On July 20, 2023, the FTC and the HHS Office for Civil Rights sent a joint letter to approximately 130 hospital systems and telehealth providers warning that tracking technologies, such as the Meta/Facebook pixel and Google Analytics, may disclose sensitive health information to third parties. The agencies said such disclosures could reveal conditions, treatments and where people seek care. The FTC added that companies not covered by HIPAA still must protect health data. For private practices, it was a clear signal to audit website tracking.
By 2023, most private practice websites carried a collection of third-party scripts: analytics, advertising pixels, chat widgets, scheduling tools and heatmaps. Few practices knew exactly what those scripts collected, and fewer had ever checked. Many tags were added years earlier by a former agency, a plugin or a vendor setting up a campaign, and nobody had reviewed them since. On July 20, 2023, two federal agencies made it clear they were paying attention.
The Federal Trade Commission and the Department of Health and Human Services’ Office for Civil Rights sent a joint letter to approximately 130 hospital systems and telehealth providers warning about online tracking technologies. The letters went to large organizations, but the warning applied to anyone running tracking tools on a health website.
This retrospective covers what happened in 2023 and what it means for private practice websites today. It connects to our coverage of the FTC’s 2023 BetterHelp order, AHA v. Becerra in 2024 and Chrome cookies and health tracking in 2025.
What actually happened in 2023
July 20: the joint letter. The FTC announced that it and HHS’s Office for Civil Rights had sent a joint letter to approximately 130 hospital systems and telehealth providers about the risks of tracking technologies integrated into websites and mobile apps. The FTC also published the model letter itself.
The tools named. The agencies pointed to technologies such as the Meta/Facebook pixel and Google Analytics, which gather identifiable information about users, usually without their knowledge and in ways that are hard to avoid.
The concern. The agencies said disclosure could reveal health conditions, diagnoses, medications, treatments, frequency of visits and where an individual seeks care.
The HIPAA backdrop. HHS had issued a bulletin in December 2022 reminding HIPAA-covered entities of their responsibilities around tracking technologies.
Beyond HIPAA. The FTC stated that companies not covered by HIPAA still have a responsibility to protect against unauthorized disclosure of personal health information, even when a third party developed their website or app. It cited its 2023 actions against BetterHelp, GoodRx and Premom, and said unauthorized disclosure may violate the FTC Act and could be a breach under the Health Breach Notification Rule.
Why it mattered for private practices
Private practices were not on the recipient list, but their websites often looked just like the ones that were. Meta pixels on treatment pages. Google Analytics capturing URLs that included condition names. Booking widgets that passed appointment types to ad platforms. Chat tools that recorded whatever visitors typed.
The letters made two things clear. First, regulators considered ordinary marketing tags capable of exposing health information. Second, responsibility sat with the practice, not only with the vendor who built the website or provided the tool. A practice could not rely on an agency’s assurance that tracking was standard. If data was flowing, the practice owned the consequences.
For cash-pay specialties, the FTC’s point about non-HIPAA entities was especially relevant. Many med spas, wellness clinics and some longevity or functional medicine practices are not covered by HIPAA for all activities, but the FTC Act and state laws still apply.
What typical agencies did
Many agencies assumed the letters were a hospital problem and changed nothing. Others removed the Meta pixel but left other tags in place. Some switched to “HIPAA-compliant” tracking vendors without reviewing what those vendors actually did.
The better response was a full tag audit with a clear principle: no health information or identifiers flow to third parties without a lawful basis and appropriate agreements. That audit often took only a few days, and it frequently uncovered tags from old campaigns or former vendors that no one remembered adding.
What it means for a private practice today
The legal details have shifted since 2023, but the core risk remains. These steps keep a practice website in a defensible position.
1. Inventory every script
Use a tag audit tool or a developer to list every script running on the site, including those loaded by plugins, chat tools and scheduling widgets. Hidden tags are common, and some load only on certain pages or after certain actions.
2. Map what each one sends
For each tool, determine what data it collects and where it sends it, especially page URLs, form fields and identifiers. Look at the actual network requests, not only the vendor’s documentation, because configuration changes what is sent.
3. Clean up sensitive pages
Remove advertising pixels from condition pages, treatment pages where sensitive, intake forms, booking flows and patient portals. If ads still need measurement, record only that a conversion happened, without detail about the service.
4. Check URLs and page titles
Analytics often captures page URLs and titles. If they contain condition names or search terms, that information may be transmitted. Neutral URL structures and filtering rules reduce that exposure.
5. Review vendor agreements
Know which vendors will sign appropriate agreements, such as business associate agreements for HIPAA-covered practices, and which will not. A vendor that refuses should not receive sensitive data.
6. Document and revisit
Record the decisions and revisit them whenever the site, tools or laws change. A yearly audit is a sensible minimum.
The 2024 court ruling and what it did not change
In June 2024, a federal court in Texas vacated part of HHS’s tracking guidance, specifically the position that certain tracking on unauthenticated web pages could be a HIPAA disclosure based on a visitor’s identity and the page visited. We covered the case in detail in our AHA v. Becerra retrospective.
That ruling narrowed one part of HIPAA guidance. It did not change the FTC’s authority over deceptive and unfair practices, the Health Breach Notification Rule or state consumer health privacy laws. It also did not address authenticated pages such as patient portals, where HIPAA concerns remain strong. Practices that treated the ruling as permission to restore every pixel misread it, and state laws have continued to expand in the meantime.
Where the risk usually hides
Most practice tracking risk is not in a single obvious pixel. It hides in details. A booking tool that adds the appointment type to a URL. A form plugin that sends field values to an analytics event. A chat widget that records conversations and shares them with a vendor. A site search that puts the visitor’s query in the URL, where analytics captures it.
Each of those can transmit sensitive information without anyone intending it. A careful audit looks at the actual data leaving the browser, not only at the list of installed tools. Browser developer tools or specialized scanners can show exactly what each request contains.
A practical tracking architecture
A defensible setup for many practices looks like this. First-party analytics configured to avoid capturing sensitive URLs, titles or form contents. No advertising pixels on sensitive pages or flows. Conversion tracking that records that a consultation request or call occurred without detail about its content. Server-side or consent-based approaches where appropriate, with careful legal review. And a clear, accurate privacy policy.
That setup gives a practice the measurement it needs to make decisions: which channels bring inquiries, which pages convert and where leads are lost. It just does so without passing health information to companies whose business is advertising. Our custom website service builds practice sites on that principle from the start.
Specialty-by-specialty sensitivity
Some practices face higher sensitivity than others. Behavioral health, addiction treatment, sexual health, fertility, weight loss and men’s health pages reveal particularly sensitive information simply by being visited. Aesthetic pages may seem less sensitive, but some treatments still imply health conditions, and state laws can define consumer health data broadly.
A sensible approach is to treat every practice website as a health website and set conservative defaults. It is easier to relax a cautious setup with good legal advice than to unwind data that has already been shared.
Questions to ask your agency or developer
Many practices rely on an agency or freelance developer for their website and campaigns. After 2023, a few direct questions became essential. Which third-party scripts run on our site, and who added each one? What data does each send, and to whom? Are any advertising pixels running on treatment, condition, intake or booking pages? Does our analytics capture page URLs, titles or search terms that could reveal health information? Which vendors have signed agreements with us, and which have refused?
A capable partner should answer those questions clearly and quickly, ideally with a written inventory. Vague reassurance that “everyone does it” or that a tool is “HIPAA-compliant” without explanation is a warning sign. Compliance depends on how a tool is configured and what agreements exist, not on a vendor’s marketing.
Consent banners are not a cure-all
Some practices responded to tracking concerns by adding cookie consent banners. Consent tools can be useful, and some state laws require certain consent mechanisms. But a banner does not automatically make it acceptable to send health information to advertisers.
The BetterHelp and GoodRx cases centered on sharing health data for advertising in ways the FTC considered deceptive or unfair, and the remedies required affirmative express consent for certain sharing, not a generic banner click. For most practices, the cleaner approach is simply not to send sensitive information to advertising platforms in the first place, then use consent tools for whatever limited tracking remains.
The patient’s point of view
It is worth stepping back from the legal detail. A patient researching a sensitive treatment on a practice website would be uncomfortable to learn that the visit was reported to a social media company and used to show them ads. That discomfort is the heart of the regulators’ concern, and it is also a brand risk.
Premium practices compete on trust. A website that quietly shares visitor behavior with advertisers undermines that trust if it ever comes to light, through a news story, a lawsuit or a curious patient using a privacy tool. Building the website to respect privacy from the start avoids that risk entirely.
What 2023 does not tell us
The agencies did not publish the list of recipients or say how many responded by changing their tracking. We have no reliable data on how many private practices audited their sites after the letters. What 2023 does show is the agencies’ documented concerns, the tools they named and the FTC’s statement that non-HIPAA entities share responsibility for health data.
The premium practice advantage
Premium practices protect patients online as carefully as in person. See our services, who we help, our booking engine and our approach to Google Maps and AI search visibility. Our team works from Austin with practices nationwide.
The bottom line
The July 2023 FTC and HHS letters put health website tracking on notice. Practices that audit their tags, remove pixels from sensitive flows and measure without sharing health data are protecting patients and their own reputation.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What did the FTC and HHS send in July 2023?
A joint letter to approximately 130 hospital systems and telehealth providers about privacy and security risks from online tracking technologies integrated into websites and apps.
Which tracking tools did the agencies mention?
The FTC's announcement named technologies such as the Meta/Facebook pixel and Google Analytics as examples of tools that can track users' online activities.
What information did the agencies worry could be revealed?
Health conditions, diagnoses, medications, treatments, frequency of visits to health care professionals and where an individual seeks treatment.
Does this apply to practices not covered by HIPAA?
The FTC said companies not covered by HIPAA still have a responsibility to protect against unauthorized disclosure of personal health information, even when a third party built their website or app.
What happened to HHS's tracking guidance later?
In 2024, a federal court vacated part of HHS's guidance concerning tracking on certain unauthenticated web pages. FTC authority and state laws were not affected by that ruling.
What should a private practice do about tracking pixels?
Audit every tag on the site, remove advertising pixels from sensitive pages and forms, avoid sending health details to third parties and get qualified privacy advice.