On this page
It depends on who runs the pixel and what it sends: the Meta Pixel is a HIPAA violation when a HIPAA covered entity or business associate uses it to disclose protected health information (PHI) to Meta without a valid patient authorization (45 CFR 164.508). Meta does not sign a business associate agreement (BAA), and its Business Tools Terms (effective November 3, 2025) say advertisers will not share data that "includes or is based on, directly or otherwise, health information" (see Curve's Meta BAA entry). In American Hospital Association v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated the part of HHS's tracking guidance that treated an IP address plus a visit to a public, unauthenticated page about a health condition or provider as enough on its own. Pixels on patient portals, and on booking, intake and other pages where people enter health information, can still disclose PHI under the rest of the guidance, which stands (our annotated HHS bulletin). Companies outside HIPAA are not in the clear either: the FTC and state laws such as Washington's My Health My Data Act (RCW 19.373) reach health data that HIPAA does not cover. Curve Compliance helps by replacing the browser pixel with server-side conversion tracking: it sends Meta only a fixed list of fields under neutral event names, checks every event for PHI-like patterns before data reaches an ad platform, and signs a BAA on every plan.
Book a call. Curve Compliance replaces the Meta Pixel with server-side conversion tracking for Meta, Google Ads, TikTok and other ad platforms, with a BAA on every plan. Curve's team does the setup, and most customers are live in about a week. Book a call with Curve.
The Meta Pixel is not a HIPAA-compliant way to send health information from a healthcare website. Meta does not offer Business Associate Agreements (BAAs) for its advertising products, including the Meta Pixel, so under HIPAA it cannot receive PHI from a covered entity's website unless each patient has signed a valid authorization, and Meta's own terms ask advertisers not to send health information at all. The Meta Pixel is Facebook's tracking tool that collects visitor behavior data to optimize ad targeting and measure campaign performance. Healthcare marketers rely on it to track conversions, retarget website visitors, and build lookalike audiences for patient acquisition campaigns. However, the Meta Pixel on a healthcare website can expose PHI and lead to regulatory violations, substantial fines and enforcement actions.
The Department of Health and Human Services Office for Civil Rights (OCR) has explicitly warned healthcare organizations about using tracking technologies that share patient data with third parties without proper safeguards. In December 2022, OCR issued a bulletin on tracking technologies on healthcare websites and apps, and revised it on March 18, 2024 (court opinion). It still says regulated entities "are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors," and that disclosing PHI to tracking vendors "for marketing purposes, without individuals' HIPAA-compliant authorizations" is impermissible (HHS tracking bulletin). A federal court vacated one narrow part of the bulletin in June 2024, covered below. The Federal Trade Commission also acts against health companies that HIPAA does not cover: in 2023, in the FTC's first case under its Health Breach Notification Rule, GoodRx agreed to pay a $1.5 million civil penalty after the FTC alleged it shared users' health information with Facebook, Google and other companies (FTC announcement).
What Makes the Meta Pixel Non-Compliant
Meta's refusal to enter into BAAs represents the fundamental barrier to HIPAA compliance for healthcare organizations. Under HIPAA regulations, covered entities must obtain written agreements from all vendors who may access PHI during their services. These agreements outline how PHI will be protected, used, and disclosed. Meta does not offer BAAs for its advertising products, and its Business Tools Terms go further: advertisers promise not to share data that "includes or is based on, directly or otherwise, health information," and the names they choose for events, conversions and custom audiences "must not reflect, imply or be based on" that kind of information (Meta Business Tools Terms, effective November 3, 2025).
The Meta Pixel operates by placing a JavaScript code snippet on websites that automatically collects extensive visitor data. This includes IP addresses, device identifiers, browsing patterns, form interactions, and page visit sequences. When deployed on healthcare websites, this data collection occurs regardless of whether visitors are patients, potential patients, or general browsers. The pixel transmits this information directly to Meta's servers, where it becomes integrated into Meta's advertising ecosystem for targeting and optimization purposes.
Healthcare organizations cannot control how Meta processes, stores, or shares this data once it reaches their servers. Meta's Business Tools Terms let Meta use the event data it receives to improve ad delivery, to personalize the features and content, including ads, that it shows people "on and off our Meta Company Products," and for research and development (Meta Business Tools Terms). Without a BAA, Meta has made no HIPAA promise about what happens to the data next. HIPAA's minimum necessary standard is a separate duty: when a covered entity uses or discloses PHI, it "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose" (45 CFR 164.502(b)). A pixel that sends the page address and event details with every event makes that hard to meet.
The timing and scope of data collection also create compliance challenges. By default, the Meta Pixel fires as soon as a page loads, collecting data before users can respond to a consent prompt or opt out of tracking. For a disclosure like this, HIPAA requires the patient's signed authorization, not an opt-out. A covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions (45 CFR 164.508(a)(3)), and HHS says website "banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization" (HHS tracking bulletin). So an opt-out link or a cookie banner does not fix a pixel that sends PHI.
To keep conversion tracking after removing the pixel, follow how to make Facebook ads HIPAA compliant.
What changed after AHA v. Becerra
On June 20, 2024, the U.S. District Court for the Northern District of Texas declared unlawful and vacated one part of HHS's tracking bulletin, which the court called the "Proscribed Combination": an online technology connecting "(1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers" (opinion and order; HHS notice on the bulletin). HHS appealed, and the Fifth Circuit dismissed the appeal on HHS's own motion on September 4, 2024 (court docket). The court said its vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." HHS's page now says "HHS is evaluating its next steps in light of that order."
| Where the Meta Pixel runs | After the June 2024 ruling |
|---|---|
| Public page about a condition or provider, sending only an IP address and the page visit | No longer PHI on that basis alone (order) |
| Booking, intake or symptom-checker page where visitors type or select details | Still covered: HHS says these pages "may have access to PHI in certain circumstances" (HHS) |
| Patient portal or other logged-in page | Still covered: tracking there "generally" has access to PHI, HHS says (HHS) |
For a clinic running Meta ads, the pages that matter most are the ones that produce conversions: bookings, consult requests and intake forms. Those are the pages the ruling left covered. The passage-by-passage breakdown is in our annotated HHS tracking bulletin.
PHI Risks When Using the Meta Pixel in Healthcare
Healthcare websites contain numerous data points that constitute PHI under HIPAA when combined with identifying information. The Meta Pixel collects many of these elements automatically, creating substantial exposure risks. IP addresses collected by the pixel can identify individuals when combined with browsing patterns on healthcare sites. Device fingerprinting data, including browser type, screen resolution, and installed plugins, creates unique visitor profiles that can be linked to specific individuals over time.
Form field interactions present particularly high PHI exposure risks. The Meta Pixel can capture data from contact forms, appointment requests, and patient portal login attempts. This includes names, email addresses, phone numbers, and medical inquiries submitted through website forms. Even partial form completions generate tracking data that may contain identifiable health information. Healthcare organizations that audit their pixels can find that their contact forms have been sending patient names and medical concerns directly to Meta's servers through pixel tracking.
Page visit patterns on healthcare websites frequently reveal sensitive health conditions. Visitors browsing cardiology services, oncology treatments, or mental health resources generate tracking data that indicates potential medical conditions. The Meta Pixel captures these page views along with visitor identifiers, creating detailed profiles of health-related interests and concerns. When combined with Meta's external data sources and cross-platform tracking, this information can identify specific individuals and their health conditions.
Search query parameters embedded in URLs represent another significant PHI risk. Healthcare websites often put health terms in the page address itself, such as a condition in a filter or a treatment in a landing page URL. The Meta Pixel sends the page address with its events, so terms like specific diseases, symptoms or treatments can travel with it. Internal site searches also generate trackable data when users search for health conditions or provider information within healthcare websites.
Geographic location data collected by the Meta Pixel can identify patients when combined with visit patterns to specialized healthcare providers. Small medical practices or specialized treatment centers serve limited geographic areas, making patient identification possible through location and timing correlation. Mental health providers, addiction treatment centers, and reproductive health clinics face particularly high identification risks due to the sensitive nature of their services and limited patient populations.
How Curve Replaces the Meta Pixel for Healthcare Sites
Curve gives healthcare organizations that need Meta advertising a way to keep it without a browser pixel. Curve sits between the website and Meta under a BAA, collects website data through server-side tracking, and strips PHI before data reaches an ad platform. This lets healthcare marketers keep running Facebook and Instagram campaigns while cutting the PHI exposure a pixel creates.
The Curve implementation process begins with removing existing Meta Pixel code from healthcare websites and replacing it with Curve's compliant tracking solution. With the pixel removed, the visitor's browser no longer sends data to Meta's servers. Data is collected by Curve under its BAA, and Curve checks every event for PHI-like patterns before anything is sent to an ad platform.
Curve's data processing includes several layers of PHI protection built for healthcare marketing. Each ad platform receives only a fixed list of fields, and contact identifiers are off by default for Meta, Google Ads and TikTok. Events can use neutral names, so a conversion reads as a booking or a lead, not a condition. Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
Healthcare organizations implementing Curve maintain full control over their advertising data while accessing Meta's advanced targeting and optimization features. Curve sends each conversion to Meta's Conversions API from Curve's servers with that fixed list of fields, so Meta's campaign optimization gets a conversion signal without the page details a pixel would carry. This includes appointment bookings, form submissions and phone calls from Meta campaigns, which Curve receives from booking systems, CRMs and call tracking and credits to the original ad click. Curve's Event Logs show what Curve sent to each platform and what the platform accepted, and Campaign Reporting puts Meta and Google Ads spend next to Curve-tracked conversions, while PHI stays out of what ad platforms receive.
Curve's team does the implementation, which requires minimal technical resources from you, and most customers are live in about a week. Curve's team handles the move from browser Meta Pixel tracking to server-side sending. Healthcare organizations keep their existing Meta advertising accounts and campaign structures and add a layer that strips PHI before data reaches an ad platform.
HIPAA-Compliant Alternatives to the Meta Pixel
Several analytics and tracking solutions offer HIPAA-compliant alternatives to the Meta Pixel for healthcare organizations. Google Analytics 4 is limited here, because Google does not offer Business Associate Agreements for Google Analytics. Google says it "does not offer Business Associate Agreements in connection with this service" and that HIPAA-regulated customers "may only use Google Analytics on pages that are not HIPAA-covered" (Google Analytics Help). There is no IP anonymization setting to turn on, because Google says "In Google Analytics 4, IP masking is not necessary since IP addresses are not logged or stored" (Google Analytics Help). Turning off advertising features and shortening data retention reduce what Google keeps, but they do not make GA4 acceptable on HIPAA-covered pages. Telehealth brands can read whether a telehealth company can use Google Analytics. However, GA4's advertising integrations require careful management to prevent PHI exposure through audience sharing and conversion tracking features.
Adobe offers enterprise web analytics, and it signs BAAs only for the products on its HIPAA-Ready list. That list includes Adobe Customer Journey Analytics but not Adobe Analytics, and customers "must have the correct license and a signed BAA with Adobe" (Adobe Trust Center, last updated September 2026). Customer Journey Analytics offers advanced segmentation and reporting. Adobe uses a shared responsibility model and "relies on the customer to use and configure the HIPAA-Ready Services consistent with HIPAA," so PHI masking, data sharing limits and conversion tracking are settings your team has to get right. It is an enterprise product that takes significant technical expertise to run.
HubSpot offers marketing automation and analytics tools, and it offers a BAA on Enterprise subscriptions once Sensitive Data is turned on and the account selects both the Health/Medical Data checkbox and "We are a HIPAA-covered entity or business associate" (HubSpot Knowledge Base; Curve's HubSpot BAA entry). The platform includes website tracking, form analytics and email marketing. HubSpot notes that "Sensitive Data properties are unavailable in certain tools, including personalization tokens, sandboxes, chatbots and playbooks." Integration with advertising platforms requires careful configuration to maintain compliance while enabling campaign optimization, because HubSpot's BAA covers data inside HubSpot, not the ad platforms that receive data from it.
Curve is built for healthcare organizations that specifically need Meta advertising capabilities while they meet their HIPAA obligations. Unlike general analytics alternatives, Curve specializes in maintaining the advanced targeting and optimization features that make Meta advertising effective for patient acquisition. Curve's team does the setup, and Curve's Event Logs show what was sent to each platform, which removes much of the configuration and monitoring work that general-purpose analytics tools need.
Healthcare organizations can also implement first-party data collection strategies that reduce dependence on third-party tracking pixels. Email marketing automation, patient portal analytics, and CRM integration provide valuable insights without external data sharing risks. These approaches require longer implementation timelines and may limit advertising platform optimization capabilities compared to pixel-based tracking solutions.
Sources (checked October 16, 2026): Meta Business Tools Terms; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; American Hospital Association v. Becerra, opinion and order (N.D. Tex. June 20, 2024) and docket; 45 CFR 164.508; 45 CFR 164.502; 45 CFR 160.404; Federal Register 2026-01688; FTC, GoodRx enforcement action; Washington My Health My Data Act, RCW 19.373; Google Analytics Help, HIPAA and Google Analytics; Google Analytics Help, IP masking; Adobe Trust Center, HIPAA-Ready Services; HubSpot Knowledge Base, Store Sensitive Data. This page is general information, not legal advice; talk to your counsel about your own website.
Frequently Asked Questions
Is the Meta pixel a HIPAA violation?
It is when a HIPAA covered entity or business associate uses it to send PHI to Meta without the patient's valid authorization, because Meta signs no BAA and its terms bar health information (Meta Business Tools Terms). Since the June 20, 2024 AHA v. Becerra ruling, a pixel that only pairs an IP address with a visit to a public page is not a violation on that basis alone, but pixels on portals, booking and intake pages still can be (court order).
Does HIPAA still apply to the Meta pixel after the court ruling?
Yes, for everything the court left in place. The June 20, 2024 order vacated only the IP-address-plus-public-page rule and says it "is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document" (order, footnote 8).
Is the Meta pixel legal for health companies that HIPAA does not cover?
Not automatically. The FTC acts against health apps and sites outside HIPAA, as in its 2023 GoodRx case (FTC), and in Washington, the My Health My Data Act says a regulated entity or small business "may not share any consumer health data except" with the consumer's separate consent or as needed to provide what the consumer asked for. It applies to businesses that operate in Washington or target Washington consumers, for the health data of Washington residents and of anyone whose data is collected in Washington (RCW 19.373).
Does Meta offer Business Associate Agreements for healthcare organizations?
No, Meta does not provide Business Associate Agreements for any of its advertising products, including the Meta Pixel, Facebook Ads, or Instagram advertising tools. Meta's Business Tools Terms tell advertisers they will not share data that "includes or is based on, directly or otherwise, health information" (Meta Business Tools Terms; Curve's Meta BAA entry). So a covered entity should not send PHI to Meta's advertising tools at all, however it configures privacy settings or data collection parameters.
What specific data does the Meta Pixel collect that could violate HIPAA?
The Meta Pixel collects IP addresses, device identifiers, browsing patterns, form interactions, page views, search queries, and geographic location data. When deployed on healthcare websites, this information can identify patients and reveal health conditions, medical interests, or treatment-seeking behavior. Form submissions may capture names, contact information, and medical inquiries that constitute PHI under HIPAA. Page visit patterns to specialized medical services can indicate specific health conditions when combined with identifying data.
Can healthcare organizations use the Meta Pixel if they anonymize patient data?
Technical anonymization of patient data does not resolve HIPAA compliance issues with the Meta Pixel because the data collection and transmission occur before healthcare organizations can implement anonymization controls. The Meta Pixel operates client-side, automatically transmitting data to Meta's servers upon page load. Healthcare organizations cannot intercept or anonymize this data stream, making true anonymization impossible while maintaining the pixel's advertising functionality. HHS also says "it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information" (HHS tracking bulletin).
What are the potential penalties for using non-compliant tracking on healthcare websites?
For 2026, HIPAA civil money penalties run from $145 per violation in the lowest tier up to $73,011 per violation in the first three tiers. For willful neglect that is not corrected within 30 days, the range is $73,011 to $2,190,294 per violation. The calendar-year cap for identical violations reaches $2,190,294 (Federal Register, January 28, 2026; 45 CFR 160.404). OCR's tracking bulletin says "OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies" (HHS). Healthcare organizations may also face FTC enforcement action for deceptive practices related to patient privacy. In 2023, GoodRx agreed to pay a $1.5 million civil penalty in the FTC's first Health Breach Notification Rule case, over health information shared with Facebook, Google and other companies (FTC), showing regulators' commitment to enforcing tracking compliance. Class actions follow the same facts; see our mid-2026 roundup of healthcare pixel lawsuits and settlements.