--- title: "Illinois Consumer Health Data Protection Act: Marketing Compliance for IL Healthcare" description: "In 2023, Illinois-headquartered Advocate Aurora Health agreed to pay $12.225 million to settle a consolidated class action over its use of Meta Pixel and…" url: "https://www.curvecompliance.com/illinois-consumer-health-data-protection-act-healthcare-marketing" site: "Curve Compliance" content_type: "text/markdown" --- [Guide](https://www.curvecompliance.com/blog?via=md) # Illinois Consumer Health Data Protection Act: Marketing Compliance for IL Healthcare In 2023, Illinois-headquartered Advocate Aurora Health agreed to pay $12.225 million to settle a consolidated class action over its use of Meta Pixel and Google Analytics on its websites, LiveWell... May 19, 2026 13 min read On this page Illinois has not yet enacted a consumer health data law: the Protect Health Data Privacy Act (HB 3494) has been reintroduced in Springfield and would add consent requirements, a private right of action and a ban on geofencing around health-care providers. Illinois marketers already face HIPAA, FTC enforcement and pixel claims under BIPA and the Illinois Eavesdropping Statute. [Curve Compliance](https://www.curvecompliance.com/?via=md) replaces browser pixels with one script, sends conversions server-side with only a fixed list of fields, and its Event Logs show what was sent and what each platform accepted. In 2023, Illinois-headquartered Advocate Aurora Health agreed to pay **$12.225 million** to settle a consolidated class action over its use of Meta Pixel and Google Analytics on its websites, LiveWell app, and MyChart patient portal, after disclosing a breach that may have affected up to 3 million patients.[\[1\]](https://www.hipaajournal.com/advocate-aurora-health-settles-pixel-lawsuit-for-12-25-million/) Two years later, Southern Illinois Healthcare entered another tracking-pixel settlement covering roughly 79,215 patients.[\[2\]](https://www.hipaajournal.com/southern-illinois-healthcare-enterprises-pixel-settlement/) The Illinois consumer health data act being debated in Springfield (the Protect Health Data Privacy Act, HB 3494) would add a private right of action of **$1,000 to $5,000 per violation** on top of these federal exposures.[\[3\]](https://www.billtrack50.com/billdetail/1824669) This guide explains the current enforcement landscape, what IL healthcare marketing teams must do now, and how to build defensible tracking infrastructure before enforcement reaches your door. **Book a call.** Running ads for an Illinois practice or health system and not sure what your scheduling and portal pages send to Meta or Google? [Book a call with Curve](https://www.curvecompliance.com/book?via=md). ## The Current Enforcement Landscape Under the Illinois Consumer Health Data Act ### OCR Enforcement Trends HHS adjusted HIPAA civil monetary penalties effective January 28, 2026, multiplying prior amounts by 1.02598 and lifting the calendar-year cap for identical-provision violations to **$2,190,294**.[\[4\]](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) Under the four-tier structure, Tier 1 (lack of knowledge) penalties start at $145 per violation and Tier 4 (willful neglect, not corrected within 30 days) penalties reach $2,190,294 per violation, with each tier subject to the $2,190,294 annual cap before OCR's enforcement-discretion reductions are applied.[\[4\]](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) OCR's [March 18, 2024 tracking-technologies bulletin](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) reiterated that regulated entities must have a signed Business Associate Agreement with any tracking vendor, or patients' HIPAA authorizations, before disclosing PHI, and that cookie banners do not constitute valid HIPAA authorizations.[\[5\]](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) Although a Northern District of Texas ruling in _American Hospital Association v. Becerra_ on June 20, 2024 vacated portions of the guidance addressing IP addresses on unauthenticated pages, OCR's underlying enforcement posture remains intact, and the agency has stated it is prioritizing Security Rule compliance in tracking-technology investigations.[\[5\]](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) ### FTC Involvement The Federal Trade Commission has built a parallel enforcement track for non-HIPAA entities and even for HIPAA-adjacent advertising practices. Notable actions include: - **GoodRx (February 2023):** [A $1.5 million civil penalty](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) for failing to report unauthorized disclosures of consumer health data to Facebook, Google, and Criteo, the first enforcement under the Health Breach Notification Rule.[\[6\]](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) - **BetterHelp (March 2023):** $7.8 million in consumer refunds for sharing mental-health intake information with Facebook, Snapchat, Criteo, and Pinterest.[\[6\]](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) - **Premom:** A $200,000 settlement with developer Easy Healthcare over disclosures to AppsFlyer and Google.[\[7\]](https://www.fiercehealthcare.com/health-tech/ftc-finalizes-changes-data-privacy-rule-step-scrutiny-digital-health-apps) In July 2023, the FTC and HHS jointly warned approximately 130 hospital systems and telehealth providers that the unauthorized disclosure of health information through tracking tools may violate the FTC Act and the Health Breach Notification Rule.[\[8\]](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-hhs-warn-hospital-systems-telehealth-providers-about-privacy-security-risks-online-tracking) ### Class-Action Lawsuit Explosion The Advocate Aurora settlement is one of dozens of class actions filed against healthcare entities over pixel disclosures. The plaintiffs alleged that pixel technology installed on Advocate Aurora's website and patient portal allowed tech companies to collect users' information including dates and times of appointments and procedures, physician identity, communications through the patient portal, and health insurance information of more than 2.5 million people.[\[9\]](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) The U.S. District Court for the Eastern District of Wisconsin granted final approval of the settlement on July 10, 2024.[\[9\]](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) In Illinois state court, _Doe v. Southern Illinois Healthcare Enterprises_ alleged that tracking pixels on the MyChart portal and Health Risk Assessment pages disclosed patient information in violation of Illinois privacy laws, including the Illinois Eavesdropping Statute and the Illinois Consumer Fraud and Deceptive Business Practices Act.[\[2\]](https://www.hipaajournal.com/southern-illinois-healthcare-enterprises-pixel-settlement/) ### State-Level Actions Although Illinois has not yet enacted a comprehensive consumer health data law, the Protect Health Data Privacy Act (most recently reintroduced as HB 3494) would create a private right of action with damages of $1,000 to $5,000 per violation, authorize Illinois Attorney General enforcement under the Consumer Fraud and Deceptive Business Practices Act, and prohibit geofencing around health-care providers.[\[3\]](https://www.billtrack50.com/billdetail/1824669) Even without the bill's passage, Illinois plaintiffs are already invoking the Biometric Information Privacy Act (BIPA), the Illinois Eavesdropping Statute, and consumer-fraud statutes in tracking-pixel cases. Illinois is part of a national wave: Washington's My Health My Data Act, Minnesota, Indiana, and Tennessee have all moved on this front. Compare what is happening here with our breakdowns of [Washington's My Health My Data Act](https://www.curvecompliance.com/washington-my-health-my-data-act-healthcare-marketing-compliance?via=md), the [Minnesota Consumer Data Privacy Act](https://www.curvecompliance.com/minnesota-consumer-data-privacy-act-healthcare-marketing?via=md), and the [Indiana Consumer Data Protection Act](https://www.curvecompliance.com/indiana-consumer-data-protection-act-healthcare-marketing?via=md). ## Specific Risks and Consequences ### Financial Penalties Stacked exposure under federal, state, and private-action regimes: - **OCR Tier 1 (lack of knowledge):** $145 to $73,011 per violation, with a statutory calendar-year cap of $2,190,294.[\[4\]](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) - **OCR Tier 2 (reasonable cause):** $1,461 to $73,011 per violation ([Federal Register, January 28, 2026](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment)), same annual cap. - **OCR Tier 3 (willful neglect, corrected):** $14,602 to $73,011 per violation ([Federal Register, January 28, 2026](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment)), same annual cap. - **OCR Tier 4 (willful neglect, uncorrected):** $73,011 to $2,190,294 per violation, same annual cap.[\[4\]](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) - **State Attorneys General (under HIPAA enforcement authority):** Up to $100 per violation, capped at $25,000 per calendar year per identical provision, plus attorneys' fees. - **Illinois proposed Protect Health Data Privacy Act:** $1,000 to $5,000 per violation under a private right of action.[\[3\]](https://www.billtrack50.com/billdetail/1824669) - **FTC actions:** GoodRx $1.5M civil penalty (HBNR); BetterHelp $7.8M in consumer refunds (FTC Act); Premom $100K civil penalty (HBNR) plus $100K to three states.[\[7\]](https://www.fiercehealthcare.com/health-tech/ftc-finalizes-changes-data-privacy-rule-step-scrutiny-digital-health-apps) - **Class-action settlements:** Advocate Aurora $12.225M.[\[1\]](https://www.hipaajournal.com/advocate-aurora-health-settles-pixel-lawsuit-for-12-25-million/) Stacking matters: an Illinois system that experiences a tracking-pixel breach can face OCR penalties, an FTC investigation, a state AG action, BIPA/Eavesdropping Statute private claims, and (if HB 3494 passes) per-violation statutory damages, all from the same underlying conduct. ### Reputational Damage Breaches affecting 500 or more individuals are published on the OCR breach portal, often called the "Wall of Shame." Advocate Aurora's filing with HHS indicated 3 million people, its entire patient base, could be affected.[\[9\]](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) A 2024 LOKKER study found that roughly one-third of major U.S. hospital websites still had the Meta Pixel installed, ensuring continued scrutiny from regulators and journalists.[\[10\]](https://www.hipaajournal.com/one-third-healthcare-websites-meta-pixel-tracking-code-2024/) A separate study published in Health Affairs found that third-party tracking technologies were in use on 98.6% of non-federal acute-care hospital websites.[\[1\]](https://www.hipaajournal.com/advocate-aurora-health-settles-pixel-lawsuit-for-12-25-million/) ### Operational Disruption OCR resolution agreements typically come with multi-year corrective action plans (CAPs) covering policies, technical remediation, workforce training, reporting, and monitoring. When OCR opens a tracking investigation, it generally issues a structured document request that reads like a technical audit, demanding an inventory of every pixel, tag, cookie, and session-replay script across every domain, with mapping of what data each one accesses and what contractual protections govern it. The Advocate Aurora settlement itself required the system to implement all remedial measures necessary to ensure its use of tracking pixels materially complies with HIPAA and OCR guidance, including the use of valid business associate agreements where required.[\[9\]](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) ### Personal Liability Beyond civil penalties, the Department of Justice prosecutes HIPAA crimes under 42 U.S.C. § 1320d-6. Criminal penalties scale with intent: knowing wrongful disclosure carries up to a $50,000 fine and 1 year imprisonment; disclosure under false pretenses up to $100,000 and 5 years; and disclosure for commercial advantage, personal gain, or malicious harm up to $250,000 and 10 years. ## How Violations Happen Under the Illinois Consumer Health Data Act Framework ### Technical Configurations In Advocate Aurora's case, tracking technologies including Meta Pixel and Google Analytics were embedded on the website, patient portal, and scheduling app to "better understand patient needs and preferences," and the tools transmitted appointment dates and times, procedures, provider information, IP addresses, names, and communications.[\[9\]](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) HHS treats IP addresses as one of 18 HIPAA identifiers when combined with health context, which is why tracking on booking flows and forms creates exposure; a June 2024 court ruling vacated OCR's view for IP addresses on unauthenticated public pages.[\[9\]](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) ### Vendor Relationships OCR's 2024 guidance makes clear that if a tracking vendor will not sign a BAA, a regulated entity may execute a BAA with an intermediary, such as a Customer Data Platform, that de-identifies tracking information under 45 CFR 164.514 before any disclosure to the downstream tracking vendor.[\[11\]](https://www.insideprivacy.com/health-privacy/hhs-ocr-updates-tracking-technologies-guidance/) The implication is direct: any vendor receiving identifiable web data tied to health interactions either signs a BAA or is fed only de-identified data through a BAA-covered intermediary. ### Staff Actions In the FTC's GoodRx case, the company shared sensitive personal health information with Facebook, Google, Criteo, and other companies for advertising purposes, contradicting privacy promises made to consumers.[\[6\]](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) These are marketing implementations, not EHR breaches, and they typically originate with growth, paid-media, or web teams. ### Audit Triggers and Red Flags Scrutiny of tracking grew after journalistic exposés. The Markup's June 2022 investigation found the Meta Pixel on appointment-scheduling pages at 33 of Newsweek's top 100 hospitals; OCR and FTC then sent joint warning letters to approximately 130 systems by July 2023.[\[8\]](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-hhs-warn-hospital-systems-telehealth-providers-about-privacy-security-risks-online-tracking) OCR has not published its selection criteria and can open a compliance review without a complaint or breach report. ## Protection Strategies for the Illinois Consumer Health Data Act ### Immediate Actions (This Week) - **Inventory every tracking pixel, tag, cookie, and SDK** on every domain, subdomain, patient portal, and mobile app, mapping each to the data it can access and the third party it transmits to. - **Pull BAAs for every marketing and analytics vendor** that receives data tied to patient interactions. If a vendor will not sign a BAA, treat its data feed as non-compliant until remediated. - **Search outbound network traffic** from appointment scheduling, symptom checker, provider search, and condition pages for PHI fields (names, emails, IP addresses combined with health-context URLs). - **Document the current state**, including screenshots, tag-manager exports, and vendor contracts. OCR document requests assume you can produce this on short notice. ### Short-Term Fixes (This Month) - Remove or reconfigure client-side pixels on authenticated pages (MyChart, patient portals, scheduling). - Move to server-side tracking with PHI filtering at the gateway, so identifiers and health context never leave your environment in raw form. - Update privacy policies to accurately describe what is collected and shared. The BetterHelp consent order specifically targeted misleading "your information stays private" representations.[\[6\]](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) - Train marketing, growth, and web-operations staff on the practical difference between aggregate analytics and PHI-bearing event streams. ### Long-Term Compliance Infrastructure OCR's posture treats data leaving the browser as a regulated data flow that requires the same scrutiny as anything in the EHR. Sustainable compliance therefore needs: - **Continuous monitoring** that detects tag drift as marketing rotates campaigns. - **A risk analysis** that explicitly covers tracking technologies under the Security Rule, which OCR has stated it is prioritizing in tracking investigations.[\[5\]](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) - **Change-management triggers** when marketing or product adds new tools. - **Audit trails** defensible to an OCR or state AG document request. ### Vendor Evaluation Criteria - **BAA availability** with appropriate restrictions on PHI use and disclosure. - **PHI filtering or de-identification** at ingest, not after data leaves your domain. - **SOC 2 Type II and HIPAA-specific attestations.** - **Healthcare-specific experience**, particularly with appointment scheduling, intake forms, and patient portals. ## How Curve Addresses Each Risk Curve is a HIPAA-compliant tracking platform built for healthcare marketing. It maps directly to the failure modes described above: - **Automated PHI stripping:** Curve removes identifiers and health context before data leaves your environment, addressing the exact mechanism that triggered the Advocate Aurora and Southern Illinois Healthcare settlements. - **Server-side tracking:** Conversion data flows through a Curve-managed gateway to Google Ads, Meta, and other ad platforms without client-side pixels broadcasting raw event data from authenticated pages. - **Signed BAAs included:** Curve enters a BAA with every customer, closing the vendor gap that OCR's 2024 guidance highlights as a primary violation pathway.[\[11\]](https://www.insideprivacy.com/health-privacy/hhs-ocr-updates-tracking-technologies-guidance/) - **Audit trails:** Documentation of what was collected, what was stripped, and what was transmitted, designed to answer the technical-inventory requests OCR routinely opens tracking investigations with. - **Healthcare-specific design:** Built around the actual workflows (appointment scheduling, intake forms, condition pages, portal logins) where Illinois plaintiffs have repeatedly found violations. - **Rapid implementation:** Curve's team does the setup, and most healthcare organizations move from at-risk client-side tracking to a defensible server-side stack in about a week, not quarters. ## Don't Wait for Enforcement Every day without compliant tracking is a day of risk exposure. [Schedule a Compliance Assessment with Curve](https://www.curvecompliance.com/?via=md). ## Illinois Healthcare Marketing Compliance Checklist - Inventoried every pixel, tag, cookie, SDK, and session-replay script on all public and authenticated properties. - Confirmed signed BAAs with every analytics, ad-tech, and CDP vendor handling patient-interaction data. - Removed or reconfigured Meta Pixel, Google Analytics, and similar tools on MyChart-style portals and scheduling flows. - Implemented server-side tracking with PHI filtering at the gateway. - Updated privacy policies to accurately reflect actual data flows (avoiding the misrepresentations cited in the BetterHelp order). - Included tracking technologies in the Security Rule risk analysis. - Documented change-management procedures for marketing tag deployments. - Trained marketing, growth, and web teams on PHI versus aggregate analytics. - Established continuous monitoring for tag drift. - Monitored Illinois legislative status of HB 3494 and successor Protect Health Data Privacy Act bills. ## Frequently Asked Questions About the Illinois Consumer Health Data Act ### What are the penalties for HIPAA marketing violations? HIPAA civil penalties scale across four tiers, with per-violation amounts ranging from $145 (Tier 1 minimum) to $2,190,294 (Tier 4) and a $2,190,294 calendar-year cap per identical provision under the January 2026 inflation adjustment.[\[4\]](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) State attorneys general may add up to $100 per violation, capped at $25,000 per year per identical provision. For tracking-based disclosures, the FTC obtained civil penalties of $1.5 million from GoodRx and $100,000 from Premom's developer under the Health Breach Notification Rule, and $7.8 million in consumer refunds from BetterHelp under the FTC Act.[\[7\]](https://www.fiercehealthcare.com/health-tech/ftc-finalizes-changes-data-privacy-rule-step-scrutiny-digital-health-apps) ### Can healthcare practices be sued for using Meta Pixel? Yes, and they have been. Advocate Aurora Health, headquartered in Downers Grove, Illinois, paid $12.225 million to settle a consolidated class action specifically over Meta Pixel and Google Analytics use on its websites and patient portal.[\[1\]](https://www.hipaajournal.com/advocate-aurora-health-settles-pixel-lawsuit-for-12-25-million/) Southern Illinois Healthcare entities reached a separate settlement covering approximately 79,215 patients over MyChart-related pixel disclosures, with plaintiffs invoking the Illinois Eavesdropping Statute and the Illinois Consumer Fraud and Deceptive Business Practices Act.[\[2\]](https://www.hipaajournal.com/southern-illinois-healthcare-enterprises-pixel-settlement/) ### How do I know if my healthcare marketing is compliant? Three diagnostic questions: (1) Do you have a signed BAA with every vendor receiving patient-interaction data, or do you de-identify through a BAA-covered intermediary before disclosure? OCR's 2024 guidance treats this as table stakes.[\[11\]](https://www.insideprivacy.com/health-privacy/hhs-ocr-updates-tracking-technologies-guidance/) (2) Have you confirmed that no PHI (including IP address combined with health-context URLs, names, emails, appointment details) leaves authenticated pages to third parties without authorization? (3) Does your privacy policy accurately describe what you actually share, or does it contain BetterHelp-style "we never share" promises that contradict your tag stack?[\[6\]](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) ### What should I do if I discover a compliance violation? OCR tier placement depends heavily on speed and completeness of remediation. Containment, internal investigation, and documentation should begin immediately. Under HIPAA, breaches affecting 500 or more individuals require notification to HHS, affected individuals, and the media. Tier 3 (willful neglect, corrected within 30 days) carries materially lower exposure than Tier 4 (willful neglect, uncorrected).[\[4\]](https://www.federalregister.gov/documents/2024/08/08/2024-17466/annual-civil-monetary-penalties-inflation-adjustment) Engage counsel before issuing public statements; the BetterHelp action specifically penalized misrepresentations in public-facing privacy communications.[\[6\]](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) ### Does the Illinois Consumer Health Data Act apply to my organization? The Illinois consumer health data act (most recently HB 3494, the Protect Health Data Privacy Act) has been reintroduced in Springfield but has not yet been enacted.[\[3\]](https://www.billtrack50.com/billdetail/1824669) If enacted, it would impose consent requirements for collection, sale, sharing, and storage of health data; create a private right of action with $1,000 to $5,000 per violation depending on negligence versus intent; prohibit geofencing around health-care providers; and authorize Illinois Attorney General enforcement under the Consumer Fraud and Deceptive Business Practices Act.[\[3\]](https://www.billtrack50.com/billdetail/1824669) IL healthcare marketing teams should track the bill closely and build now to its standard, since current Illinois plaintiffs already use BIPA, the Eavesdropping Statute, and consumer-fraud statutes to bring substantially similar claims. ### How can an Illinois healthcare organization keep ad tracking without sending patient data to Meta or Google? Remove client-side pixels from authenticated pages such as MyChart and scheduling, and move to server-side tracking. Curve Compliance signs a BAA, sends conversions server-side to Meta Conversions API and Google Ads with only a fixed list of fields, and keeps contact identifiers off by default. It also flags PHI-like patterns, such as emails in URLs, so your team can fix them at the source. ## Sources - [HIPAA Journal: Advocate Aurora Health Settles Pixel Lawsuit for $12.225 Million](https://www.hipaajournal.com/advocate-aurora-health-settles-pixel-lawsuit-for-12-25-million/) - [HIPAA Journal: Southern Illinois Healthcare Enterprises Pixel Settlement](https://www.hipaajournal.com/southern-illinois-healthcare-enterprises-pixel-settlement/) - [BillTrack50: IL HB3494 Protect Health Data Privacy Act](https://www.billtrack50.com/billdetail/1824669) - [Federal Register: HHS Annual Civil Monetary Penalties Inflation Adjustment (Aug. 8, 2024)](https://www.federalregister.gov/documents/2024/08/08/2024-17466/annual-civil-monetary-penalties-inflation-adjustment) - [HHS.gov: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) - [FTC: Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info](https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising) - [Fierce Healthcare: FTC Finalizes Changes to Health Breach Notification Rule](https://www.fiercehealthcare.com/health-tech/ftc-finalizes-changes-data-privacy-rule-step-scrutiny-digital-health-apps) - [FTC: FTC and HHS Warn Hospital Systems and Telehealth Providers](https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-hhs-warn-hospital-systems-telehealth-providers-about-privacy-security-risks-online-tracking) - [Milberg: Aurora Health Agrees to $12.25M Settlement in Tracking Pixel Suit](https://milberg.com/news/aurora-health-data-breach-proposed-settlement/) - [HIPAA Journal: One-third of Healthcare Websites Still Use Meta Pixel](https://www.hipaajournal.com/one-third-healthcare-websites-meta-pixel-tracking-code-2024/) - [Inside Privacy (Covington): HHS OCR Updates Tracking Technologies Guidance](https://www.insideprivacy.com/health-privacy/hhs-ocr-updates-tracking-technologies-guidance/) Copy link On this page No headings found Keep exploring ## Related articles [Browse all guides](https://www.curvecompliance.com/blog?via=md) - [Guide Advocate Aurora $12.2M Pixel Settlement: Anatomy of a Healthcare Data Lawsuit May 19, 2026](https://www.curvecompliance.com/advocate-aurora-12-2m-pixel-settlement-anatomy-healthcare-data-lawsuit?via=md) - [Guide Oregon Consumer Privacy Act Healthcare Provisions: Marketing Compliance for OR Providers May 19, 2026](https://www.curvecompliance.com/oregon-consumer-privacy-act-healthcare-provisions-marketing-compliance?via=md) - [Guide Minnesota Consumer Data Privacy Act: Healthcare Marketing Compliance for the North Star State Mar 27, 2026](https://www.curvecompliance.com/minnesota-consumer-data-privacy-act-healthcare-marketing?via=md) - [Guide HIPAA Marketing Risk Calculator: Estimate Your Pixel Exposure in 2 Minutes May 19, 2026](https://www.curvecompliance.com/hipaa-marketing-risk-calculator-estimate-pixel-exposure-2-minutes?via=md) Next step ## Check your own site See if your website is at risk. Enter your domain to scan it for tracking scripts that can expose patient data. [Or book a tracking audit](https://www.curvecompliance.com/book?src=guide-nextstep&via=md) ## Stay Compliant. Scale Confidently. Curve's team sets up HIPAA-compliant ad tracking for you, and most customers are live in about a week. [Book a free tracking audit](https://www.curvecompliance.com/book?src=guide-band&via=md) --- Full site index for agents: https://www.curvecompliance.com/llms.txt Sitemap: https://www.curvecompliance.com/sitemap.xml HTML version of this page: https://www.curvecompliance.com/illinois-consumer-health-data-protection-act-healthcare-marketing