Glossary
HIPAA marketing glossary: 46 ad tracking terms, defined
This glossary defines the HIPAA, privacy and ad platform terms healthcare marketers meet when they track ads, in one or two plain sentences each, quoted from HHS, the eCFR or the platform's own documentation wherever a law or platform rule is involved. Curve Compliance keeps it, and each term links to a full Curve Compliance guide for the details.
On this page
HIPAA basics
Protected health information (PHI)
Individually identifiable health information, held or sent in any form or medium, electronic or not, with a few exclusions such as certain education and employment records.
“Protected health information means individually identifiable health information”
Why it matters for ad tracking: A pixel on a booking or condition page can send PHI to an ad platform, so a healthcare advertiser needs to know exactly what its tags send.
Go deeper: What does PHI stand for?, What counts as PHI on a website, PHI vs PII in healthcare marketing, Is a specific data point PHI?
Related: Electronic protected health information (ePHI), Individually identifiable health information (IIHI), The 18 HIPAA identifiers, De-identification and Safe Harbor
Electronic protected health information (ePHI)
PHI that is sent or stored in electronic form, such as data in a website form, a CRM or an email. It is the information the HIPAA Security Rule protects.
“Electronic protected health information means information that comes within paragraphs (1)(i) or (1)(ii) of the definition of protected health information”
Why it matters for ad tracking: HHS says ePHI collected through a website must be protected and secured under the Security Rule, so PHI captured by a form or tag is covered from the moment it is collected.
Go deeper: What is ePHI?, HIPAA Security Rule changes for marketing technology
Related: Protected health information (PHI), HIPAA Security Rule
Individually identifiable health information (IIHI)
Health information, including demographic details, that a provider, health plan, employer or clearinghouse creates or receives, that relates to someone's health, care or payment for care, and that identifies the person or reasonably could.
“Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual”
Why it matters for ad tracking: It is the building block of PHI: data that relates to health and identifies a person, such as a patient's email address sent alongside a booking.
Go deeper: What counts as PHI on a website, The 18 HIPAA identifiers in website data, Is a specific data point PHI?
Related: Protected health information (PHI), The 18 HIPAA identifiers
Covered entity
A health plan, a health care clearinghouse, or a health care provider that sends health information electronically in connection with a standard transaction, such as an insurance claim. HIPAA applies directly to covered entities.
“Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”
Why it matters for ad tracking: Whether your practice is a covered entity, or works for one, decides whether HIPAA applies to the data your website sends to ad platforms.
Go deeper: What is a HIPAA covered entity?, Does HIPAA apply to cash-pay telehealth?, Does HIPAA apply to med spas?
Related: Business associate, Protected health information (PHI)
Business associate
A person or company outside a covered entity's workforce that creates, receives, maintains or transmits PHI on its behalf, or provides certain services that involve PHI. Tracking and analytics vendors can qualify.
“tracking technology vendors are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function”
Why it matters for ad tracking: A vendor that receives PHI from your website needs a BAA, and Meta and Google Ads don't sign one, so PHI has to stay out of what their pixels receive.
Go deeper: What is a business associate?, What is a business associate agreement?, BAA Directory: which tools sign a BAA
Business associate agreement (BAA)
The written contract HIPAA requires between a covered entity and a business associate. It sets what the vendor may do with PHI, how it must protect it and how it reports problems, including breaches.
“A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate.”
Why it matters for ad tracking: A BAA covers the vendor that signs it, not the other tags on the same page, so each vendor that receives PHI needs its own.
Go deeper: What is a business associate agreement?, Sample BAA and template, BAA Directory: which tools sign a BAA
Related: Business associate, HIPAA Security Rule
Treatment, payment and health care operations (TPO)
The everyday purposes for which a covered entity may use or disclose PHI without the patient's authorization: treating patients, getting paid, and running the practice, such as quality review and business management.
“a covered entity may use or disclose protected health information for treatment, payment, or health care operations”
Why it matters for ad tracking: TPO does not cover marketing: HHS says disclosing PHI to tracking technology vendors for marketing without HIPAA-compliant authorizations is an impermissible disclosure.
Go deeper: HIPAA TPO: treatment, payment and operations
Related: Marketing (under HIPAA), Authorization (HIPAA), Minimum necessary
Notice of privacy practices (NPP)
The notice a covered entity must give patients describing how it may use and disclose their PHI, the rights they have, and the entity's own legal duties.
“an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity”
Why it matters for ad tracking: A privacy notice describes how PHI may be used; it is not an authorization, so it does not permit sending PHI to an ad platform.
Go deeper: Notice of privacy practices under HIPAA
Related: Authorization (HIPAA), Cookie banner vs HIPAA authorization
HITECH Act
The Health Information Technology for Economic and Clinical Health Act, signed in 2009. Among other things, it strengthened civil and criminal enforcement of the HIPAA rules.
“The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, was signed into law on February 17, 2009”
Why it matters for ad tracking: It set the four categories of HIPAA violations, by level of culpability, that decide the penalty range for any violation, including one caused by a tracking tag.
Go deeper: What is the HITECH Act?, HIPAA marketing penalties reference table
Related: Civil money penalty, Breach and breach notification
Marketing (under HIPAA)
A communication about a product or service that encourages people to buy or use it. The Privacy Rule lists exceptions, such as refill reminders and some treatment communications.
“marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”
Why it matters for ad tracking: Using or disclosing PHI for marketing generally requires the patient's written authorization first.
Go deeper: HIPAA marketing authorization and ad tracking
Related: Authorization (HIPAA), Treatment, payment and health care operations (TPO), Cookie banner vs HIPAA authorization
Authorization (HIPAA)
A patient's signed, specific permission that lets a covered entity use or disclose their PHI for a purpose the Privacy Rule does not otherwise allow, such as most marketing.
“a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing”
Why it matters for ad tracking: Without one, PHI can't be used for most marketing, and HHS says a cookie banner click is not one.
Go deeper: HIPAA marketing authorization and ad tracking
Related: Marketing (under HIPAA), Cookie banner vs HIPAA authorization
Minimum necessary
The Privacy Rule standard that covered entities and business associates limit PHI to the least needed for the purpose of each use, disclosure or request. Some disclosures, such as those for treatment, are exempt.
“make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request”
Why it matters for ad tracking: It is the reason to send each vendor a fixed, short list of fields rather than everything a tag can collect.
Go deeper: The minimum necessary rule and ad tracking
Related: Business associate agreement (BAA), Server-side tracking
De-identification and Safe Harbor
Health data is de-identified under HIPAA when an expert finds the risk of identifying anyone is very small, or under Safe Harbor when all 18 listed identifiers are removed and nothing left is known to identify someone.
“A covered entity may determine that health information is not individually identifiable health information only if:”
Why it matters for ad tracking: Removing names alone meets neither method, so data a vendor calls anonymized can still be PHI; a hashed email is a common example.
Go deeper: De-identified vs anonymized vs aggregated data
Related: The 18 HIPAA identifiers, Limited data set
Limited data set
PHI with direct identifiers such as names, street addresses, phone numbers and email addresses removed. A covered entity may share it only for research, public health or health care operations, under a data use agreement.
“A limited data set is protected health information that excludes the following direct identifiers”
Why it matters for ad tracking: A limited data set is still PHI, so it is not a way to send patient data to an ad platform.
Go deeper: De-identified vs anonymized vs aggregated data
Related: De-identification and Safe Harbor, Protected health information (PHI)
The 18 HIPAA identifiers
The 18 kinds of identifiers Safe Harbor de-identification requires removing, from names and small geographic areas to device identifiers, web URLs, IP addresses and any other unique identifying number, characteristic or code.
“Any other unique identifying number, characteristic, or code”
Why it matters for ad tracking: Web URLs and IP addresses are on the list, and a browser pixel request carries both.
Go deeper: The 18 HIPAA identifiers in website data, Are IP addresses PHI under HIPAA?, Is a specific data point PHI?
Related: De-identification and Safe Harbor, Click ID (gclid, fbclid), Tracking pixel (web beacon)
Breach and breach notification
A breach is a use or disclosure of PHI not permitted by the Privacy Rule that compromises its security or privacy. A breach of unsecured PHI must be reported to the people affected, HHS and, for large ones, the media.
“without unreasonable delay and in no case later than 60 calendar days after discovery of a breach”
Why it matters for ad tracking: If PHI reached an ad platform without a permitted basis, the breach rules decide who has to be told and by when.
Go deeper: Breach liability for clinic marketing teams
Related: Office for Civil Rights (OCR), FTC Health Breach Notification Rule
Office for Civil Rights (OCR)
The office within HHS that enforces the HIPAA Privacy, Security and Breach Notification Rules, along with other laws, and investigates health information privacy complaints.
“enforces federal civil rights laws, conscience and religious freedom laws, the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules”
Why it matters for ad tracking: OCR issued the bulletin on online tracking technologies that most healthcare tracking reviews start from.
Go deeper: What triggers an OCR marketing investigation
Related: Civil money penalty, Tracking technology
Civil money penalty
The fine HHS can impose for a HIPAA violation. Amounts depend on what the organization knew and how it responded, are capped per violation and per calendar year, and are adjusted for inflation every year.
“These amounts will be updated annually and published at 45 CFR part 102.”
Why it matters for ad tracking: The penalty tiers turn partly on whether a violation was corrected quickly, so finding and fixing a leaking tag early matters.
Go deeper: HIPAA marketing penalties reference table
Related: Office for Civil Rights (OCR), HITECH Act, Breach and breach notification
HIPAA Security Rule
The HIPAA rules for protecting electronic PHI with administrative, physical and technical safeguards. They apply to covered entities and business associates alike.
“Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.”
Why it matters for ad tracking: HHS has proposed that regulated entities get written verification of each business associate's technical safeguards at least once every 12 months. It is a proposal, not a final rule.
Go deeper: HIPAA Security Rule changes for marketing technology
Related: Electronic protected health information (ePHI), Business associate agreement (BAA), Business associate
Website tracking
Tracking technology
HHS's term for a script or code on a website or app that collects information about users and what they do, such as cookies, tracking pixels, session replay scripts and fingerprinting scripts.
“Generally, a tracking technology is a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app.”
Why it matters for ad tracking: This HHS bulletin is the main federal guidance on pixels and other trackers on healthcare websites. It opens with a note that a court order of June 20, 2024 vacated part of it.
Go deeper: What is a tracking pixel? The healthcare answer, The HHS tracking bulletin, annotated after AHA v. Becerra
Related: Tracking pixel (web beacon), Cookie (first-party and third-party), Session replay, Fingerprinting
Tracking pixel (web beacon)
A small piece of code, originally a 1-pixel image, that reports page views and actions to another company, such as Meta, Google or TikTok, each time it loads.
“A web beacon or tracking pixel is a tiny graphic image (usually 1 pixel) placed on a webpage that allows the website owner or a third party to collect information regarding the use of the webpage that contains the web beacon.”
Why it matters for ad tracking: A pixel sends what the page gives it, including the full URL and query string, so on a booking or condition page it can carry health details to the ad platform.
Go deeper: What is a tracking pixel? The healthcare answer, Told to remove all tracking pixels? How to still measure ads
Related: Tracking technology, Conversions API (Meta), Server-side tracking
Cookie (first-party and third-party)
A small file a website stores in the visitor's browser. A first-party cookie is set by the site the visitor is on; a third-party cookie is set by another company's domain, such as an ad platform's.
“Cookies are files placed on a user's device to customize a user's browsing experience but can also be used to track a user's activities.”
Why it matters for ad tracking: First-party does not settle the HIPAA question: what matters is whether identifiable health information reaches a company that has not signed a BAA.
Go deeper: Cookieless attribution for healthcare, Is a cookie banner enough for HIPAA?
Related: Cookie banner vs HIPAA authorization, Google Consent Mode, Tracking technology
Session replay
A script that records a visitor's mouse movements, clicks and typing so the visit can be watched back later. Unless fields are masked, recordings can capture what people type into forms.
“Session replay scripts record a user's activities (e.g., mouse movements, clicks, and typing) when using a webpage or app.”
Why it matters for ad tracking: A replay tool that records booking or intake pages can receive PHI, so it needs a BAA and masking of sensitive fields.
Go deeper: What makes session replay HIPAA compliant
Related: Tracking technology, Business associate agreement (BAA)
Fingerprinting
Recognizing a browser or device by its unique mix of settings and configuration, rather than by a cookie, so its activity can be followed across visits.
“Fingerprinting uses a browser's and/or device's unique configurations and settings to track user activity.”
Why it matters for ad tracking: HHS names fingerprinting alongside cookies, pixels and session replay as a tracking technology, so it gets the same review on a health site.
Go deeper: What is a tracking pixel? The healthcare answer
Related: Tracking technology, Cookie (first-party and third-party)
Customer data platform (CDP)
Software that combines data about people from several sources, such as website events, forms and a CRM, into one profile per customer for analysis and marketing.
“Some CDP vendors may be willing to work with regulated entities as their business associates and enter into appropriate business associate agreements.”
Why it matters for ad tracking: A CDP that joins web events to patient records holds PHI, so it needs a BAA, and whatever it forwards to ad platforms needs the same review as a pixel.
Go deeper: HIPAA-compliant CDPs for healthcare marketing
Related: Business associate agreement (BAA), Server-side tracking
Server-side tracking
Sending conversion events from a server to an ad or analytics platform, instead of letting pixels send them straight from the visitor's browser. The sender decides exactly which fields leave.
Why it matters for ad tracking: Server-side delivery lets you remove health details before an event leaves your systems; it does not lift a platform's data restrictions.
Go deeper: Server-side vs client-side tracking for healthcare, Curve Compliance conversion tracking
Related: Conversions API (Meta), Tracking pixel (web beacon), Minimum necessary
Tag manager
A tool such as Google Tag Manager that loads and manages marketing tags from one container, so tags can be added or changed without editing the site's code.
“Google Tag Manager is a tag management system that allows you to set up and manage tags on your site without changing your website's code.”
Why it matters for ad tracking: A tag manager makes it easy to add a pixel to every page, including booking and intake pages, so its container needs the same review as the site itself.
Go deeper: Is Google Tag Manager HIPAA compliant?, Does Google Tag Manager sign a BAA?
Related: Data layer, Tracking pixel (web beacon)
Data layer
A JavaScript object on the page that holds details about the page and visitor actions, such as which form was submitted, for tags to read.
“The data layer is an object used by Google Tag Manager and gtag.js to pass information to tags.”
Why it matters for ad tracking: Any tag can read what is pushed into the data layer, so condition names, form answers and contact details should never go into it.
Go deeper: Healthcare data layer implementation
Ad blocker
A browser extension or setting that stops ads, and often tracking scripts and pixels, from loading.
Why it matters for ad tracking: When a visitor's ad blocker stops a browser pixel, the ad platform never sees that visitor's conversion.
Go deeper: Ad Signal Loss Calculator
Ad platform terms
Conversions API (Meta)
Meta's connection for sending website, app, offline and messaging events from an advertiser's server, website platform, app or CRM to Meta, rather than only through the Meta Pixel in the browser.
“Server events are linked to a dataset ID and are processed like events sent using the Meta Pixel”
Why it matters for ad tracking: Because Meta processes server events like pixel events, the same data rules and restrictions apply; server-side delivery controls what is sent but is not a way around Meta's rules.
Go deeper: Meta Conversions API for healthcare, Curve Compliance and Meta
Related: Server-side tracking, Restricted standard events (Meta), Health and wellness data source category (Meta)
Enhanced conversions (Google Ads)
A Google Ads feature that adds hashed first-party customer data, such as email addresses, to conversion tags or imported conversions to improve measurement.
“The feature uses a secure one-way hashing algorithm called SHA256 on your first party customer data, such as email addresses, before sending to Google.”
Why it matters for ad tracking: Hashing alone does not take an email address out of HIPAA (a hashed email can still be PHI), and Curve Compliance keeps contact identifiers off by default on Meta, Google Ads and TikTok.
Go deeper: Google Ads enhanced conversions without PHI leakage
Related: Offline conversion import, Click ID (gclid, fbclid), De-identification and Safe Harbor
Click ID (gclid, fbclid)
A unique code an ad platform adds to the landing page URL when someone clicks an ad, such as Google's gclid or Meta's fbclid, so a later conversion can be matched to that click.
“After someone clicks your ad, auto-tagging adds a bit of additional information a parameter called GCLID”
“ClickID is a Meta-generated parameter that is passed with the URL of an advertiser's website when a user clicks an ad on Facebook and/or Instagram.”
Why it matters for ad tracking: A click ID carries no health details by itself, but HIPAA's identifier list includes any other unique identifying code, so it should travel only with neutral events.
Go deeper: UTM parameters, click IDs and PHI
Related: UTM parameters, Offline conversion import, The 18 HIPAA identifiers
UTM parameters
Tags such as utm_source, utm_medium and utm_campaign added to a link so analytics tools can tell which campaign sent a visit.
“By adding utm campaign parameters to the destination URLs you use in referral links and ad campaigns, you can view which campaigns refer traffic.”
Why it matters for ad tracking: UTM values are part of the URL that pixels send, so a campaign named after a condition or treatment puts that condition into every event.
Go deeper: UTM parameters, click IDs and PHI
Related: Click ID (gclid, fbclid), Tracking pixel (web beacon)
Offline conversion import
Uploading conversions that happen off the website, such as an attended visit recorded in a CRM or EHR, to an ad platform and matching each one to the original ad click.
“Offline conversion import lets you see what happens in the offline world after someone clicks your ads.”
Why it matters for ad tracking: It lets a clinic count booked or attended visits as ad conversions; the upload should carry the click ID and a neutral conversion name, never the visit reason.
Go deeper: Google Ads offline conversion import for patient appointments
Related: Click ID (gclid, fbclid), Attribution model, Tracking plan and neutral event alias
Health and wellness data source category (Meta)
A category Meta can assign to a website or app connected to its business tools when it relates to medical conditions, patient relationships or health products and services. Categories like this can come with data sharing restrictions.
“Health and wellness: Is associated with medical conditions or specific health statuses, provider/patient relationships, services for accessing personal health information, or health-related products and services”
Why it matters for ad tracking: Once a dataset is in a restricted category, Meta may limit which events and URL details it accepts, which changes what campaigns can optimize on.
Go deeper: Meta data source category review
Related: Restricted standard events (Meta), Conversions API (Meta)
Restricted standard events (Meta)
A data sharing restriction Meta can apply to a website or app in a restricted category. It stops the sharing of specific mid and lower funnel standard events.
“Restriction on certain standard events: Restricts the sharing of specific mid and lower funnel events.”
Why it matters for ad tracking: Meta suggests "leveraging more upper-funnel events" instead; sending a blocked milestone under another name is not a fix.
Go deeper: Meta restricted standard events and full restriction
Related: Health and wellness data source category (Meta), Tracking plan and neutral event alias
Personalized advertising: health (Google)
Google treats health as a sensitive interest category in its personalized advertising policy, which limits the audiences a health advertiser can target. Predefined Google audiences remain available.
“Content related to Health is a sensitive interest category”
“You can't use advertiser-curated audiences.”
Why it matters for ad tracking: The policy limits targeting, not conversion tracking, so a clinic can keep measuring conversions while its audience options narrow.
Go deeper: Google Ads personalized advertising policy for health audiences
Related: Enhanced conversions (Google Ads), Offline conversion import
Meta Ads Data Advisor
Meta's browser extension for Chrome and Edge, formerly called Meta Pixel Helper. It shows which Meta Pixel events a page fires and can set up the pixel, the Conversions API and CRM connections from the browser.
“Configure Meta Pixel, Conversions API, customer relationship management (CRM) integrations, and product catalogs from your browser without writing code.”
Why it matters for ad tracking: Meta says that starting August 3, 2026, new pixel setups through Data Advisor pre-select automatic standard events, so review each automated change on a health site before you approve it.
Go deeper: Is the Meta Pixel HIPAA compliant?
Related: Tracking pixel (web beacon), Conversions API (Meta), Restricted standard events (Meta)
Attribution model
The rule that decides how credit for a conversion is split across the ad clicks and interactions that came before it, such as last click or data-driven.
“Attribution models let you choose how much credit each ad interaction gets for your conversions.”
Why it matters for ad tracking: In healthcare the conversion that counts often happens days later in a booking tool or EHR, so a model only works if that outcome is matched back to the click.
Go deeper: Healthcare marketing attribution models
Related: Offline conversion import, Click ID (gclid, fbclid)
Data clean room
A controlled environment where two parties, such as an advertiser and a media platform, match and analyze their data under agreed rules and see only aggregated results.
Why it matters for ad tracking: A clean room changes who sees the results, not whether HIPAA applies to the data that goes in.
Go deeper: Data clean rooms in healthcare marketing
Related: De-identification and Safe Harbor, Customer data platform (CDP)
Consent and state law
Cookie banner vs HIPAA authorization
A cookie banner records a visitor's choice about cookies and tracking. A HIPAA authorization is a signed, specific permission to use PHI. One does not stand in for the other.
“Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.”
Why it matters for ad tracking: A visitor clicking accept does not make it permissible to send PHI to an ad platform.
Go deeper: Cookie consent banners vs HIPAA authorization, Is a cookie banner enough for HIPAA?
Related: Authorization (HIPAA), Google Consent Mode, Cookie (first-party and third-party)
Google Consent Mode
Google's way for a site to pass each visitor's cookie consent choice to Google tags, which then adjust what they store and send. It works with a consent banner but does not provide one.
“Consent mode lets you communicate your users' cookie or app identifier consent status to Google.”
“Consent mode doesn't provide a consent banner or widget.”
Why it matters for ad tracking: Consent mode passes a cookie choice, not a HIPAA authorization, so it does not decide whether PHI may be sent to Google.
Go deeper: Google Consent Mode v2 for healthcare, Consent mode and HIPAA: where they do not overlap
Related: Cookie banner vs HIPAA authorization, Cookie (first-party and third-party)
Consumer health data (Washington)
The term Washington's My Health My Data Act uses for personal information linked or reasonably linkable to a consumer that identifies their physical or mental health status. It reaches many businesses that HIPAA does not cover.
“personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status”
Why it matters for ad tracking: The definition includes "Data that identifies a consumer seeking health care services", so ad tracking on a health site can fall under it even where HIPAA does not apply.
Go deeper: Washington My Health My Data Act for healthcare marketing
Related: FTC Health Breach Notification Rule, Covered entity
FTC Health Breach Notification Rule
An FTC rule that requires vendors of personal health records and related entities to notify consumers after a breach of unsecured health information. It does not apply to HIPAA-covered entities or their business associates acting as such.
“A breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure.”
Why it matters for ad tracking: Under this rule a breach includes an unauthorized disclosure, not only a hack, so sharing health data with an ad platform without permission can trigger notice duties for a vendor of personal health records.
Go deeper: The FTC Health Breach Notification Rule beyond HIPAA
Related: Consumer health data (Washington), Breach and breach notification
42 CFR Part 2
Federal rules that restrict the use and disclosure of substance use disorder patient records held by federally assisted treatment programs, with their own consent requirements on top of HIPAA.
“the regulations in this part impose restrictions upon the use and disclosure of substance use disorder patient records”
Why it matters for ad tracking: On an addiction treatment site, data showing that someone sought treatment needs extra care, because Part 2 adds its own consent rules.
Go deeper: Facebook ads for addiction treatment and 42 CFR Part 2, 42 CFR Part 2 and behavioral health marketing
Related: Authorization (HIPAA), Protected health information (PHI)
Curve workflow terms
Tracking plan and neutral event alias
A tracking plan lists the conversions a business sends to its ad platforms, the names they go under and what must never be sent. A neutral event alias, such as event_1, replaces a descriptive event name for every ad platform.
Why it matters for ad tracking: An event named after a service or condition tells the ad platform what someone booked; event_1 does not.
Go deeper: HIPAA-safe tracking plans, Example: telehealth, med spa, dental, mental health, primary or specialty care, physical therapy or orthopedics, plastic surgery, addiction treatment
Related: Restricted standard events (Meta), Data layer, Offline conversion import
How Curve Compliance helps
- Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn.
- Each platform receives a fixed list of fields, events can use neutral names such as event_1, and contact identifiers are off by default on Meta, Google Ads and TikTok.
- Curve Compliance detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
- Curve Compliance signs a BAA on every plan, and its team does the setup for you, typically live in about a week.
- The free website scan lists the pixels and trackers on any page of your site.
Book a call with Curve Compliance and its team will walk through what your website sends today.
Sources and notes
HHS's tracking bulletin opens with a note that on June 20, 2024, the U.S. District Court for the Northern District of Texas vacated part of it in American Hospital Association v. Becerra: the part saying HIPAA obligations are triggered when an online technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. The definitions quoted here come from the bulletin as HHS publishes it today. See the bulletin and Curve Compliance's annotated guide.
Each definition explains a term in plain English and is not legal advice. Talk to your counsel about how a rule applies to your own organization.
Every quote was checked against its source on .
Track ad conversions under a BAA
Curve Compliance replaces browser ad pixels with server-side delivery, sends each platform a fixed list of fields, and checks every event for PHI-like patterns.
- BAA signed on every plan
- Set up by Curve Compliance's team
- Typically live in about a week