HIPAA and your marketing stack: pixels, analytics, and ads for telehealth brands

Why the default stack is a problem

A pixel is code that sends what a visitor does — URLs, button clicks, form fields, sometimes everything — to the platform that served the ad. On a sneaker store that is harmless. On a telehealth funnel, the URL alone (/intake/glp1-weight-loss/step-3) plus the platform’s identifiers equals “this identifiable person is seeking weight-loss treatment” — which is protected health information when a covered entity or its vendor transmits it, and “health data” under the FTC’s and several states’ regimes regardless.

This is not theoretical. OCR issued guidance on online tracking by HIPAA-regulated entities; the FTC reached settlements with GoodRx and BetterHelp over sharing health data with advertising platforms; and hundreds of pixel class actions have followed hospital systems and DTC brands alike. Reviewers at LegitScript now look for analytics on pages that collect health information.

The map: what can run where

Building the compliant funnel

1. Split at the intake door. Marketing site and clinical funnel on separate surfaces (or at minimum separate tag configurations), so the ad stack physically cannot see past the door.
2. First-party measurement inside. Your own analytics, your own event stream, under your control and your BAAs where vendors touch it.
3. Server-side conversions, stripped. Send the platforms a purchase/lead event with click ID and value — no condition, no product name, no dosage. You keep optimization; they don’t get diagnoses.
4. Audit the tag manager quarterly. Pixels accrete. Someone’s A/B tool from last year is someone else’s lawsuit.
5. Mind retargeting lists. Building an audience of “people who started the TRT intake” is exactly the disclosure the enforcement actions describe. Retarget from marketing-page behavior only.
6. Write it down. A data map of what each tool receives, on which pages, under which agreement — the artifact every reviewer, auditor, and acquirer asks for.

Already running pixels? Remediate in this order

Most funnels were assembled before anyone drew the map above, so finding tags in the wrong zone is common — and discovery is routine, because plaintiff firms run the same scanners you do. The order of operations matters:

1. Inventory before you touch anything. Pull the tag manager and every hardcoded script, page by page — you cannot assess what you have not mapped, and the inventory itself becomes the compliance artifact.
2. Stop the bleeding. Remove third-party tags from intake, checkout, portal, and scheduling the same week. This is configuration, not engineering, and every day they run extends the lookback.
3. Assess the lookback with counsel. What was sent, to whom, for how long, and whether it triggers breach-notification duties under HIPAA or the FTC’s rule is a legal call, not a marketing one. Bring the inventory, not a guess.
4. Rebuild measurement deliberately. Stand up first-party analytics inside the funnel and stripped server-side conversions before the growth team feels the attribution loss and quietly re-adds the pixel.
5. Add a gate. New tags go through a review that asks two questions — what does it receive, and on which pages — before anything ships. That gate is the difference between a remediation and a cycle.

The upside of doing it right

Constraint breeds advantage here: brands forced off third-party pixels build first-party funnels with cleaner attribution, own their data outright, and sail through diligence. And the failure mode for getting it wrong is not just fines — it is losing the ad account and the certification that paid acquisition depends on, mid-growth.

Frequently asked questions