Georgia Consumer Privacy Bill SB 473: Healthcare Marketing Implications for GA Providers

In 2024, Advocate Aurora Health agreed to a $12.25 million settlement to resolve a class action alleging it shared patient information with Meta and Google through a tracking pixel, one of the largest of dozens of similar suits filed against U.S. hospitals.^[1] Georgia providers should pay close attention. Although Georgia SB 473 (the Georgia Consumer Privacy Protection Act) did not become law in 2024, its proposed framework, combined with HIPAA, FTC enforcement, and a wave of pixel-tracking lawsuits, defines the compliance environment GA hospitals, medical practices, behavioral health groups, and digital health companies now operate in. This article explains what SB 473 would have required, why its substance still matters for GA consumer privacy healthcare compliance, and what marketing teams must do today to avoid HIPAA marketing penalties, regulatory action, and class-action exposure.

What Georgia SB 473 Proposed (and Where It Stands)

The Georgia Consumer Privacy Protection Act (SB 473) passed the Senate on February 27, 2024, by a vote of 37–15 and was favorably reported by the House Technology and Infrastructure Innovation Committee on March 20, 2024.^[2] The legislature adjourned in late March without a House floor vote, and the bill died without becoming law. A 2025 successor, Senate Bill 111, was a substantially similar measure that advanced in the Senate before stalling in the House.

SB 473 would have applied to entities exceeding $25 million in annual revenue that processed personal data of at least 175,000 Georgia residents (or 25,000 residents where more than half of revenue derived from data sales), with civil penalties of up to $7,500 per violation (and treble damages for knowing or willful violations) and a 60-day cure period.^[3] The bill granted consumers rights to access, correct, delete, and obtain copies of their personal information, and to opt out of the sale of their personal information or its use for targeted advertising or profiling. The Attorney General had exclusive enforcement authority, and the bill was scheduled to take effect on July 1, 2026 if adopted.

Even though Georgia SB 473 stalled, healthcare entities operating in Georgia still face binding obligations. Georgia's breach notification statute applies, Georgia courts are actively developing common law data protection standards, and federal sectoral regimes including HIPAA apply regardless of the state-law void. Multistate Georgia health systems that serve patients in California, Colorado, Virginia, Connecticut, Texas, and other states must also comply with those state regimes today, regardless of how Georgia legislates next.

The Current Enforcement Landscape

OCR Enforcement Trends

OCR Director Melanie Fontes Rainer confirmed that 2024 was almost a record year for HIPAA enforcement, with more than $9.9 million collected in 22 settlements and civil monetary penalties, including a $4,750,000 settlement with Montefiore Medical Center to resolve multiple HIPAA Security Rule violations.^[4] OCR's most frequently cited violation was an inadequate risk analysis, and in late 2024, OCR launched its Risk Analysis Initiative to increase the number of completed investigations and highlight the need for better compliance with this Security Rule requirement.

FTC Involvement and Dual Jurisdiction

For digital health vendors and consumer-facing health apps outside HIPAA's direct reach, the FTC has become the principal enforcer. The FTC required online counseling service BetterHelp to pay $7.8 million and prohibited it from sharing consumers' health data for advertising, resolving allegations the firm shared consumers' sensitive health data with third parties such as Facebook and Snapchat for advertising after promising to keep such data private.^[5] One month earlier, GoodRx was prohibited from sharing user health data with applicable third parties and agreed to pay a $1.5 million civil penalty, the first enforcement action ever brought under the Health Breach Notification Rule.

The Class-Action Lawsuit Explosion

Class action exposure is now the largest financial threat for many Georgia hospitals and health systems. OCR's online tracking technologies guidance has spurred class action litigation, breach notifications, and governmental investigations nationwide.^[6] Representative settlements include:

• Advocate Aurora Health: $12.25 million to settle a consolidated class action alleging the system shared users' personal information without consent with third parties like Meta and Google through a tracking pixel.
• MarinHealth: $3 million settlement fund to resolve claims related to its use of the Meta Pixel tracking tool on its website between 2019 and 2025, from which attorneys' fees, class representative awards, and legal costs will be deducted.^[7]
• Jefferson Healthcare: Agreed not to use Meta Pixel on its website for at least two years and to pay $125,000 in attorneys' fees plus class representative awards and administration costs.^[8]

State-Level Actions

State Attorneys General are increasingly stepping into the tracking-tech space. The New York Attorney General secured a $300,000 financial penalty from NewYork-Presbyterian Hospital to resolve alleged HIPAA Privacy Rule violations stemming from tracking pixels and tags placed on its website between June 2016 and June 2022.^[9] For Georgia providers that operate multi-state, our overview of multi-state healthcare marketing compliance outlines how overlapping privacy laws stack penalties.

Specific Risks and Consequences

Financial Penalties

• OCR civil monetary penalties: Tiered and inflation-adjusted per violation, with annual caps; per-violation fines can add up quickly if multiple records or pages are affected, and the cap underscores the significance of large-scale tracking failures.
• FTC civil penalties: Substantial consumer-refund judgments (such as the GoodRx and BetterHelp orders described above), plus long-term compliance programs that typically run for many years.
• State AG penalties: The NewYork-Presbyterian settlement marked one of the first state-AG enforcement actions specifically targeting pixel-based PHI disclosure, and additional states are expected to follow.
• Class-action settlements: Disclosed hospital pixel settlements have ranged from roughly six figures to eight figures depending on the size of the class and the sensitivity of the data; class counsel fees and administration costs are typically substantial on top of class funds.
• Breach economics: Healthcare breaches consistently rank as among the most expensive across industries when all response, notification, and remediation costs are tallied.

Reputational Damage

OCR's "Wall of Shame" publicly lists breaches affecting 500 or more individuals, and pixel-driven disclosures often reach hundreds of thousands of website visitors. Website tracking that collects ePHI can affect very large populations and often involves highly sensitive conditions; the scale and sensitivity amplify enforcement risk.

Operational Disruption

A Corrective Action Plan is a multi-year program that focuses teams on steady improvements: drafting and enforcing policies, closing technical gaps, delivering regular training, and reporting progress on a set cadence. Day to day, it raises the bar on governance of data flows, including third-party scripts, pixels, and tags, until continuous monitoring is demonstrable. Post-incident work commonly includes removing or re-configuring trackers across all web properties, implementing client-side monitoring, renegotiating BAAs with web vendors, and tightening consent controls.

Personal and Executive Liability

FTC orders increasingly target individual officers, and HIPAA's criminal provisions (42 U.S.C. § 1320d-6) can apply where executives knowingly permit impermissible disclosures. Regulators have specifically called out governance failures, including assigning critical data-sharing decisions to junior staff without adequate training.

How Violations Happen

Technical Configurations

The single most common violation pattern is a marketing or web team deploying a tracker without understanding what data it transmits. Meta Pixel tracks website users and logs their activity, such as which buttons they click, which pages they visit, and certain information they enter into forms. When that activity occurs on an appointment page, symptom checker, or condition-specific landing page, the transmitted data becomes PHI under HIPAA. The same risks apply to Google Analytics, conversion APIs, session-replay tools, and chat widgets.

Vendor Relationships and BAAs

OCR's tracking-technology bulletin, even after partial court vacatur, is explicit on vendor handling. Regulated entities may not share PHI with tracking technology vendors (e.g., third-party advertisers) absent a business associate agreement with the vendor or pursuant to a patient authorization.^[10] Meta and Google generally will not sign BAAs covering pixel data, leaving providers exposed. If a tracking technology vendor will not sign a BAA, a regulated entity could choose to establish a BAA with another vendor, for example a Customer Data Platform vendor, that will enter into a BAA with the regulated entity to de-identify online tracking information that includes PHI.

The Post-AHA Legal Picture

Georgia providers should understand both what changed and what did not. A federal court held that OCR's "Proscribed Combination" guidance was unlawful and that OCR exceeded its authority under HIPAA; however, the court declined to enjoin OCR's enforcement of the bulletin and instead vacated only the Proscribed Combination from the bulletin.^[11] An IP address coupled with information that a person visited a website may not be IIHI as suggested by the vacated guidance, but HIPAA still applies if a person's health information is collected along with individually identifiable data, including information confirming that an individual has a certain condition, sought care on a certain date or location, or paid for their care. HIPAA has always applied and continues to apply to such PHI.

Audit Triggers and Red Flags

• Patient complaints to OCR after seeing targeted ads for conditions they researched on a provider site.
• Browser-based audits by plaintiffs' firms scanning hospital sites for pixel activity.
• Breach notifications filed by the provider itself once tracking is discovered internally.
• State AG sweeps following high-profile press coverage.
• Random OCR audits under the Risk Analysis Initiative.

Protection Strategies for Georgia Providers

Immediate Actions (This Week)

1. Run a browser-level scan of every public, authenticated, and patient-portal page to inventory pixels, tags, session-replay scripts, and chat widgets.
2. Pull every active marketing/analytics vendor contract and confirm BAA status.
3. Identify any URL parameters, form fields, or appointment-type values that could reach a third party.
4. Document the current state in writing; OCR investigators expect contemporaneous records.

Short-Term Fixes (This Month)

1. Remove or reconfigure any tracker that lacks a signed BAA and transmits health-context data.
2. Migrate to server-side tracking with PHI stripping before data leaves your environment.
3. Update online privacy notices to reflect actual data flows; vague language will not satisfy the FTC.
4. Train marketing, IT, and digital staff on what constitutes PHI in a URL or event payload.

Long-Term Compliance Infrastructure

Implement continuous monitoring of client-side scripts, schedule recurring privacy impact assessments, and align your program with HIPAA Security Rule risk-analysis expectations. Providers expanding into Oregon, Montana, or Minnesota should review state-specific obligations early; see our guides to the Oregon Consumer Privacy Act for healthcare providers and the Minnesota Consumer Data Privacy Act for healthcare marketing.

Vendor Evaluation Criteria

• BAA availability: Will the vendor sign a BAA covering all data flows, not just storage?
• PHI handling: Does the vendor strip PHI server-side before transmission to ad platforms?
• Certifications: SOC 2 Type II, HITRUST, or equivalent independent attestation.
• Healthcare track record: Documented experience with hospitals, behavioral health, and digital health clients.
• Audit logs: Tamper-evident records of what data was sent, when, and to whom.

How Curve Solves the Tracking-Compliance Problem

Curve is a HIPAA-compliant tracking solution built specifically for the risks above. Where traditional pixels send raw form fields, URL parameters, and IP addresses to Meta and Google, Curve addresses each failure mode directly:

• Automated PHI stripping: Curve removes protected health information at the server before any data is transmitted to ad platforms, eliminating the most common cause of pixel litigation.
• Server-side tracking: Conversion data flows through Curve's infrastructure (not the patient's browser), closing the client-side leakage path that plaintiffs' firms scan for.
• Signed BAAs included: Curve executes a BAA with every customer, satisfying the OCR requirement that any vendor receiving PHI be a business associate.
• Audit trails: Every event is logged with a tamper-evident record, providing the documentation OCR and state AGs expect during investigations and Corrective Action Plans.
• Healthcare-specific design: Built for hospitals, behavioral health, telehealth, and specialty practices, including therapy practices balancing growth and privacy (see therapy practice marketing and privacy-first Facebook ads for therapy practices).
• Rapid implementation: Most Georgia providers can replace risky pixels with a compliant configuration in days, not quarters.

Don't Wait for Enforcement

Every day without compliant tracking is a day of risk exposure. Schedule a Compliance Assessment with Curve.

Georgia Healthcare Marketing Compliance Self-Assessment Checklist

• We have inventoried every tracking pixel, tag, and script on our public site, authenticated portals, and mobile apps.
• We have a signed BAA with every vendor that could receive PHI, including any analytics or marketing platform.
• Server-side tracking with PHI stripping is in place for all marketing conversion events.
• Our privacy notice accurately discloses third-party data flows in plain language.
• Marketing, IT, and clinical-digital staff have completed training on PHI in URLs, forms, and ad events.
• A current HIPAA Security Rule risk analysis covers our website and marketing stack.
• We maintain audit logs sufficient to reconstruct any data transmission to a third party.
• We have a documented incident response plan covering tracking-technology disclosures.
• We monitor evolving Georgia legislation (successors to SB 473 and SB 111) and multi-state obligations.

Frequently Asked Questions

What are the penalties for HIPAA marketing violations?

HIPAA civil monetary penalties are tiered by culpability with per-violation amounts and annual caps that are inflation-adjusted each year. In 2024, OCR collected more than $9.9 million in 22 settlements and civil monetary penalties, including a $4,750,000 settlement with Montefiore Medical Center.^[4] FTC penalties under the Health Breach Notification Rule and Section 5 have reached substantial multi-million-dollar amounts (GoodRx and BetterHelp), and reported hospital pixel class-action settlements have ranged from roughly six figures to eight figures per defendant.

Can healthcare practices be sued for using Meta Pixel?

Yes. Numerous hospitals and health systems have been sued and settled. Advocate Aurora Health agreed to pay $12.25 million to settle a consolidated class action accusing it of sharing users' personal information without their consent with third parties like Meta and Google through a tracking pixel.^[1] MarinHealth agreed to a $3 million settlement to resolve claims related to its use of the Meta Pixel tracking tool.^[7]

How do I know if my healthcare marketing is compliant?

Confirm three things: (1) every vendor that receives any data that could be PHI has a signed BAA; (2) PHI is stripped server-side before any transmission to ad platforms; and (3) your privacy notice matches actual data flows. If a covered entity shares PHI with a vendor or other entity, the covered entity must usually obtain a business associate agreement; general website privacy policies and terms of use are insufficient.

What should I do if I discover a compliance violation?

Stop the offending data flow immediately, preserve logs, and engage privacy counsel before notifying patients. Assess your obligations under the HIPAA Breach Notification Rule and, separately, the FTC's Health Breach Notification Rule if you operate a non-HIPAA consumer health product. Post-incident work commonly includes removing or re-configuring trackers across all web properties, implementing client-side monitoring, renegotiating BAAs with web vendors, and tightening consent controls.

Did Georgia SB 473 become law, and does it still affect us?

No, it did not become law. The legislature adjourned in late March 2024 without a House floor vote, and the bill died without becoming law. However, its substantive framework continues to shape Georgia legislative drafts (including SB 111 in 2025), and Georgia providers remain subject to HIPAA, FTC enforcement, Georgia's breach notification statute, and the privacy laws of every other state where patients reside.

Sources

1. Milberg, Aurora Health Agrees To $12.25M Settlement in Tracking Pixel Suit
2. Alston & Bird Byte Back, Proposed State Privacy Law Update (March 4, 2024)
3. WilmerHale, State Comprehensive Privacy Law Update (Feb. 23, 2024)
4. HIPAA Journal, State of HIPAA
5. FTC, Final Approval to Order Banning BetterHelp From Sharing Sensitive Health Data
6. Ropes & Gray, Federal Judge Vacates Key Points of OCR Tracking Guidance
7. HIPAA Journal, MarinHealth $3M Meta Pixel Settlement
8. HIPAA Journal, Jefferson Healthcare Meta Pixel Settlement
9. NY Attorney General, $300,000 NewYork-Presbyterian Settlement
10. Inside Privacy (Covington), HHS OCR Updates Tracking Technologies Guidance
11. Nixon Peabody, Portions of OCR Tracking Bulletin Deemed Unlawful