On this page
Website tracking is any script or code on a page that records what visitors do and sends it to the site owner or a vendor, such as an analytics tool or an ad platform. On a health website that data can include what a patient types or selects when booking, which is why HHS treats tracking code as something the HIPAA Rules can reach (HHS). Curve Compliance, which replaces browser ad pixels on health sites with one script that sends conversions server-side, checked every source below on November 9, 2026.
Book a call. Not sure what your site sends today? Curve Compliance's free website scan lists the pixels and trackers on a page, and Curve replaces browser ad pixels with one script that sends conversions server-side and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What website tracking is: pixels, tags, cookies and scripts
HHS lists the usual kinds: “Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts to track and collect information from users” (HHS). Here is what each one is, in the words of the people who define or make them:
| Type | What it is | Source |
|---|---|---|
| Tracking pixel | “A tiny graphic image (usually 1 pixel) placed on a webpage that allows the website owner or a third party to collect information regarding the use of the webpage.” Meta describes its own as “a piece of code that you put on your website.” | HHS; Meta |
| Tag and tag manager | “Google Tag Manager is a tag management system that allows you to set up and manage tags on your site without changing your website's code.” A container “can replace all other manually-coded tags on a site or app, including tags from Google Ads, Google Analytics, Floodlight, and 3rd party tags.” | |
| Cookie | “A small piece of data a server sends to a user's web browser.” Tracking, “Recording and analyzing user behavior,” is one of the three main uses MDN lists. | MDN |
| Session replay script | “Session replay scripts record a user's activities (e.g., mouse movements, clicks, and typing) when using a webpage or app.” | HHS |
| Fingerprinting | “Fingerprinting uses a browser's and/or device's unique configurations and settings to track user activity.” | HHS |
For more on the most common one, see what a tracking pixel is on a health site.
Web tracking vs website analytics
People use "web tracking" and "website tracking" for the same thing: code that records visits and actions. Website analytics is one use of it, where the owner studies traffic in an analytics tool. Ad tracking is another, where a pixel reports actions to an ad platform so it can measure and target ads.
Meta says its pixel “allows you to measure the effectiveness of your Meta advertising by understanding the actions people take on your website,” and that advertisers can “make custom audiences from these events, or use these events for retargeting ads” (Meta). Whose code it is matters too. MDN explains that when a cookie's domain and scheme match the page, “the cookie is considered to be from the same site as the page, and is referred to as a first-party cookie,” and when they differ it is a third-party cookie (MDN). See third-party cookies on health websites.
What trackers send from a health site
Meta says that once the pixel is set up, it “will log when someone takes an action, also called an event, on your website” (Meta). What travels with that event is where health sites get into trouble:
- The event itself. Meta tells advertisers to “Regularly review your Meta Pixel setup, event names, parameters, URLs, and any optional features you enable to ensure compliance” (Meta). An event name like a condition-specific booking says more than a neutral one.
- What people type or pick when they book. HHS gives this example: “tracking technologies might collect an individual's email address, or reason for seeking health care typed or selected by an individual, when the individual visits a regulated entity's webpage and makes an appointment with a health care provider” (HHS).
- Logged-in pages. On patient portals and telehealth platforms, HHS says tracking “generally” has access to PHI, such as “an individual's IP address, medical record number, home or email addresses, dates of appointments” (HHS).
- Booking and form tools. When patients book or fill in a form on another tool, the same question moves to that page. See Calendly vs Acuity for healthcare and Jotform alternatives for healthcare.
Meta's own rule is plain: “When using Meta Pixel and other Meta Business Tools, you must ensure that no prohibited information is shared with Meta. Prohibited information includes health, financial, or children’s data” (Meta).
What HHS says, including the 2024 court order
HHS says regulated entities “are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors,” and that “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). It also says cookie banners don't solve this: “Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization” (HHS).
The page now opens with a note: “On June 20, 2024, the U.S. District Court for the Northern District of Texas issued an order declaring unlawful and vacating a portion of this guidance document.” The vacated part covers tracking that connects an IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers (HHS). See what still applies after AHA v. Becerra. How this applies to your pages depends on what they collect, so talk to your counsel about your own site.
How to see what your site loads
- Run a scan. Curve Compliance's free website scan lists the pixels and trackers on a page.
- Check every template, not just the home page. Service pages, booking and intake pages and thank-you pages often load different tags. The step-by-step version is in website tracker checker steps for health sites.
- Open your tag manager. List each tag in the container and the trigger that fires it. Google describes triggers as what “cause your tag to fire when certain events occur” (Google).
- Check cookies. See which cookies are first-party and which belong to ad platforms with the cookie checker for healthcare websites.
- Write down what each event sends. Event name, page address and parameters, for every event that reaches an ad platform.
Tracking without exposing patients: server-side conversions
Server-side conversion tracking moves the send from the visitor's browser to a server under your control or a vendor you have a BAA with. The server decides which fields leave, so a booking can reach Meta or Google Ads as a neutral event without the form answers. HHS describes this kind of middle step: a vendor that signs a BAA and passes on only de-identified information to vendors “that are unwilling to enter into a BAA with a regulated entity” (HHS).
For the detail, see server-side vs client-side tracking and a HIPAA-compliant Meta Pixel alternative. For apps and patient portals, see HIPAA compliant product analytics for health apps.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and events can use neutral names such as a booked consult. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.
When a patient leaves your site to book in Calendly, Acuity, Jane App or another scheduler, Curve keeps the ad attribution and credits the booking to the original click. Curve also offers consent management, and session replay and heatmaps run under the same BAA. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. Book a call to see what your own pages send today.
Sources, checked November 9, 2026: HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; MDN Third-party cookies and Using HTTP cookies; Meta, About Meta Pixel; Google, Introduction to Tag Manager.
Frequently Asked Questions
What is website tracking?
Website tracking is code on a page, such as a pixel, tag, cookie or session replay script, that records what visitors do and sends it to the site owner or a vendor. HHS defines a tracking technology as “a script or code on a website or mobile app used to gather information about users or their actions” (HHS).
Is web tracking illegal?
Not in itself. HHS says regulated entities may not use tracking “in a manner that would result in impermissible disclosures” of PHI, and a June 20, 2024 court order vacated the part of its guidance about unauthenticated public pages (HHS).
How do I check what tracking is on my website?
Run Curve Compliance's free website scan on your key pages, then follow the website tracker checker steps for booking, intake and thank-you pages.
What is the difference between a pixel and a cookie?
HHS describes a pixel as a tiny image placed on a webpage that lets the owner or a third party collect information about its use, and cookies as “files placed on a user's device to customize a user's browsing experience but can also be used to track a user's activities” (HHS). A pixel sends; a cookie remembers.
Does website tracking need a BAA?
When a tracking vendor receives PHI, HHS says regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors” (HHS). HHS also says a vendor agreeing to strip PHI after it arrives is not enough.
Do cookie banners count as HIPAA authorization?
No. HHS says banners that ask users to accept or reject tracking “do not constitute a valid HIPAA authorization” (HHS).
Can I track who visits my website without PHI?
You can measure visits and bookings without sending PHI to ad platforms: send neutral events from a server with a fixed list of fields, and keep form answers out. Curve Compliance does this under a BAA on every plan and strips PHI before data reaches an ad platform.
Talk to Curve Compliance
Book a call. Want to keep measuring ads without pixels sending patient details? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side with a fixed list of fields, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.