Website tracking · Source dated
Tracking tools on practice websites: what the court ruling left standing
A status check as of October 2026: website tracking guidance depends on what a page does and what information its tools collect.
By Quantum Clinical Advisors · Published
Illustrative photography; not the organization or people discussed.
What happened
On June 20, 2024, a federal court in the Northern District of Texas, in American Hospital Association v. Becerra, vacated the part of HHS guidance saying HIPAA is triggered when an online technology connects a visitor’s IP address with a visit to an unauthenticated public webpage about specific health conditions or healthcare providers. The HHS page carries a notice about the order. Its content was last reviewed June 26, 2024.
The rest of the guidance as posted still says tracking technologies on user-authenticated pages generally have access to protected health information (PHI). Many unauthenticated pages do not expose PHI to tracking technologies, but some can—for example, pages that permit appointments, symptom-checker tools, or login and registration pages where credentials are entered. Information collected by a regulated entity’s own mobile app is generally PHI.
This is a status check as of October 2026, not a statement that the guidance will remain unchanged. Re-check the guidance periodically with your compliance adviser.
Read the source (opens in a new tab)Why it's important to know
What a webpage does matters when reviewing tracking tools.
Booking and login pages are different from general informational pages.
The court ruling did not remove the rest of the posted guidance.
How this could potentially affect your practice
- Depending on your practice, booking, intake, symptom or login pages may need closer review than general informational pages.
- Tools on authenticated pages could have access to PHI, according to the posted guidance.
- Some unauthenticated pages might also expose PHI, depending on what visitors enter and what the tools collect.
- Changes to the posted guidance could affect how your advisers assess the tools on each page.
Questions for your practice
These are QCA discussion points, not findings about your practice or a compliance certification.
- Which pages collect anything a patient types?
- Who approves tags added to the site?
- Is the booking or intake tool one your compliance adviser has approved?
- Has anyone listed every tool that loads on each page?
Source and scope
HHS bulletin: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (opens in a new tab). Source dated June 26, 2024. The reported facts above are summarized from the cited sources; the practice questions are QCA's commentary.
This article is general business information, not medical, legal or financial advice. Applicability depends on your practice and its activities. Consult qualified legal, compliance and IT advisers for decisions about HIPAA and other privacy obligations. QCA provides marketing and website consulting only and does not access patient information.