On June 20, 2024, a federal court in the Northern District of Texas ruled in American Hospital Association v. Becerra that one part of HHS's guidance on online tracking technologies exceeded the agency's authority. The court vacated only the rule that an IP address plus a visit to a public health-condition page triggers HIPAA. The rest of the guidance stayed in place, and HHS dropped its appeal in August 2024. Behavioral health websites still need careful tracking choices.
If you run a behavioral health practice, you have probably been told two contradictory things about your website. One person says every analytics tag is a HIPAA violation waiting to happen. Another says a court threw out the government’s tracking rules in 2024, so you can use whatever you want.
Neither is right. What happened in 2024 was more specific than either version, and the details matter a great deal for practices whose patients are seeking help with mental health or substance use.
This retrospective covers the ruling, what it left in place, a major enforcement action from the same year, and what a behavioral health website should do now. It is marketing guidance, not legal advice. Privacy law is complex and fact-specific; get qualified counsel for your situation.
What actually happened in 2024
The background. In December 2022, the HHS Office for Civil Rights issued a bulletin on how HIPAA applies to online tracking technologies such as analytics tags and advertising pixels. HHS revised it on March 18, 2024. Among other things, the bulletin said HIPAA obligations could be triggered when tracking technology connects a visitor’s IP address with a visit to a public webpage about specific health conditions or providers. The court later called this the “Proscribed Combination.”
The lawsuit. The American Hospital Association, the Texas Hospital Association and two Texas health systems sued HHS in late 2023. They argued that the Proscribed Combination prevented hospitals from using standard web tools on public pages and went beyond what HIPAA allows.
The ruling. On June 20, 2024, Judge Mark T. Pittman of the Northern District of Texas agreed. The opinion and order declared the Proscribed Combination unlawful and vacated it. The final judgment was explicit that nothing in the ruling limited the rest of the revised bulletin.
The guidance page. HHS updated its online tracking guidance with a note describing exactly which portion the court vacated.
No appeal. The AHA reported that HHS withdrew its notice of appeal on August 29, 2024, making the ruling final.
The FTC in the same year. On April 15, 2024, the FTC announced a proposed order against telehealth company Cerebral, a mental health provider. The FTC alleged Cerebral gave sensitive information of nearly 3.2 million consumers to third parties such as LinkedIn, Snapchat and TikTok through tracking tools on its website and apps. The order banned it from using or disclosing personal and health information for most advertising purposes and required payments of more than $7 million.
What the ruling did and did not change
The ruling was narrow. It addressed one scenario: a tracking tool on a public page, with no login, linking a visitor’s IP address to a visit about a health condition or provider. The court said that combination alone is not protected health information under HIPAA.
It did not address tracking on authenticated pages, such as patient portals, intake forms behind a login, or telehealth platforms. It did not address what happens when a public page collects more than an IP address, such as a name, phone number or reason for visit entered into a form. It did not change the FTC Act, the FTC’s Health Breach Notification Rule, or state laws. And it did not change how patients feel when they learn their visit to a therapy page was shared with an advertising platform.
That last point matters most in behavioral health. A visitor reading a page about addiction treatment, eating disorders or trauma therapy is often in a vulnerable moment. Even when a practice is technically within the law, sharing that visit with ad platforms can damage trust in a way that is very hard to repair.
Why behavioral health is different
Most medical marketing involves services a patient is comfortable discussing. Behavioral health often does not. Many patients research quietly, on personal devices, sometimes over weeks before they reach out. They expect discretion from the first click.
The Cerebral case showed what regulators focus on in this space. The FTC’s complaint was not only about tracking pixels. It was about sensitive data shared with third parties for advertising, in ways the company’s privacy statements did not make clear to users. A small behavioral health practice is not a national telehealth company, but the same principle applies: what you promise patients about privacy has to match what your website actually does.
Federal rules for substance use disorder records add another layer. Programs covered by 42 CFR Part 2 already work under stricter confidentiality rules than HIPAA alone, and that culture of discretion should extend to how their websites handle visitor data.
What typical agencies did
When the ruling came out, some agencies told behavioral health clients that tracking was back on and reinstalled every pixel they had removed. That overread the decision. The court vacated one scenario, not the whole framework, and it said nothing about the FTC or state law.
Other agencies had never removed anything in the first place. Their behavioral health clients’ websites were still sending detailed page views, form events and button clicks to advertising platforms, sometimes including the names of conditions in the page addresses.
Few agencies did the useful middle work: mapping exactly what each page collects, where it goes, and whether that flow could be defended to a patient, a regulator or a reporter.
What it means for a behavioral health practice today
The goal is a website that markets effectively and that you would be comfortable explaining to any patient. This is marketing guidance, not legal advice; have counsel review your setup.
1. Map every tool and what it sends
List every analytics tag, pixel, chat tool, scheduling widget and form tool. Note which pages it runs on and what data it sends to whom. You cannot defend what you have not mapped.
2. Keep advertising pixels off sensitive pages
Pages about specific conditions, intake forms, assessments and appointment requests deserve the most caution. Many practices remove advertising pixels from these pages entirely.
3. Check page addresses and event names
A page address or event name containing a condition can reveal sensitive information on its own. Use neutral naming where data leaves your site.
4. Move intake behind secure, compliant tools
Use form and scheduling vendors that will sign a business associate agreement where HIPAA applies, and keep sensitive questions out of general contact forms.
5. Make your privacy notice match reality
Your website’s privacy statements should describe what you actually do. The Cerebral case turned on the gap between promises and practice.
6. Measure with privacy-conscious methods
Track calls and booked intakes in your own systems. You can learn which channels work without sending sensitive visit data to ad platforms. Our behavioral health marketing approach is built around this.
Marketing behavioral health without oversharing
Privacy-conscious marketing is not weaker marketing. Behavioral health patients choose providers based on trust, fit and access. Those are things you can communicate clearly without tracking every visitor.
Strong pages that explain your approach, your clinicians, the conditions you treat, insurance and payment options, and what the first appointment involves do much of the work. A Google Business Profile with accurate hours, genuine reviews where appropriate and clear contact options captures local demand. Fast, warm call handling turns that demand into intakes. We cover the call side in call handling and lead leakage.
Measurement can stay inside your walls. Call tracking that records the source without recording sensitive content, intake forms that log a referral channel, and a simple monthly review of booked intakes by source give a practice the answers it needs without broadcasting who visited which page.
A quick self-check for practice owners
You do not need to be technical to start. Open your website on your own phone and visit a page about a specific condition you treat. Then ask your web team a few direct questions.
Which outside companies received data from that visit? If the answer includes advertising platforms, ask why that page needs them.
Does any page address include a condition name that is sent to a third party? Neutral page and event naming is a simple fix.
Where do contact form submissions go? Ask which vendors receive them, and whether those vendors have signed agreements where required.
Does our privacy notice describe what we found? If not, one of them needs to change, and it is usually the website.
These questions take an hour to answer and can prevent a problem that takes years to repair.
Common misreadings of the ruling
“The court said tracking is fine.” It did not. The court addressed one specific combination on public pages under HIPAA. It did not bless any particular tool or practice.
“HIPAA is the only law that matters.” For many websites, the FTC Act and state laws may matter as much. The Cerebral order was an FTC action, not a HIPAA case.
“Public pages are always safe now.” A public page can still collect sensitive information, for example through a form, a chat tool or a symptom quiz. What a page collects matters as much as whether it requires a login.
“Small practices are not a target.” Enforcement priorities change, and private lawsuits over website tracking have been filed against healthcare organizations of many sizes. Planning on being overlooked is not a strategy.
“We removed the pixel, so we are done.” Tools get re-added during redesigns, plugin updates and new campaigns. A tracking review should be repeated whenever the website changes, not done once and forgotten.
What 2024 does not tell us
The ruling resolved one question about HIPAA and public webpages, but it did not settle every tracking scenario, and courts in other cases may look at related issues differently. We do not have reliable public data on how many behavioral health websites share sensitive visit data with advertisers. State consumer health privacy laws, FTC enforcement priorities and future HHS guidance all continue to change. Whether a given law applies to your practice depends on your specific facts, so rely on qualified advice rather than general articles, including this one.
The premium practice advantage
In behavioral health, discretion is part of the service. A practice whose website treats visitor privacy with the same care as the therapy room is demonstrating its values before the first call.
Competitors who load every pixel available may get slightly more ad data. They also carry more risk and send a quieter message about how they handle trust. See our services, who we help, and how we support Google Maps and AI search visibility without oversharing. Our team works from Austin with practices nationwide.
The bottom line
AHA v. Becerra narrowed one piece of HHS’s tracking guidance in June 2024. It did not make behavioral health tracking risk-free, and the FTC’s Cerebral order the same year showed how seriously regulators treat sensitive data shared for advertising. Map your tools, protect sensitive pages, and market on trust.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What did the court decide in AHA v. Becerra?
On June 20, 2024, Judge Mark Pittman declared unlawful and vacated the part of HHS's online tracking guidance that treated the combination of an IP address and a visit to an unauthenticated public webpage about specific health conditions or providers as protected health information. The court said HHS exceeded its authority under HIPAA.
Did the ruling throw out all of HHS's tracking guidance?
No. The final judgment said nothing in the ruling limits the legal operability of anything else in HHS's March 18, 2024 revised bulletin. Tracking on patient portals, appointment scheduling behind logins and other authenticated pages remained covered by the guidance.
Did HHS appeal?
HHS initially filed a notice of appeal, then withdrew it. The American Hospital Association reported that HHS officially withdrew its appeal on August 29, 2024, making the district court ruling final.
Why does this matter more for behavioral health?
Behavioral health information is among the most sensitive health data. Even where HIPAA does not apply to a specific page, other laws such as the FTC Act and state privacy and consumer health laws can apply, and the reputational harm of a privacy incident is severe.
What happened with Cerebral in 2024?
On April 15, 2024, the FTC announced a proposed order against telehealth firm Cerebral. The FTC alleged it shared sensitive information of nearly 3.2 million consumers with third parties through tracking tools. The order banned it from using or disclosing health information for most advertising purposes and required payments of more than $7 million.
Is this legal advice?
No. This is marketing guidance. Whether HIPAA, the FTC Act or state laws apply to a specific page or tool depends on your circumstances. Have qualified counsel review your website tracking.