HIPAA Marketing Authorization and Ad Tracking Explained

Ad tracking needs a HIPAA marketing authorization when a covered entity's website or app would disclose protected health information (PHI) to an ad platform or other tracking vendor for marketing. HHS says those disclosures, made "without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures" (HHS), and 45 CFR 164.508(a)(3) requires an authorization "for any use or disclosure of protected health information for marketing," with two narrow exceptions (eCFR). A valid authorization is a signed form, so the practical route is to keep PHI out of what ad platforms receive. Curve Compliance is built for that setup: it signs a BAA on every plan and strips PHI before data reaches an ad platform.

Book a call. Curve Compliance sends conversions to your ad platforms server-side, and Curve's team does the setup. Book a call with Curve.

What HIPAA counts as marketing

The definition is in 45 CFR 164.501: "marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service" (eCFR). The same section carves out these communications:

• Refill reminders. Communications "To provide refill reminders" about a drug currently prescribed for the person, within a limit on third-party payment (eCFR).
• Treatment and care coordination. Communications "For treatment of an individual by a health care provider," including care coordination and recommending other treatments or providers (eCFR).
• Your own services. Communications that describe a health-related product or service "that is provided by, or included in a plan of benefits of, the covered entity making the communication" (eCFR).

The treatment and own-services carve-outs fall away "where the covered entity receives financial remuneration in exchange for making the communication" from a third party (eCFR). A clinic's ad about its own services can sit inside a carve-out, but that settles what the ad says, not where the data goes. Ad tracking turns on whether PHI reaches a company with no business associate agreement (BAA). For the wider rules, see HIPAA-compliant marketing.

When HIPAA requires a marketing authorization

Section 164.508(a)(3) names two exceptions: "A face-to-face communication made by a covered entity to an individual" and "A promotional gift of nominal value provided by the covered entity." If the marketing involves financial remuneration from a third party, "the authorization must state that such remuneration is involved" (eCFR). HHS's marketing guidance sums it up: "With limited exceptions, the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing" (HHS).

HIPAA authorization form: the required elements

A HIPAA authorization form must contain six core elements and three required statements, in plain language, with a signed copy for the individual (45 CFR 164.508(c)). These are minimums: a valid form "must contain at least the following" (eCFR).

Requirement	What 45 CFR 164.508 says
What is shared	"A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion" (eCFR)
Who discloses	Identification of those "authorized to make the requested use or disclosure" (eCFR)
Who receives it	Identification of those "to whom the covered entity may make the requested use or disclosure" (eCFR)
Why	"A description of each purpose of the requested use or disclosure." (eCFR)
Until when	"An expiration date or an expiration event" (eCFR)
Signature	"Signature of the individual and date." (eCFR)
Revoking	"The individual's right to revoke the authorization in writing" (eCFR)
No conditions on care	Whether treatment, payment, enrollment or eligibility can be conditioned on signing; generally they may not be (eCFR)
Redisclosure	A statement that the information may be "subject to redisclosure by the recipient and no longer be protected by this subpart" (eCFR)
Form and copy	"written in plain language," with "a copy of the signed authorization" for the individual (eCFR)

A pixel fires as the page loads, before anyone could sign a form like this, so an authorization is hard to use as the basis for ad tracking.

Business associate or marketing disclosure?

A business associate "creates, receives, maintains, or transmits protected health information" on a covered entity's behalf for a regulated function, such as data analysis (eCFR). HHS's tracking bulletin says tracking technology vendors "are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function," such as health care operations, and that you must then "enter into a business associate agreement (BAA) with these tracking technology vendors" (HHS). See what a business associate agreement is.

If the vendor is not your business associate, HHS requires authorizations first (see the table below). A vendor's promise to clean the data later does not help: "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS).

A BAA is not a marketing permission either. A business associate "may not use or disclose protected health information in a manner that would violate the requirements of this subpart, if done by the covered entity," apart from narrow exceptions for its own management and data aggregation (eCFR 164.502; eCFR 164.504). So a vendor under a BAA cannot pass PHI on for marketing that would need an authorization if you did it yourself.

Where common tracking setups land

Each row quotes HHS's tracking bulletin. For what counts as PHI on a page, see what counts as PHI on a website.

Setup	What HHS says
Pixel on a booking page or symptom checker that captures an email or reason for the visit	"the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply" (HHS)
Pixel on a patient portal or other logged-in page	"Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI." (HHS)
PHI sent to a vendor that is not your business associate	"the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor" (HHS)
Disclosure listed in your privacy policy	"the Privacy Rule does not permit disclosures of PHI to a tracking technology vendor based solely on" a privacy policy, notice or terms (HHS)
A vendor under a BAA that passes on only de-identified data	An option: a BAA with a vendor that will de-identify the data and "then subsequently disclose only de-identified information to tracking technology vendors that are unwilling to enter into a BAA" (HHS)

What changed after AHA v. Becerra

HHS's notice on the bulletin says a federal court in Texas, on June 20, 2024, vacated it "to the extent it provides that HIPAA obligations are triggered" when a tracking tool connects an IP address with a visit to an unauthenticated page about specific health conditions or providers, and that "HHS is evaluating its next steps in light of that order" (HHS). The court wrote that the vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance" in the bulletin (opinion), and HHS's appeal was dismissed on September 4, 2024 (docket). The authorization and BAA passages quoted here remain on the page. See the bulletin annotated after AHA v. Becerra.

Meta, Google and the missing BAA

The authorization question comes up because Meta and Google do not sign a BAA for these tools. Meta's Business Tools Terms, which name the Meta Pixel and the Conversions API, say you will not share data that "includes or is based on, directly or otherwise, health information," and that event and audience names "must not reflect, imply or be based on any category of information described in this Section 1.h" (Meta). Google says it "does not offer Business Associate Agreements in connection with" Google Analytics (Google). Curve's BAA Directory lists Meta and Google Ads as not signing one; see which ad platforms sign a BAA.

A patient authorization answers HIPAA, not Meta, whose terms bar health information either way, for the Conversions API as much as the pixel.

A setup that keeps PHI out of ad platforms

HHS describes another route. When a tracking vendor will not sign a BAA, "the regulated entity can choose to establish a BAA with another vendor," and its example is a customer data platform (HHS; see HIPAA-compliant CDPs). In practice:

• Find what fires today. Curve's free website scan lists the pixels and trackers on a page.
• Take browser pixels off PHI pages. Booking, intake and portal pages first; see removing the Meta pixel.
• Put a vendor under a BAA in the middle. One that strips PHI before data reaches an ad platform; see server-side tracking tools.
• Send only what each platform needs. Neutral event names and a fixed field list; see the minimum necessary rule.
• Write it down. Record which pages and events touch PHI, and talk to your counsel about any use that would still need an authorization.

How Curve Compliance helps

Curve Compliance signs a BAA on every plan, replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to each platform and what the platform accepted.

Curve is SOC 2 Type II, and Curve's team does the setup. For the pixel question in detail, see HIPAA-compliant Meta pixel alternatives.

Sources, checked October 26, 2026: 45 CFR 164.501; 45 CFR 164.508; 45 CFR 160.103; 45 CFR 164.502; 45 CFR 164.504; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; HHS, Marketing; Meta Business Tools Terms; Google, HIPAA and Google Analytics; AHA v. Becerra opinion; AHA v. Becerra docket.

Frequently Asked Questions

When does ad tracking need a HIPAA marketing authorization?

When a covered entity's site or app would disclose PHI to an ad platform for marketing, HIPAA requires the patient's written authorization first (eCFR). HHS says the same for PHI sent to any vendor that is not your business associate (HHS).

What counts as marketing under HIPAA?

A communication that encourages people to buy or use a product or service. Refill reminders, treatment messages and communications about your own health services are carved out, with limits when a third party pays (45 CFR 164.501).

Do I need patient authorization to use the Meta pixel?

Under HIPAA, only if the pixel would disclose PHI, which HHS says tracking on a booking page or patient portal can do (HHS). Meta does not sign a BAA (Directory entry) and its terms bar health information (Meta), so use a vendor under a BAA that removes PHI first.

Is an ad tracking vendor a business associate?

It is if it handles PHI on your behalf for a covered function, and HHS says that is so "regardless of whether the required BAA is in place" (HHS; eCFR). If the vendor is not your business associate, HHS requires authorizations before PHI goes to it.

Is a cookie banner a HIPAA authorization?

No. HHS says banners that ask users to accept or reject tracking technologies "do not constitute a valid HIPAA authorization" (HHS). See consent management vs HIPAA authorization and why the two are not the same. Curve offers consent management under the same BAA as its ad tracking.

Does a BAA replace a marketing authorization?

No. A business associate may not use or disclose PHI in a way that would violate the Privacy Rule if you did it yourself (eCFR), so marketing that needs an authorization still needs one.

What are the three required statements on a HIPAA authorization?

The right to revoke it in writing, whether care or benefits can be conditioned on signing, and that disclosed information may be redisclosed and "no longer be protected by this subpart" (45 CFR 164.508(c)(2)).

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. See what your site sends to ad platforms today and how Curve Compliance removes PHI before anything is sent to an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.