Skip to content
Teeth ShakersDental Practice Marketing Get the newsletter

HIPAA and Patient Privacy in Marketing · Chapter 5 of 6

Website tracking and ad pixels

Quinn GoodmanBy Dental marketing strategist

Most dental websites run tracking code: an analytics tag, ad pixels from Google or Meta, a chat widget, a booking tool, a call-tracking script. Each one can send information about what a visitor does to the company that provides it. On a healthcare website, that can include information that links a person to your practice.

Why it matters

A pixel on an ordinary page may record that a browser visited your site. On a booking page, a contact form or a patient portal, the same pixel may send the platform details such as the page address, the button clicked, the appointment type chosen or even what was typed into a form, along with identifiers like an IP address or a logged-in account. That can amount to disclosing protected health information to a company that has no business associate agreement with you.

What HHS has said

HHS, which enforces HIPAA, has published guidance on the use of online tracking technologies by HIPAA-covered entities. It explains how tracking on websites, apps and patient portals can disclose PHI. Part of that guidance was challenged in court and a federal court set aside a portion of it, so the exact line, particularly for public pages that don’t require a login, is unsettled. Check the current version of the guidance with your healthcare attorney rather than relying on a summary. What hasn’t changed is that pages where patients log in, book or submit information are the highest-risk places for tracking. Some state privacy laws also reach website data that HIPAA may not.

Practical steps

  1. Make a list of every tag on the site. Ask whoever manages the website and any agency to name every script, pixel and widget, what it sends and who added it. Old agencies often leave tags behind.
  2. Keep ad pixels off booking, forms, patient portal and payment pages unless your attorney has approved the specific setup.
  3. Check the vendors on patient-facing pages. Analytics, chat, form and booking tools that receive patient information should sign a business associate agreement. If a vendor won’t, remove it from those pages or replace it.
  4. Turn off extras you don’t need, such as session recording, automatic form-field capture and advanced matching features that send contact details back to the platform.
  5. Test what actually fires. Have your web developer check key pages with browser developer tools or a tag inspection tool at least once a quarter and after every website or plugin change.
  6. Keep forms free of health details. See online booking and forms.

How this affects ad measurement and remarketing is covered in the paid ads guide’s ad policies, privacy and board rules chapter.

Frequently asked questions

Can a dental website use the Meta pixel?
Not on pages where patients book, fill in forms, log into a portal or pay, unless your healthcare attorney has approved the setup. HHS has published guidance on tracking technologies for HIPAA-covered entities, and part of it was set aside by a federal court, so check the current version with your attorney.
Is Google Analytics HIPAA compliant for dentists?
It depends on where it runs and what it sends. Analytics and other vendors that receive patient information should sign a business associate agreement; if a vendor will not, remove it from booking, form and portal pages, and test what fires on key pages regularly.