On December 1, 2022, the HHS Office for Civil Rights issued a bulletin on the use of online tracking technologies by HIPAA-covered entities and business associates. It said these entities may not use tracking tools in ways that result in impermissible disclosures of protected health information to tracking vendors. HHS revised the bulletin on March 18, 2024, and on June 20, 2024, a federal court vacated part of it in AHA v. Becerra. For behavioral health practices, tracking on portals, intake and booking flows still requires careful review.
Behavioral health practices hold some of the most sensitive information in healthcare. The fact that a person is seeking therapy, psychiatric care or substance use treatment can affect their employment, relationships and sense of safety. That sensitivity extends to the practice’s website, where people often take their first private step toward care.
In 2022, federal regulators addressed how that first step could be exposed. Months after reporting showed the Meta Pixel sending appointment data from hospital websites to Facebook, the HHS Office for Civil Rights issued a bulletin on online tracking technologies. It became one of the most debated pieces of HIPAA guidance in years.
This retrospective covers what HHS said in 2022, what changed afterward and what it means for a behavioral health practice today. For context, see the 2022 Meta Pixel hospital findings, the FTC and HHS warning letters of 2023, the FTC’s BetterHelp order and AHA v. Becerra in 2024.
What actually happened in 2022
December 1: the bulletin. The HHS Office for Civil Rights issued a bulletin titled Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
The central rule. The bulletin said regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of protected health information to tracking technology vendors or any other violations of the HIPAA Rules.
Websites and apps. It addressed tracking on user-authenticated pages such as patient portals, on unauthenticated public pages and within mobile apps, explaining where HHS believed protected health information could be involved.
Vendors and agreements. It explained that if a tracking vendor receives protected health information on behalf of a regulated entity, HIPAA requirements such as business associate agreements apply, and that disclosures for marketing generally require patient authorization.
What came after. HHS revised the bulletin on March 18, 2024. On June 20, 2024, a federal district court in AHA v. Becerra vacated the portion addressing certain tracking on unauthenticated public pages. The broader HIPAA obligations remained.
Why it mattered for behavioral health practices
Behavioral health websites often carry tools that reveal more than a practice realizes. A booking widget might record which service a visitor selected, such as substance use treatment or psychiatric medication management. An intake form might capture symptoms. A patient portal might show appointment and billing details. If a tracking script runs on those pages, it may send information about the visitor to a third party.
For many behavioral health practices covered by HIPAA, the bulletin made clear that those flows needed scrutiny. It also explained why: the combination of identifying information and health information is what HIPAA protects, and tracking vendors were often not set up to handle it.
The stakes were not only legal. For a person seeking behavioral health care, discovering that their search for help had been shared with an advertising platform could damage trust in the practice and in care generally.
What typical agencies did
Some agencies did nothing, reasoning that guidance was not law. Others removed every tracking tag in a panic, leaving practices with no measurement. Few took the time to map which pages and flows carried real risk and adjust accordingly.
When the court vacated part of the bulletin in 2024, some agencies told clients tracking concerns were over. That was not accurate. The vacated portion was narrow, and tracking on authenticated pages, intake and booking flows still raised the same HIPAA questions. State health privacy laws and FTC enforcement also continued.
What it means for a behavioral health practice today
The legal landscape has changed since 2022, but these steps remain sound. Confirm specifics with a healthcare privacy attorney.
1. Map your sensitive flows
Identify the patient portal, intake forms, booking pages, contact forms and any page where visitors disclose health information.
2. Remove ad tracking from those flows
Do not run advertising pixels on authenticated or sensitive pages unless a documented legal review supports it.
3. Review vendor agreements
Confirm whether vendors who may receive patient information have signed business associate agreements where required.
4. Check apps and widgets
Mobile apps, chat tools, scheduling widgets and telehealth platforms may carry their own tracking. Ask each vendor.
5. Follow state law too
Several states regulate consumer health data beyond HIPAA, and some apply to practices regardless of HIPAA status.
6. Keep records
Document what tools run where, who approved them and when they were last reviewed.
Why public pages were debated
The most contested part of the 2022 bulletin concerned unauthenticated public pages, the ones anyone can visit without logging in. HHS explained that tracking on some of these pages could involve protected health information, for example when a page addressed specific symptoms or conditions or allowed a visitor to search for care, and the tracking captured identifying details such as an IP address.
Hospital groups argued that this approach swept too broadly, since many visitors to public health pages are not patients at all and may be researching for a relative, a class or simple curiosity. The American Hospital Association and others challenged the guidance in court. In June 2024, the court in AHA v. Becerra agreed that HHS had exceeded its authority on the specific combination of identifying information and visits to public pages, and vacated that portion.
For behavioral health practices, the debate should not obscure the practical question. Even where federal law does not reach a public page, a patient who learns that their visit to an addiction treatment page was shared with an ad platform is unlikely to care about the legal distinction. State laws may also apply. A cautious approach to tracking on condition pages remains sensible.
Authenticated pages are the clearest risk
The part of the bulletin addressing user-authenticated pages was not vacated. Patient portals and similar logged-in areas generally have access to protected health information, and tracking technologies on those pages can capture it. The bulletin explained this clearly in 2022, and the guidance on authenticated pages remained relevant after the court’s decision.
For a behavioral health practice, a portal may show appointment types, clinician names, billing details and messages. None of that should reach an advertising platform. If a portal is provided by an electronic health record vendor, the practice should confirm what third-party scripts, if any, the vendor permits and what data they collect.
Intake and booking forms
Forms are where visitors tell a practice what they need. Even a short contact form might ask what brings a person in. Booking widgets often ask the visitor to choose a service or clinician. If a tracking tool records form fields, button labels or page addresses that include those choices, the information may leave the practice’s control.
The fix is usually straightforward: keep advertising tracking off these pages, configure analytics to avoid collecting sensitive fields, and test each form to confirm what leaves the site. For practices with many forms or vendors, a structured audit is worth the time.
Telehealth and mobile apps
Many behavioral health practices expanded telehealth after 2020, and some use mobile apps for scheduling, messaging or therapy exercises. The 2022 bulletin addressed mobile apps directly, explaining that apps offered by regulated entities can collect information such as device identifiers and health data, and that the same HIPAA rules apply to disclosures from those apps.
A practice using a third-party telehealth or scheduling platform should ask what analytics and advertising software development kits the app includes and what data they transmit. Vendors serving healthcare often offer configurations designed for privacy, but defaults vary. Getting written answers and keeping them on file is part of responsible vendor management.
The same diligence applies to email and text tools. Appointment reminders, newsletters and marketing messages can carry tracking links and open pixels. Messages that reference a specific service or clinician combine identity with health context, so the safest approach is to keep reminders generic and to review what each messaging platform records about recipients.
Questions to ask every vendor
A short, consistent set of questions makes vendor reviews faster and more reliable. Does your product include any third-party tracking, analytics or advertising code? What data does it collect from patients or visitors, and where is it sent? Can tracking be disabled or limited, and what is the default? Will you sign a business associate agreement if our use requires one? How do you notify customers when tracking behavior changes?
Written answers to those questions, kept with the contract, give a practice a clear record of what it was told. They also make it easier to compare vendors when choosing a new booking, portal or telehealth tool, since privacy becomes one of the stated selection criteria rather than an afterthought discovered later.
Measuring growth responsibly
Behavioral health practices still need to understand where new patients come from. Aggregate measurement without sharing patient information is possible. Ask new patients how they found the practice. Count consultation requests by channel internally. Use analytics configured to avoid sensitive data, potentially hosted on infrastructure the practice controls. Measure advertising on outcomes that do not reveal health details.
These approaches provide enough information to make good decisions about marketing budgets without placing patients’ privacy at risk. They are also easier to explain to patients who ask how their information is used, and they hold up better when platforms or laws change again.
Trust as a clinical asset
In behavioral health, trust is part of care. A patient who doubts the privacy of their information may withhold details, delay treatment or not return. A website that respects privacy supports the clinical relationship before it begins.
That makes a clear, accurate privacy notice and a careful approach to tracking more than compliance tasks. They are part of how a practice shows prospective patients it is safe to reach out.
What 2022 does not tell us
The 2022 bulletin was guidance, and parts of it did not survive legal challenge. It does not define every situation in which tracking is permitted or prohibited, and we cannot say how widely practices followed it. Current obligations depend on HIPAA status, state law and the specific tools involved, which is why individual legal advice matters. What 2022 established is that federal regulators considered tracking on healthcare websites a serious privacy issue.
The premium practice advantage
A premium behavioral health practice protects privacy as carefully online as in session. See our behavioral health services, our custom websites, our booking engine, our full services, who we help and how we approach Google Maps and AI search visibility. Our team works from Austin with practices nationwide.
The bottom line
In December 2022, HHS told HIPAA-covered entities they could not use tracking tools in ways that disclosed protected health information to vendors. Parts were later revised and vacated, but for behavioral health practices, keeping tracking out of sensitive flows remains essential.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What was the HHS tracking bulletin?
Guidance issued by the HHS Office for Civil Rights on December 1, 2022, explaining how HIPAA rules apply to online tracking technologies used by covered entities and business associates on websites and mobile apps.
What was its central point?
That regulated entities may not use tracking technologies in a way that results in impermissible disclosures of protected health information to tracking technology vendors.
Is the 2022 bulletin still in effect?
Not in its original form. HHS revised it on March 18, 2024, and on June 20, 2024, a federal court vacated part of it in AHA v. Becerra. Other HIPAA obligations were not removed.
Which part did the court vacate?
The portion that treated certain tracking on unauthenticated public web pages as a disclosure of protected health information based on a combination of a visitor's identifying information and the page visited.
Why does this matter to behavioral health practices?
Behavioral health information is among the most sensitive kinds of health data. Portals, intake forms and booking flows can reveal that a person is seeking mental health or substance use care.
What should a practice do now?
Review tracking on authenticated and sensitive pages, check vendor agreements and get advice from a healthcare privacy attorney on current obligations.