HIPAA Compliant Website: Pixels, Forms, and Portals

The U.S. Department of Health and Human Services (HHS) describes tracking technology as code that gathers information about website or app users and their activities. Its guidance distinguishes between public webpages, pages that collect health information, and authenticated patient environments. Those distinctions matter because HIPAA obligations depend on the information involved, the organization handling it, and whether protected health information (PHI) reaches outside vendors.

Public Pages

A telehealth website usually begins with pages anyone can access without signing in. These may include the homepage, blog articles, pricing information, service descriptions, and condition-specific landing pages.

Such pages often use analytics to understand website performance and visitor behavior. A brand might measure page views, navigation patterns, or interactions with general website content.

HHS guidance on online tracking technologies explains that tracking tools on many unauthenticated public webpages do not access PHI. When the information collected does not involve PHI, HIPAA does not regulate that tracking activity.

For example, collecting information about visits to a hospital's public employment page generally does not involve disclosure of an individual's health information.

However, a public webpage is not automatically outside HIPAA merely because visitors do not log in.

Public Does Not Always Mean Unregulated

A condition-specific landing page may attract people researching healthcare options, but the relationship between website activity and identifiable health information requires careful examination.

The June 2024 federal court ruling limited part of HHS's earlier interpretation involving visits to unauthenticated webpages. Under that ruling, connecting an IP address to a visit to a public page about a health condition or provider is not, by itself, sufficient to trigger HIPAA obligations.

That does not mean every tracking configuration on a public healthcare website is permissible.

A page may collect additional information through forms, embedded tools, or user interactions. Once tracking technologies access identifiable information about someone seeking care, the analysis can change.

For telehealth marketing teams, the practical priority is understanding what to measure without collecting information beyond what's needed for measurement.

You can often evaluate general website engagement without exposing patient identities, diagnoses, medication interests, or other sensitive details to advertising vendors.

The distinction matters more when visitors move from browsing public information to sharing health details.

Pages That Ask About Health

Some of the most sensitive pages on a telehealth website do not require a patient account.

A visitor might complete a symptom questionnaire, answer eligibility questions, book a consultation, or begin registration before receiving login credentials.

These experiences may look like ordinary website forms, but they can collect information directly related to a person's health or intended medical care.

HHS explains that tracking technologies on unauthenticated pages may access PHI when visitors provide identifiable information connected to healthcare services.

For example, a booking form might collect an email address alongside the reason someone is seeking treatment. A symptom checker could collect responses describing a health concern and connect them to identifying information.

If tracking technology captures and transmits that information to an outside vendor, HIPAA may apply.

Symptom and Eligibility Questionnaires

A telehealth intake process may ask patients about medical history, current medications, symptoms, or treatment goals.

Those questions are relevant to clinical evaluation, but their answers should not automatically flow into marketing analytics systems.

Consider a questionnaire that asks whether a patient takes medication for a particular condition. A tracking script that captures the selected answer and an identifier could expose sensitive information to a third party.

The organization needs to understand whether its forms send field values, page parameters, events, or other information that could reveal patient health details.

A useful separation is to keep clinical questionnaire responses within the systems that manage patient care, rather than reusing them as ordinary marketing events.

This is why online intake should be treated as a healthcare information workflow, even when patients complete it before their first consultation.

Booking, Registration, and Login Pages

Appointment scheduling can create similar risks.

A patient might select a particular medical service, enter identifying information, and choose an appointment time. Tracking technologies that transmit those details may disclose PHI.

HHS also addresses registration and login pages. When tracking on those pages collects information qualifying as PHI, its disclosure is subject to the HIPAA Rules.

A website team should therefore examine more than the visible questions on a form. The information transmitted when someone submits, abandons, or interacts with a page can matter as much as the information the patient intentionally sends to the healthcare organization.

The fact that a page appears before authentication does not establish that its data is appropriate for unrestricted analytics.

Logged-In Pages

Authenticated patient portals generally connect more directly to protected health information.

After logging in, patients may review appointments, exchange messages with clinicians, complete medical questionnaires, access treatment information, or manage aspects of their care.

HHS explains that tracking technologies on authenticated pages of a HIPAA-regulated entity generally have access to PHI.

As a result, the organization must ensure that any use or disclosure of that information complies with the HIPAA Privacy Rule.

Why Tracking Needs Special Scrutiny

A patient portal may contain details that are not visible on a public marketing page, including diagnoses, prescriptions, treatment records, and secure messages.

A tracking script operating in that environment could collect information that the patient reasonably expects to remain within their healthcare relationship.

When an outside tracking vendor receives PHI as a business associate, the organization must establish an appropriate business associate agreement (BAA) and ensure the underlying disclosure is permitted.

A BAA alone does not make every use of tracking technology acceptable. The information shared, its purpose, and the vendor's role must also comply with applicable HIPAA requirements.

For telehealth operators, one practical approach is to separate marketing analytics from patient-facing clinical environments. Tracking intended to measure advertising performance does not necessarily belong on pages containing medical information.

The same decision applies to any telehealth platform. Bask Health, for example, supports a Google Tag Manager integration alongside other analytics connections, so brands building on it still choose which tags run on which pages.

Why a Cookie Banner Is Not Enough

Some websites use consent banners that allow visitors to accept or reject cookies and tracking technologies.

Those interfaces can serve specific privacy or preference-management purposes, but they don't automatically satisfy HIPAA's authorization requirements.

HHS explicitly states that ordinary website banners asking users to accept or reject tracking do not constitute a valid HIPAA authorization.

That matters because a brand cannot assume that clicking "Accept" permits disclosure of PHI to advertising vendors.

Where HIPAA authorization is required, the organization must satisfy the rule's specific requirements. Where another HIPAA permission applies, the disclosure still needs to stay within that permission and meet applicable safeguards.

Hosting and Forms Behind a HIPAA-Compliant Website

A website's privacy obligations do not end with what visitors see in their browsers.

Form submissions may pass through hosting infrastructure, cloud storage, notification services, and other software before reaching the clinical team.

That path matters because HIPAA evaluates the organizations handling PHI, including service providers behind the visible website.

According to HHS's business associate guidance, a cloud service provider that creates, receives, maintains, or transmits electronic PHI on behalf of a covered entity generally qualifies as a business associate.

The same analysis may apply to a form provider, data storage service, or other vendor that handles PHI in performing services for a HIPAA-regulated organization.

When that relationship exists, an appropriate BAA is generally required.

Follow the Form Submission

A website team should know where each form submission goes after the patient clicks Submit.

For example, a clinical questionnaire might send information into a patient record while also triggering an email notification or recording an analytics event.

Those destinations may involve different vendors and different information-handling responsibilities.

The organization should evaluate whether every recipient needs the information it receives and whether the corresponding contractual and technical safeguards are appropriate.

A form may look secure to the patient while still transmitting unnecessary details to outside services.

Other website requirements, including usability, accessibility, and basic technical configuration, remain important for launching a healthcare brand. However, those considerations do not replace a review of where health information travels.

Security Controls on the Systems Behind the Site

Once PHI reaches a server, form tool, or patient portal, the HIPAA Security Rule applies to the systems that hold it. For a website, that generally means encrypting data in transit with TLS and at rest, giving each person who can access patient records a unique login, and keeping audit logs showing who accessed what. HHS's proposed Security Rule update would go further and require both encryption and multi-factor authentication, with limited exceptions.

A vendor's published controls are a reasonable starting point for that review. Bask Health's security page lists encryption at rest and in transit, two-factor authentication, and system monitoring, logging, and alerting. A brand still needs a BAA with each vendor that handles PHI and its own rules for which team members can reach patient records.

Mobile Apps Are Part of the Same Analysis

HHS also discusses tracking within mobile applications offered by HIPAA-regulated organizations.

Information collected through those apps generally may involve PHI, including information entered by patients and certain device-related identifiers linked to healthcare activities.

For example, a patient using an app to track medication or manage a medical condition may transmit identifiable health information through embedded analytics tools.

The organization needs to evaluate those disclosures under applicable HIPAA requirements, just as it would for an authenticated patient portal.

Understanding what counts as PHI helps teams distinguish ordinary technical data from information that, in context, identifies a person and relates to their healthcare.

The focus should remain on the information collected and where it goes, rather than assuming a mobile app or website form is protected simply because it uses modern security technology.

What the 2024 Court Ruling Changed

On June 20, 2024, the U.S. District Court for the Northern District of Texas issued a decision in American Hospital Association v. Becerra that affected HHS's online tracking guidance.

The court declared unlawful and vacated the portion of the guidance that treated a particular combination of information as sufficient to trigger HIPAA obligations.

Specifically, the affected interpretation concerned circumstances in which tracking technology connected an individual's IP address with a visit to an unauthenticated public webpage addressing particular health conditions or healthcare providers.

HHS acknowledges the ruling in a notice at the beginning of its tracking guidance and states that it is evaluating next steps. OCR had appealed the decision but withdrew that appeal on August 29, 2024, so the vacatur stands.

The ruling narrowed that portion of the agency's interpretation, but it did not eliminate HIPAA's broader protections for patient information collected through healthcare websites.

A telehealth company should not interpret the decision as permission to transmit medical questionnaires, appointment details, or authenticated portal activity to outside advertising services without assessing whether those disclosures are permitted.

The underlying HIPAA analysis still depends on whether identifiable health information is involved, what the vendor receives, and which legal permissions or contractual safeguards apply.

The ruling also requires careful assessment of tracking on logged-in portals, booking pages, symptom tools, and login or registration workflows where PHI may be disclosed.

HIPAA is also not the only rule in play. In July 2023, the FTC and HHS sent a joint letter to approximately 130 hospital systems and telehealth providers about tools such as the Meta/Facebook pixel and Google Analytics. The FTC warned that companies outside HIPAA still have to protect that information, since an unauthorized disclosure may violate the FTC Act and could count as a breach under its Health Breach Notification Rule.

FAQs

Does a Website Need to Be HIPAA Compliant?

A website operated by or on behalf of a HIPAA-regulated organization must comply with applicable HIPAA requirements when it creates, receives, maintains, or transmits PHI.

Not every public page or analytics interaction involves PHI. However, clinical forms, appointment workflows, authenticated patient portals, and other health-related activities may create obligations that ordinary marketing pages do not.

The appropriate assessment depends on the data collected, the activity's purpose, and who handles the information.

Is a Cookie Banner Enough for HIPAA Compliance?

No. HHS explains that standard website banners asking visitors to accept or reject tracking technologies do not constitute valid HIPAA authorizations.

A website must independently satisfy applicable HIPAA requirements for disclosures of PHI, including appropriate permissions, business associate arrangements, and security safeguards.

Do the Same Rules Apply to a Mobile App?

HIPAA obligations can apply to mobile applications offered by covered entities and their business associates.

HHS explains that information collected through a regulated entity's mobile app generally is PHI when it relates to an identifiable individual's health or healthcare. The organization must evaluate how it collects, uses, and discloses that information, including through third-party tracking technologies.

References

1. U.S. Department of Health and Human Services. (2024). Use of online tracking technologies by HIPAA covered entities and business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
2. U.S. Department of Health and Human Services. (n.d.). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
3. Federal Trade Commission. (2023). FTC and HHS warn hospital systems and telehealth providers about privacy and security risks from online tracking technologies. https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-hhs-warn-hospital-systems-telehealth-providers-about-privacy-security-risks-online-tracking