Draw a line through the site. On one side, marketing pages where no one enters health details, which may carry analytics and ad tags like any site. On the other, the pages where a person books, describes symptoms, logs in or registers, which carry no third-party tags unless the vendor has signed a BAA, and whose forms, notifications and hosting are secured to your security review's standard.
We build sites this way and document the tags page by page, we sign a HIPAA business associate agreement where our work touches protected health information, and we do not call ourselves HIPAA compliant, because that is not a thing a design company can be. Where data is hosted is decided in your contract and your security review.
Who is regulated, and why the website is in scope
The HHS Office for Civil Rights' bulletin on online tracking technologies addresses HIPAA covered entities and business associates, which it calls regulated entities, and says the HIPAA Rules apply when the information they collect through tracking technologies or disclose to tracking vendors includes protected health information. It defines a tracking technology as a script or code on a website or mobile app used to gather information about users or their actions, and names cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts, plus the device and advertising identifiers that apps collect.
The bulletin's examples make the website's role plain: an individual's medical record number, home or email address, dates of appointments, IP address, geographic location and device identifiers can all be disclosed through tracking, and where such information meets the definition of individually identifiable health information it is PHI. A practice's website is therefore part of its HIPAA footprint wherever a person enters or reveals something about their health.
Which pages carry protected health information
The bulletin draws its lines by page type. On user-authenticated pages, such as a patient portal or a telehealth platform, tracking technologies generally have access to PHI, and the regulated entity must configure any such page so that tracking uses and discloses PHI only as the Privacy Rule permits, and must protect the electronic PHI under the Security Rule.
On unauthenticated pages, which need no login, tracking on many pages, such as location, visiting hours or job postings, does not reach PHI and is not regulated by HIPAA. But the bulletin gives the cases where it can: a page that lets a person schedule an appointment or use a symptom checker without logging in, where the email address or reason for seeking care typed in is disclosed to the tracking vendor; and the portal login or registration page, where credentials or registration details entered are individually identifiable health information. Those pages are regulated even though no one has logged in.
For a designer, that gives a working map: the home page, service pages, clinician pages, blog and contact details may carry ordinary analytics; the appointment request, symptom or intake tool, portal, login and registration pages are the patient side, and the rules below apply to them.
Tracking, pixels and analytics: what the guidance requires
Where tracking reaches PHI, the bulletin's requirements are specific. Disclosures to a tracking vendor must be permitted by the Privacy Rule and limited to the minimum necessary. A tracking vendor that creates, receives, maintains or transmits PHI for a regulated entity is a business associate, and a business associate agreement is required. Telling users in a privacy policy or terms that tracking is used does not permit the disclosure; a website banner asking users to accept or reject cookies does not constitute a valid HIPAA authorization; and it is insufficient for a vendor to agree to remove or de-identify PHI after receiving it. Where no Privacy Rule permission applies and the vendor is not a business associate, each individual's HIPAA-compliant authorization is required before PHI is disclosed.
In practice: no ad platform pixels, retargeting tags or session recording on the patient-side pages, because those vendors typically will not sign a BAA for that data; analytics on those pages only through a vendor that has signed one, configured to receive the minimum; and a documented list, page by page, of every tag on the site, kept current as the site changes. A tag manager that fires every tag on every page is the most common way a practice breaks this without knowing.
The June 2024 court order, and what it did and did not change
The HHS page itself records that on 20 June 2024, in American Hospital Association v. Becerra, the U.S. District Court for the Northern District of Texas vacated the guidance to the extent it provides that HIPAA obligations are triggered in circumstances where an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers, and that HHS is evaluating its next steps. The order concerns that one position about IP addresses and public condition or provider pages. The guidance's statements about authenticated pages, about appointment and symptom tools and login and registration pages that collect health details, about business associate agreements, about cookie banners and about mobile apps are not what the court vacated. Treat the vacated position as unsettled, follow the rest, and ask counsel how the order applies to your pages.
Forms: appointment requests, intake and contact
Five rules for forms:
- Keep every form that asks for a health detail (reason for visit, symptoms, insurance, date of birth with a name) on the patient side of the line: no third-party tags on the page without a BAA, and no tag that reads form fields.
- Send form data only to systems your security review has approved: the practice management or scheduling system under a BAA, or a secured mailbox or portal; never as a plain email notification to a shared inbox.
- Encrypt the form in transit and at rest, limit who can read submissions, and set retention so that submissions do not sit in a web platform's database for years.
- Make the contact form a non-health form: name, phone, email and a message field with a note not to include health details, and route health questions to a secured channel.
- Show the practice's privacy notice where the form is, and keep the notice and the actual data flows in step.
Hosting, email notifications and vendors
Hosting, email, chat, scheduling, analytics and any other vendor that may touch PHI is a potential business associate. For each, ask three questions before any data flows: will this vendor receive, store or transmit PHI; will the vendor sign a business associate agreement that your counsel accepts; and does the configuration meet your security review's requirements for encryption, access control, logging and backups. A vendor that will not sign a BAA for the data in question does not touch that data. We sign a business associate agreement ourselves where our build or maintenance work touches PHI; where your data is hosted is a decision made in your contract and your security review, not on a marketing page.
Apps and portals, and the rule outside HIPAA
The bulletin extends the same logic to mobile apps that regulated entities offer: information typed into the app and device identifiers are generally PHI, and disclosures to app vendors, tracking vendors or any third party must comply with the HIPAA Rules. It also notes the boundary: health information a person enters into an app that is not offered by or on behalf of a regulated entity is not protected by HIPAA, and other law may apply, naming the FTC Act and the FTC's Health Breach Notification Rule. The FTC's April 2024 press release on the final changes to that rule says it applies to health apps and similar technologies not covered by HIPAA and requires notification of individuals, the FTC and in some cases the media after a breach of unsecured health data. Our guide to healthcare app development cost covers what that adds to a build, and our mobile app development page covers the build itself.
Canada
A practice or health brand in Canada works under the Office of the Privacy Commissioner's PIPEDA for personal information handled in commercial activity, under the substantially similar provincial laws of Alberta, British Columbia and Quebec where they apply, and under provincial health privacy laws such as Ontario's PHIPA for health information. The design principles are the same: separate the pages, keep third-party tags off the health side, secure the forms and know every vendor; the legal tests and the authorities differ, so read the law for your province.
The marketing site still has to work
None of this excuses a slow or vague site. Google's Core Web Vitals targets apply to the marketing pages as to any site: a Largest Contentful Paint of 2.5 seconds or less, an Interaction to Next Paint under 200 milliseconds and a Cumulative Layout Shift under 0.1 at the 75th percentile. The service, clinician and location pages can carry ordinary analytics and be measured normally, and the patient-side pages can be measured through an approved method. Our guide to medical website design covers what patients look for on those marketing pages.
If you want it built this way
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. Our web design and development page explains how we plan, build and test sites, and for a practice we build the patient pages separated from the marketing pages and document every tag page by page. We do not certify compliance and we do not call ourselves HIPAA compliant; we sign a HIPAA business associate agreement where our work touches protected health information, and where data is hosted is settled in your contract and your security review. This guide is general information, not legal advice.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.