 2023): $7.8 million, for allegedly disclosing email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest. The order bans sharing health data for advertising and requires affirmative express consent for other disclosures 11.
• Rule update (26 April 2024): the FTC clarified that the rule applies to health apps and similar technologies not covered by HIPAA, and that an unauthorised disclosure counts as a breach. It added definitions of "covered health care provider" and "health care services or supplies," which includes any online service such as a website or app. Individuals must be told within 60 calendar days of discovery, and the FTC at the same time for 500 or more people 1213.

Platform terms point the same way. Meta's Business Tools Terms, effective 3 November 2025, have you warrant that you will not share data that includes or is based on health information 14. Google Analytics' terms bar passing information Google could recognise as personally identifiable, hashed or otherwise, and say nothing about HIPAA or business associates 15. Sending health context to those platforms breaches their terms, and there is no BAA route to cure it. For tool-by-tool answers, see Mailchimp, HubSpot, Klaviyo and GA4.

State law reaches data HIPAA does not

Washington's My Health My Data Act requires consent before collecting consumer health data and separate consent before sharing it, bans geofences around in-person health care facilities, and treats violations as unfair or deceptive acts under the state Consumer Protection Act. Information that is PHI under HIPAA is exempt 16. That leaves an important group covered: site visitors and leads who are not yet patients. See US state privacy laws 2026–2028.

A design that holds up: first-party, server-side, filtered

1. Collect first-party. Send events to an endpoint on your own domain. Put no third-party scripts on logged-in, scheduling, search or form routes.
2. Classify the route. Public informational, public interactive, authenticated, app. Third-party destinations are denied by default everywhere except where documented.
3. Gate on consent. Honour opt-in where state law requires it, honour opt-out signals, and store the consent state with every event. Marketing disclosures of PHI need an authorization 17.
4. Filter with an allowlist, not a blocklist. Forward only named fields. Drop IP address, user agent, referrer, full URL and query string, page title, form values and search terms. Hashing an email address does not de-identify it: Safe Harbor lists email addresses and IP addresses among its 18 identifier types 18, and Google's terms cover hashed data 15.
5. Send identified data only to destinations under a BAA, and only for permitted purposes.
6. Log every outbound payload with destination, schema version, consent state and the rule that fired.
7. Monitor. Scan tags and SDKs on a schedule and put tag changes under change control, including agency-added scripts.

Vendors such as Freshpaint market BAA-supported tracking for healthcare 20; treat that as a claim to test against the contract. Website analytics follows the same logic: self-hosted analytics or a BAA-backed tool on sensitive routes, and no consumer ad pixels there.

What a customer data platform must do

PrivyCDP's append-only audit ledger and customer-owned deployment target the last row; the HIPAA-compliant customer data platform guide compares how vendors handle the rest. The BAA checklist covers contract terms.

Remediation checklist

1. Inventory every tag, pixel, SDK and session-replay script on web and app, including agency-added ones.
2. Map each page and screen to a route class and list what it collects.
3. Remove third-party trackers from logged-in, scheduling, search and form flows unless there is a BAA and a documented need.
4. Block ad-platform tags on condition- and provider-specific pages pending legal sign-off.
5. Review vendor contracts: BAA, or no PHI at all.
6. Move to first-party server-side collection with an allowlist filter.
7. Update consent banners and, where PHI is used for marketing, authorizations.
8. Reconstruct what was sent in the past, to whom, and for how long.
9. Run a breach risk assessment on any PHI disclosed: the four factors in 45 CFR 164.402, with the 60-day notice clock running from discovery 21.
10. Record the work in your Security Rule risk analysis.
11. Test quarterly with synthetic traffic and before each release.
12. Train marketing staff and agencies; require approval for new tags.

Checked 2026-10-17 unless noted.

If you are rebuilding web and app measurement on first-party, server-side collection inside your own boundary, the deployment qualification page explains how PrivyCDP deployments are scoped. Return to the healthcare hub for related guides.