Is a Cookie Banner Enough for HIPAA Compliance?

No, a cookie banner is not enough for HIPAA: the Department of Health and Human Services (HHS) says website banners that ask users to accept or reject tracking "do not constitute a valid HIPAA authorization" (HHS bulletin on online tracking). To send protected health information (PHI) to a tracking or advertising vendor, HHS says a clinic needs a signed business associate agreement (BAA) with that vendor plus a Privacy Rule permission, or each person's written authorization under 45 CFR 164.508. A banner click is neither, though a banner still has a job under state privacy laws. Curve Compliance pairs consent management with server-side conversion tracking that sends each ad platform a fixed list of fields, strips PHI before data reaches an ad platform, and includes a BAA on every plan.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then set up consent management and server-side conversions under a BAA on every plan. Book a call with Curve.

What HHS says about cookie banners

The sentence comes from the HHS Office for Civil Rights bulletin on online tracking technologies, in its list of HIPAA obligations for "regulated entities" (covered entities and business associates). In full: "If there is not an applicable Privacy Rule permission or if the vendor is not a business associate of the regulated entity, then the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor. Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization." (HHS bulletin)

HHS says the same of privacy policies (HHS bulletin): one that names your tracking tools does not, on its own, permit sending PHI to them. The question only comes up when tracking touches PHI and HIPAA applies to you: see what counts as PHI on a website and does HIPAA apply to med spas.

Does that sentence still stand after AHA v. Becerra?

Yes. On June 20, 2024, a federal court in the Northern District of Texas declared one part of the bulletin unlawful and vacated it in American Hospital Association v. Becerra: the position that HIPAA obligations are triggered when an online technology connects a person's IP address with a visit to a public, no-login webpage about specific health conditions or healthcare providers. Footnote 8 of the order limits it: "Such vacatur is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." The government appealed, then moved to dismiss its own appeal, and the Fifth Circuit dismissed it on September 4, 2024 (court docket, entries 69 and 71).

The banner sentence was not part of the vacated position. It is still on the HHS page as of October 13, 2026, under a notice saying "HHS is evaluating its next steps in light of that order." The bulletin is guidance (its disclaimer says its contents "do not have the force and effect of law"), so the binding text is the regulation below. More: the bulletin, annotated and are IP addresses PHI under HIPAA.

What HIPAA asks for when PHI goes to a tracking vendor

HHS describes two routes (HHS bulletin). One is a BAA plus a permission: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." The other, when either piece is missing, is the person's HIPAA authorization.

A BAA is a contract with the vendor. Under 45 CFR 164.502(e), a covered entity may disclose PHI to a business associate "if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information," documented in a written contract or other written agreement that meets 45 CFR 164.504(e).

An authorization is a document the patient signs. Under 45 CFR 164.508(c)(1), it "must contain at least the following elements":

1. What information. "A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion."
2. Who may use or disclose it, by "name or other specific identification of the person(s), or class of persons."
3. Who receives it, identified the same way: by name, other specific identification, or class of persons.
4. Why. "A description of each purpose of the requested use or disclosure."
5. When it ends. "An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure."
6. Signature. "Signature of the individual and date."

Section 164.508(c)(2) adds three statements: the right to revoke in writing, whether treatment or payment can be conditioned on signing, and the chance that the recipient discloses the information again. The document "must be written in plain language," and the individual gets a copy. For marketing, a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," apart from face-to-face communications and promotional gifts of nominal value (164.508(a)(3)).

Question	Cookie banner	HIPAA authorization	Business associate agreement
What is it?	A notice that asks a visitor to accept or reject tracking such as cookies	A document the patient signs that meets 45 CFR 164.508	A written contract or agreement with the vendor (164.502(e)(2))
Who agrees, and how?	The visitor, with a click	The patient or a personal representative, with "Signature of the individual and date"	The vendor, in writing, before it receives PHI
What must it say?	What the state privacy law it serves requires	Six core elements and three statements, in plain language	Permitted uses of PHI, safeguards, and reporting of improper uses (164.504(e)(2))
Does it let a clinic send PHI to a tracking vendor?	No. HHS: banners "do not constitute a valid HIPAA authorization"	Yes, consistent with the signed document	Yes, with "an applicable permission" under the Privacy Rule

Curve's BAA Directory lists Meta and Google Ads as not signing a BAA, and Meta's Business Tools Terms have advertisers promise not to share data that "includes or is based on, directly or otherwise, health information." For that case HHS points to a go-between: "the regulated entity can choose to establish a BAA with another vendor" that will de-identify the tracking data and pass on "only de-identified information" (HHS bulletin).

What a cookie banner is still good for

A banner answers state privacy laws and gives visitors a choice. Those laws are separate from HIPAA and reach only the businesses they define.

Washington's My Health My Data Act covers any legal entity that "Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington" and decides how consumer health data is collected, shared or sold (RCW 19.373.010). To collect that data, the entity needs "consent from the consumer for such collection for a specified purpose" unless the collection is necessary to provide a product or service the consumer requested (RCW 19.373.030), and consent means "a clear affirmative act." The act does not apply to PHI under HIPAA (RCW 19.373.100).

California's CCPA applies to "for-profit businesses that do business in California" that meet any one of three size or data thresholds, and "generally does not apply to nonprofit organizations or government agencies." Consumers can opt out of the sale or sharing of personal information, including through Global Privacy Control, which "must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information." The law "exempts certain types of information such as certain medical information" (California Attorney General).

A banner only does that job when the site obeys it, so tags wait or stop according to each choice. Curve's longer guides go deeper: cookie consent banners vs HIPAA authorization, consent management vs HIPAA authorization and what to configure on a clinic consent banner.

How Curve Compliance helps

Curve Compliance helps with both jobs. Its consent management applies the right rule for each visitor's region, shows a banner where opt-in is required, records every decision in an audit log, and holds back tracking and ad forwarding until a visitor's choice allows it. Washington starts as opt-in and California as opt-out, and Curve treats Global Privacy Control as a decline of advertising.

For HIPAA, Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and Curve strips PHI before data reaches an ad platform. Curve signs a BAA on every plan (BAA Directory entry).

For how these rules apply to your own site, talk to your counsel, and book a call with Curve to see what your pages send today.

Sources, checked October 13, 2026: HHS bulletin on online tracking technologies; HHS FAQ on electronic authorizations; 45 CFR 164.502, 164.504 and 164.508; American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. June 20, 2024) and its docket; Washington RCW 19.373.010, 19.373.030 and 19.373.100; California Attorney General, CCPA; and Meta Business Tools Terms.

Frequently Asked Questions

Is a cookie banner enough for HIPAA?

No. HHS says website banners that ask users to accept or reject tracking "do not constitute a valid HIPAA authorization" (HHS bulletin). Sending PHI to a tracking vendor takes a signed BAA with a Privacy Rule permission, or the patient's written authorization.

What does a valid HIPAA authorization need?

Under 45 CFR 164.508(c), six core elements: a specific description of the information, who may use or disclose it, who receives it, each purpose, an expiration date or event, and the "Signature of the individual and date," plus three required statements, all in plain language.

Did AHA v. Becerra overturn the HHS position on cookie banners?

No. The June 20, 2024 order vacated only the bulletin's position on an IP address combined with a visit to a public webpage about health conditions or providers. The court wrote that the vacatur should not be construed as "limiting the legal operability of other guidance in the germane HHS document."

If a visitor clicks Accept, can I send their data to Meta or Google?

Not if it is PHI. HHS says a banner is not a HIPAA authorization (HHS bulletin), and Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. Curve Compliance sends conversions server-side and strips PHI before data reaches an ad platform.

Can a HIPAA authorization be collected online?

Yes, as a signed document. HHS says "the Privacy Rule allows HIPAA authorizations to be obtained electronically from individuals, provided any electronic signature is valid under applicable law" (HHS FAQ). It still needs every element in 45 CFR 164.508(c), and a banner collects a click, not a signature and date.

Do I still need a cookie banner if my tracking vendor signs a BAA?

That depends on the state privacy laws that apply to you. A BAA is a HIPAA contract with a vendor. A banner serves laws such as Washington's My Health My Data Act (RCW 19.373.030) and California's CCPA (Attorney General), for the businesses they cover. Curve Compliance signs a BAA on every plan and provides consent management.

Does Curve Compliance work with the cookie banner I already have?

Yes. Curve's consent management can show its own banner where opt-in is required, or you can keep your existing consent tool and pass its choices to Curve.

Talk to Curve Compliance

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, set up consent management and server-side conversions, and sign a BAA on every plan. Most customers are live in about a week. Book a call with Curve.