HIPAA Network Map for Marketing Tools: Security Rule 2027

A HIPAA network map, as HHS's proposed Security Rule describes it, is a map of how electronic protected health information (ePHI) moves through, into and out of a regulated entity's systems, kept with a written inventory of every technology asset that may affect ePHI, and HHS's agenda targets a final rule for July 2027 (Federal Register; reginfo.gov). For marketing, the map starts with every tag, form, scheduler and vendor that can touch patient data. Curve Compliance helps with that part: it signs a BAA on every plan, strips PHI before data reaches an ad platform, and its Event Logs show what was sent to each ad platform and what the platform accepted.

Book a call. Want help listing the tags, forms and vendors that belong on your map? Curve Compliance's team reviews what your site sends to Meta, Google and TikTok with you. Book a call with Curve.

What the proposed rule requires

HHS proposes, "In place of the existing standard for security management process," a new standard at 45 CFR 164.308(a)(1) called "Technology asset inventory" (Federal Register). As proposed, it has four parts:

Part	Proposed text, 45 CFR 164.308(a)(1)
General	"Conduct and maintain an accurate and thorough written inventory and a network map of the covered entity's or business associate's electronic information systems and all technology assets that may affect the confidentiality, integrity, or availability of electronic protected health information." (NPRM)
Inventory	A written inventory "that contains the identification, version, person accountable, and location of each technology asset" (NPRM)
Network map	A map "that illustrates the movement of electronic protected health information throughout the covered entity's or business associate's electronic information systems, including but not limited to how electronic protected health information enters and exits such information systems, and is accessed from outside of such information systems" (NPRM)
Maintenance	Review and update both "On an ongoing basis, but at least once every 12 months," and after changes "including but not limited to the adoption of new technology assets" (NPRM)

Two proposed definitions set the scope. A technology asset means "the components of an electronic information system, including but not limited to hardware, software, electronic media, information, and data." A relevant electronic information system is one "that creates, receives, maintains, or transmits electronic protected health information or that otherwise affects the confidentiality, integrity, or availability of electronic protected health information" (NPRM).

Where marketing tools fit

The proposed rule's text does not mention tracking pixels, cookies or advertising. HHS's tracking guidance covers that ground. It says websites "commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts," and lists "Addressing the use of tracking technologies in the regulated entity's Risk Analysis and Risk Management processes" among the requirements regulated entities "must meet when using tracking technologies with access to PHI". It adds that "OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies" (HHS).

Which pages matter most? HHS says "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI." Booking pages without a login "may have access to PHI in certain circumstances"; HHS's example is a tag that collects "an individual's email address, or reason for seeking health care typed or selected by an individual" when someone makes an appointment (HHS). The same page notes that a federal court vacated part of the guidance on June 20, 2024, the part about visits to unauthenticated pages on specific conditions or providers tied to an IP address; see the bulletin annotated after AHA v. Becerra. To see which tags a page loads, use this tracker check.

Vendors count too. Assets a business associate uses to handle your ePHI "would be required to be included in the network map of the covered entity," and also in the business associate's own inventory and map (NPRM). A marketing vendor that receives ePHI without a BAA is the gap a good map surfaces; see when marketing vendors need a BAA.

A sample network map for a clinic's marketing stack

This is an illustration, not an HHS template. List one row for each system that can create, receive, maintain or transmit ePHI, then draw the arrows between them.

System	What can carry ePHI	Where it can go	BAA to check
Website pages with ad pixels	Booking clicks, form fields, emails or conditions in URLs	Meta, Google and TikTok through browser tags	Meta and Google Ads do not sign one (Meta, Google Ads)
Intake and lead forms	Names, contact details, answers	Form host, CRM, notification emails	The form host's BAA
Online scheduler	Appointment type, contact details	Scheduler, calendar, reminder texts	The scheduler's BAA
Call tracking	Caller numbers, recordings	Call tracking vendor, conversion uploads	The call tracking vendor's BAA
CRM and email or SMS tools	Lead records, notes, message history	Email and SMS senders, ad uploads	Each tool's BAA
Session replay and heatmaps	What visitors type and click	Replay vendor	The replay vendor's BAA
Server-side conversion layer	Events from pages, forms and bookings	Ad platforms, after PHI is stripped	The layer's BAA (Curve signs one on every plan)

Check each vendor in the BAA Directory and see which ad platforms sign a BAA.

What to keep as evidence

• An inventory row per tag and vendor. With the four proposed fields: identification, version, person accountable and location (NPRM).
• Signed BAAs. The proposal would also require covered entities to "Obtain written verification from the business associate at least once every 12 months" that it has deployed the required technical safeguards (NPRM). See why a BAA may not be enough.
• A scan of what each page loads. Curve's free website scan lists the pixels and trackers on a page.
• A record of what each ad platform received. Curve's Event Logs show what Curve sent to each platform and what the platform accepted.
• A dated change log. The proposal ties updates to changes such as new technology assets, so note the date whenever a tag, vendor or page changes.

Status and dates

HHS published the proposal on January 6, 2025 as a "Proposed Rule" at 90 FR 898, with comments due "on or before March 7, 2025" (Federal Register). HHS's Unified Agenda lists "Final Action 07/00/2027" under "Long-Term Actions" (reginfo.gov). In the proposal, "The effective date of a final rule would be 60 days after publication," and HHS "proposes to apply the standard compliance date of 180 days after the effective date of a final rule" (Federal Register). See where the new HIPAA rules stand.

Today's rule already requires a risk analysis: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate" (45 CFR 164.308). For the other proposed changes, see the martech security checklist; for every dated rule in 2027, see the 2027 compliance calendar.

How Curve Compliance helps

Curve Compliance keeps the ad tracking part of your map simple. It replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn through one vendor that signs a BAA on every plan. Each platform receives only a fixed list of fields, Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and contact identifiers are off by default on Meta, Google Ads and TikTok. Event Logs show what Curve sent to each platform and what the platform accepted.

List Curve on your map like any business associate. Curve Forms hosts intake and lead forms, and session replay and heatmaps run under the same BAA, so more of the marketing stack sits with one vendor. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For how the final rule will apply to you, talk to your counsel.

Sources, checked October 26, 2026: HHS, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 90 FR 898; Unified Agenda, RIN 0945-AA22; 45 CFR 164.308; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; BAA Directory entries for Meta and Google Ads.

Frequently Asked Questions

What is a HIPAA network map?

Under HHS's proposed Security Rule, it is a map that "illustrates the movement of electronic protected health information" through a regulated entity's systems, including how ePHI enters and exits them (Federal Register). It is a proposal, and HHS's agenda targets a final rule for July 2027 (reginfo.gov).

Does the HIPAA network map include marketing tools?

The proposal does not name marketing tools, but it covers "all technology assets that may affect the confidentiality, integrity, or availability of" ePHI (Federal Register). HHS tells regulated entities to address tracking technologies with access to PHI in their risk analysis (HHS), so pixels, forms, schedulers and call tracking that receive ePHI fit.

When will the new HIPAA Security Rule be final?

HHS's Unified Agenda lists "Final Action 07/00/2027" (reginfo.gov). As proposed, a final rule would take effect 60 days after publication, and entities would have up to 180 days from that date to comply (Federal Register; status).

Do business associates' systems go on my network map?

Yes, under the proposal. Assets a business associate uses to handle your ePHI "would be required to be included in the network map of the covered entity" (Federal Register).

Is a tracking pixel a technology asset under HIPAA?

The proposal does not mention pixels. It defines a technology asset as "the components of an electronic information system, including but not limited to hardware, software, electronic media, information, and data" (Federal Register), and HHS lists "tracking pixels" as a tracking technology and says tracking technologies with access to PHI belong in a regulated entity's risk analysis (HHS), so treat a pixel that can receive ePHI as in scope.

How often would the network map need updating?

"On an ongoing basis, but at least once every 12 months," and after changes such as "the adoption of new technology assets" (Federal Register).

Does Curve Compliance sign a BAA?

Yes, on every plan. Curve strips PHI before data reaches an ad platform, and its Event Logs show what Curve sent to each platform and what the platform accepted.

Talk to Curve Compliance

Book a call. Get the marketing side of your network map in order before the final rule. Curve Compliance signs a BAA on every plan and strips PHI before data reaches an ad platform, and Curve's team does the setup, typically live in about a week. Book a call with Curve.