On June 16, 2022, The Markup reported that it tested the websites of Newsweek's top 100 US hospitals and found the Meta Pixel on 33 of them sending Facebook data when a person clicked to schedule an appointment, connected to an IP address. It also found the pixel inside the patient portals of seven health systems. Experts said some of this sharing may have violated HIPAA. For men's health clinics, it showed how tracking tools on booking pages can expose sensitive health interests.
Men’s health clinics often deal with subjects patients are reluctant to discuss even with friends: testosterone, erectile function, fertility, hair loss, weight and energy. Many patients choose a specialized clinic precisely because it feels discreet. They book online at night, fill out forms privately and expect the details to stay between them and their clinician.
In June 2022, an investigation showed how easily that expectation could be broken by ordinary marketing software. The Markup reported that the Meta Pixel, a common advertising tracking tool, was sending Facebook data from the appointment pages of many top US hospitals. The hospitals were not men’s health clinics, but the mechanism was the same one used on countless practice websites.
This retrospective covers what The Markup actually reported in 2022 and what it means for a men’s health clinic today. For the regulatory chapters that followed, see the HHS tracking technologies bulletin of 2022, the FTC and HHS warning letters of 2023 and AHA v. Becerra in 2024.
What actually happened in 2022
June 16: the investigation. The Markup, in a story co-published with STAT, reported that a tracking tool installed on many hospital websites had been collecting sensitive health information and sending it to Facebook.
33 of the top 100. The Markup tested the websites of Newsweek’s top 100 hospitals in America. On 33 of them, it found the Meta Pixel sending Facebook a packet of data whenever a person clicked a button to schedule a doctor’s appointment. The data was connected to an IP address, which can generally be linked to an individual or household.
Specific details. In examples documented by The Markup, clicking to schedule sent Facebook the button text, the doctor’s name and, in some cases, the search term or condition the visitor had entered or selected.
Inside patient portals. The Markup also found the Meta Pixel inside the password-protected patient portals of seven health systems, and on five of them documented data about real volunteer patients being sent, including medication names and appointment details.
Expert concern. Former regulators and privacy experts who reviewed the findings told The Markup the hospitals may have violated HIPAA, which generally prohibits covered entities from sharing identifiable health information with third parties without authorization or appropriate contracts. Some hospitals removed the pixel after being contacted.
What followed. In December 2022, the HHS Office for Civil Rights issued a bulletin on the use of online tracking technologies by HIPAA-covered entities, citing the risk of impermissible disclosures.
Why it mattered for men’s health clinics
A men’s health clinic’s website is a map of sensitive interests. Pages for testosterone replacement, erectile dysfunction treatment, peptide therapy, hair restoration and medical weight loss each reveal something about a visitor who reads them and, especially, who books from them. If a tracking pixel fires when someone requests an appointment for a specific service, the clinic may be telling an advertising platform about that person’s health interest.
Many clinics installed pixels for ordinary reasons: to measure ad campaigns and build retargeting audiences. They often did so through templates, plugins or booking tools that added tracking by default. Few had reviewed exactly what was being sent.
The Markup’s findings made the risk concrete. If the most sophisticated hospital systems were sending appointment details to an ad platform, smaller clinics with less oversight were unlikely to be immune.
What typical agencies did
Many agencies treated the story as a hospital problem. Their clinic clients were not on Newsweek’s list, so pixels stayed in place, sometimes on every page including booking and intake. Some argued that because a clinic did not bill insurance, health privacy rules did not apply, without checking the clinic’s actual obligations or the growing number of state health privacy laws.
Others removed tracking entirely and lost all measurement, then struggled to judge whether any marketing worked. Without data, budgets drifted toward whichever vendor sounded most confident rather than whichever channel actually brought patients.
The more careful approach audited what each script sent, removed tracking from sensitive pages and flows, and rebuilt measurement in ways that did not share health information with advertising platforms.
What it means for a men’s health clinic today
Health privacy rules and enforcement have evolved since 2022. These steps reduce risk while keeping useful measurement.
1. Inventory every tracking tool
List each pixel, tag, analytics script and widget on your site, who owns it and what data it collects.
2. Keep sensitive pages clean
Do not run advertising pixels on booking, intake, contact, patient portal or condition-specific service pages without a documented legal review.
3. Check booking and chat vendors
Third-party booking engines and chat tools may add their own tracking. Ask vendors what they collect and share.
4. Get qualified legal advice
HIPAA status and state health privacy laws vary by clinic. A healthcare privacy attorney can assess your obligations.
5. Use privacy-safe measurement
Measure aggregate outcomes such as total consultations by channel without sending health details to ad platforms.
6. Update your privacy notice
Make sure your privacy notice accurately describes what your site collects and shares.
How tracking reaches booking pages
Few clinics deliberately send appointment details to an ad platform. It usually happens through layers. A website template includes a tag manager. The tag manager fires the pixel on every page. The pixel records page views and button clicks automatically, capturing text such as a button label or URL. A booking widget passes service names in its address. Together, those layers can reveal that a specific visitor requested an appointment for a specific service.
Automatic event detection deserves particular attention. Some pixels can identify clicks and form actions without anyone configuring them, and some booking and form tools add their own integrations. A clinic may have no idea these events exist until someone inspects the network traffic.
Inspecting that traffic is not difficult. A developer can open a booking page in a browser’s developer tools, complete a test booking and watch which requests leave the page and what they contain. Doing this for each important flow, and repeating it after any significant site change, turns an invisible risk into a documented one that can be managed.
State laws widen the picture
HIPAA is not the only consideration. Many men’s health clinics operate on a cash-pay basis, and their HIPAA status depends on their specific circumstances. But state laws have expanded since 2022. Washington’s My Health My Data Act and laws in other states regulate consumer health data more broadly, and the FTC has brought cases involving health information shared through tracking tools by companies outside HIPAA.
The practical conclusion is that a clinic should not assume it is outside the rules because it does not bill insurance. Sensitive health interests deserve protection either way, and the legal exposure can arise from several directions.
Multi-state operation complicates matters further. A men’s health clinic offering telehealth to patients in several states may be subject to the privacy laws of each, which can differ in what counts as health data, what consent is required and what rights patients have. A single cautious standard applied everywhere is usually simpler and safer than tailoring tracking state by state.
Measurement without exposure
Clinics still need to know which marketing works. The answer is to measure in ways that do not reveal health interests to third parties. Aggregate reporting, such as how many consultation requests came from each channel this month, can be gathered internally. Analytics tools can be configured to avoid collecting sensitive details, and some can run on servers the clinic controls. Asking new patients how they found the clinic provides valuable data without any tracking at all.
Advertising platforms can still be used, with care. Campaigns can be measured on outcomes that do not reveal specific services, and conversion data can be stripped of health details before it leaves the clinic’s systems. Each approach should be reviewed by someone who understands both the technology and the law.
A simple quarterly privacy review
Privacy problems on websites rarely come from a single bad decision. They accumulate as tools are added, campaigns launch and vendors update their code. A short, regular review catches them before they become serious.
A practical quarterly review has five steps. First, export the list of tags from the tag manager and compare it with the approved inventory, removing anything unexplained. Second, run test bookings and form submissions on the most sensitive flows while watching network requests, and confirm nothing health-related leaves the site for an advertising platform. Third, check each third-party vendor’s current settings, since defaults can change. Fourth, confirm the privacy notice still matches reality. Fifth, record the date, the person responsible and any changes made.
The review takes a few hours for most clinic websites. It also produces a record that demonstrates diligence if questions ever arise from a patient, a regulator or a partner. For a clinic whose patients value discretion, that record is part of how the practice keeps its word.
Discretion as a brand promise
For a premium men’s health clinic, discretion is part of the value. Patients choose the clinic in part because it feels private and professional. A clinic that can say, and prove, that its website does not share patients’ health interests with advertising platforms is offering something many competitors cannot.
That promise extends beyond the website. Appointment reminders that avoid naming the service, billing descriptors that do not reveal treatment, and email marketing that respects consent all reinforce the same message: the clinic takes privacy seriously.
Staff habits matter too. Front desk scripts that confirm appointments without naming services, voicemail messages that stay general and a clear rule about never discussing a patient’s care in public spaces show patients that discretion is a practice, not a slogan on the website.
What 2022 does not tell us
The Markup studied hospital websites and health system portals, not men’s health clinics. Its findings do not tell us how common the same problems were among smaller clinics, and we have no public data measuring that. They also did not determine legal violations. What 2022 does show is how ordinary tracking tools can expose sensitive health information when no one checks what they send.
The premium practice advantage
A premium men’s health clinic earns trust through discretion as much as expertise. See our men’s health services, our men’s health clinic marketing guide, our custom websites, our full services, who we help and how we approach Google Maps and AI search visibility. Our team works from Austin with practices nationwide.
The bottom line
In June 2022, The Markup found the Meta Pixel sending appointment data from 33 of the top 100 hospital websites. For men’s health clinics, it was a clear signal to audit tracking, keep sensitive pages clean and measure marketing without exposing patients’ health interests.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What did The Markup find in June 2022?
It tested the websites of Newsweek's top 100 US hospitals and found the Meta Pixel on 33 of them sending Facebook data whenever a person clicked a button to schedule a doctor's appointment.
What kind of data was sent?
In examples The Markup documented, the data included the button text, the doctor's name and search terms or conditions selected, connected to the visitor's IP address.
Were patient portals affected?
The Markup reported finding the Meta Pixel inside the password-protected patient portals of seven health systems.
Did the findings mean the hospitals broke the law?
The Markup reported that former regulators and privacy experts said some hospitals may have violated HIPAA. It did not establish violations, and hospitals responded differently.
Why does this matter to men's health clinics?
Clinics offering testosterone therapy, sexual health, hair restoration or weight care handle sensitive interests. A tracking tool on a booking page can reveal that someone sought those services.
What should a clinic check first?
Which third-party scripts run on its booking, intake, contact and service pages, and exactly what data each sends.