HIPAA Minimum Necessary Rule: What It Means for Ad Tracking

The HIPAA minimum necessary rule requires covered entities and business associates to make reasonable efforts to limit protected health information to the minimum necessary for the purpose of each use, disclosure or request (45 CFR 164.502(b); HHS). For ad tracking, HHS applies it directly: every disclosure of PHI to a tracking vendor must be specifically permitted, and unless an exception applies, only the minimum necessary PHI may go (HHS). So each vendor should get a short, fixed list of fields, and an ad platform with no BAA and no patient authorization should get no PHI at all. Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, sends each ad platform only a fixed list of fields and strips PHI before data reaches an ad platform.

Book a call. Want a field-by-field answer for your own tags? Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Book a call with Curve.

What the rule says

The standard is one sentence: a covered entity or business associate "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (45 CFR 164.502(b)). HHS calls it "a key protection of the HIPAA Privacy Rule" and says it is "designed to be sufficiently flexible to accommodate the various circumstances of any covered entity" (HHS). The details are in 45 CFR 164.514(d):

• Uses inside your organization. You must identify "Those persons or classes of persons, as appropriate, in its workforce who need access to protected health information to carry out their duties," and the categories of PHI each one needs (164.514(d)(2)). For a marketing team, that means deciding who sees lead and booking details.
• Routine and recurring disclosures. You need "policies and procedures (which may be standard protocols) that limit the protected health information disclosed to the amount reasonably necessary to achieve the purpose of the disclosure" (164.514(d)(3)(i)). HHS adds: "Individual review of each disclosure or request is not required" (HHS).
• Everything else. For other disclosures you must set criteria and "Review requests for disclosure on an individual basis in accordance with such criteria" (164.514(d)(3)(ii)).
• Never the whole record by default. A covered entity "may not use, disclose or request an entire medical record" unless it is "specifically justified" as reasonably necessary (164.514(d)(5)).

When a tag or feed sends PHI, it sends the same fields on every page view or booking, which is what a routine and recurring disclosure looks like. So the rule calls for a standard protocol that fixes what each tag or feed sends.

Where it does not apply

Situation	Minimum necessary?	Rule
"Disclosures to or requests by a health care provider for treatment"	Does not apply	164.502(b)(2)(i)
Uses or disclosures made to the individual	Does not apply	164.502(b)(2)(ii)
"Uses or disclosures made pursuant to an authorization"	Does not apply; the authorization sets the scope	164.502(b)(2)(iii); 164.508(c)
Disclosures to HHS for enforcement	Does not apply	164.502(b)(2)(iv)
"Uses or disclosures that are required by law"	Does not apply	164.502(b)(2)(v)
"Uses or disclosures that are required for compliance with applicable requirements of this subchapter"	Does not apply	164.502(b)(2)(vi)
A tracking or analytics vendor under a BAA	Applies	HHS bulletin; 164.502(b)(1)
Staff access to lead and booking data	Applies, by role	164.514(d)(2)

Treatment is rarely the purpose of an ad tag, so the exception that matters to marketers is authorization. When a patient signs a valid HIPAA authorization, the minimum necessary standard does not apply to disclosures under it (164.502(b)). The authorization itself must contain "A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion" (164.508(c)), so its own terms set the limit. Marketing usually needs one. HHS says "With limited exceptions, the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing" (HHS). See when ad tracking needs a HIPAA authorization.

How it applies to tracking vendors

HHS lists it among the duties of any covered entity or business associate using tracking tools: "Ensuring that all disclosures of PHI to tracking technology vendors are specifically permitted by the Privacy Rule and that, unless an exception applies, only the minimum necessary PHI to achieve the intended purpose is disclosed" (HHS). That is two gates, in order.

• Gate 1: is the disclosure allowed at all? HHS says regulated entities "must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." Without that, "the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor" (HHS). See which ad platforms sign a BAA.
• Gate 2: is it the minimum? Once a disclosure is allowed, send only the fields its purpose needs. Measuring which ad drove a booking needs far less than the booking itself.
• Filtering after the fact does not count. HHS says "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS). The limit applies to what you send.
• HHS's route for vendors without a BAA. A regulated entity can sign a BAA with another vendor, such as a customer data platform, that agrees "to de-identify online tracking information that includes PHI and then subsequently disclose only de-identified information to tracking technology vendors that are unwilling to enter into a BAA with a regulated entity" (HHS). See HIPAA-compliant CDPs.

A field-by-field check for Meta, Google and CRM uploads

Gate 1 comes first: a platform with no BAA and no patient authorization should get no PHI at all, so for those platforms these questions are about keeping each flow free of PHI (HHS). Where a flow does carry PHI under a BAA, compare what the platform asks for with what your purpose needs. The first three rows quote each platform's own pages.

Data flow	What the platform asks for	Minimum necessary questions
Meta Conversions API, website events	Meta marks event_name, event_time, user_data and action_source as required, and says event_source_url "is required for website events shared using the Conversions API" (Meta).	Is the event name neutral? Meta's terms say event names "must not reflect, imply or be based on" health information (Meta). Is the URL free of query strings and patient details? Does user_data carry more than the purpose needs?
Google Ads website conversions	Google says the GCLID is "required for Google Ads website conversion tracking" (Google).	Is the page URL that fires the tag clean? Does the conversion name describe a service or condition?
Google Ads offline conversions	You give "that GCLID back to Google Ads along with a few details about the type of conversion it was and when it happened" (Google).	Can the conversion type be a neutral name? Does anything else from the CRM or EHR ride along?
Customer list uploads	A list of people for the platform to match.	A list of patients tells the platform who your patients are. Does the purpose need a list at all? See Customer Match for clinics.
Analytics and session tools	Page views, events and page URLs.	Does the tool need form contents, site search terms or full URLs? Is the vendor under a BAA?

Write the answer for each flow into your standard protocol, keep it "in written or electronic form" (45 CFR 164.530(j)), and review it whenever you add a tag, a field or a platform. URLs need their own pass; see are UTM parameters PHI, and for which data can identify a patient, the 18 HIPAA identifiers. How the rule applies to your flows depends on your facts, so talk to your counsel.

How Curve Compliance helps

The minimum necessary rule asks for a fixed list of what each vendor gets. That is how Curve Compliance sends conversions. It replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and events can use neutral names. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform.

Event Logs show what Curve sent to each platform and what the platform accepted, so you can see each flow for yourself. Offline conversion uploads from a CRM or EHR are credited to the original ad click. Curve collects this data under the BAA it signs on every plan (BAA Directory entry), Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.502; 45 CFR 164.508; 45 CFR 164.514; 45 CFR 164.530; HHS, minimum necessary requirement; HHS, marketing; HHS, guidance on de-identification; HHS, online tracking technologies bulletin; Meta, server event parameters; Meta Business Tools Terms; Google Ads, about offline conversion imports; Google Ads, GCLID definition.

Frequently Asked Questions

What is the HIPAA minimum necessary rule?

It requires covered entities and business associates to make reasonable efforts to limit PHI to the minimum necessary to accomplish the purpose of each use, disclosure or request (45 CFR 164.502(b)). HHS applies it to tracking: any PHI disclosed to a tracking vendor must be permitted and limited to the minimum necessary (HHS).

Does minimum necessary apply to marketing?

It applies to any permitted use or disclosure that is not exempt (164.502(b)). Most marketing disclosures of PHI first need a written authorization (HHS), and disclosures under an authorization are exempt, with the authorization's own description setting the scope (164.508(c)).

Does an authorization remove the limit?

It removes the minimum necessary standard for disclosures made under it (164.502(b)(2)(iii)), but not the limits of the authorization itself, which must describe the information "in a specific and meaningful fashion" (164.508(c)). See HIPAA authorizations for ad tracking.

Is a hashed email the minimum necessary?

Hashing does not take an email off HIPAA's identifier list: HHS treats a code "derived from a secure hash function without a secret key" as an identifying element (HHS). Whether sending it is the minimum depends on whether the purpose needs it at all. See is a hashed email PHI.

How do I document it?

Write policies and procedures, which may be standard protocols for routine disclosures (164.514(d)(3)), keep them in written or electronic form, and retain them for six years from creation or from when they were last in effect, whichever is later (164.530(j)).

Does minimum necessary apply to business associates?

Yes. The standard says "a covered entity or business associate must make reasonable efforts" to limit PHI to the minimum necessary (45 CFR 164.502(b)).

Can I send everything and let the vendor filter it?

No. HHS says it is "insufficient for a tracking technology vendor to agree to remove PHI from the information it receives" (HHS). Limit what you send.

Talk to Curve Compliance

Book a call. Curve Compliance sends each ad platform only a fixed list of fields, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.