Last verified: October 2026, against the court's opinion, Meta's developer documentation and FTC announcements. General information, not legal advice — confirm with your compliance officer or attorney.
Every Meta Pixel lawsuit and regulator action against a health website rests on the same mechanism: a snippet of advertising code, installed to measure ads, quietly sent visitors' activity on health pages to a platform that sells ads. This page explains what a pixel transmits, what HHS's guidance says after a 2024 court ruling cut part of it, and how a practice manager can audit a website in about 30 minutes.
What a tracking pixel actually sends
Meta describes its pixel as "a snippet of JavaScript code that allows you to track visitor activity on your website" (Meta for Developers (opens in a new tab)). According to that documentation, each pixel event can carry:
- HTTP headers: IP address, browser details, the page location and the referring page
- Pixel-specific data: the pixel ID and the Facebook cookie
- Button clicks: which buttons were clicked, their labels and the pages that followed
- Form field names, such as "email" or "address." Meta says it doesn't capture field values unless you include them
- Optional values a developer adds, such as page type or conversion value
Advanced matching (opens in a new tab) goes further. It sends email, name, phone, date of birth, city and ZIP code, hashed with SHA-256, so Meta can match the visitor to an account.
On a shoe store's site, that's ordinary marketing data. On a fertility clinic's site, the page location alone ("/services/ivf/book-consultation") combined with an IP address and a hashed email describes a person seeking a specific kind of care.
Why the Meta Pixel lawsuits happened
Health organizations installed pixels for the same reason every advertiser does: to see which ads produce appointments. The trouble was placement. Pixels ended up on appointment pages, symptom checkers and patient portals, where the data they send by default includes health context.
Regulators acted first against health companies outside HIPAA. In February 2023, the FTC announced a $1.5 million civil penalty against GoodRx (opens in a new tab) under its Health Breach Notification Rule, alleging it shared users' prescription and health-condition information with Facebook, Google and others for advertising. In March 2023, the FTC announced that BetterHelp would pay $7.8 million (opens in a new tab) over allegations that it shared email addresses, IP addresses and mental health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest.
The private class actions behind most "Meta Pixel lawsuit" searches have made similar allegations against hospitals and health systems, typically under state privacy laws. We don't name cases here; the mechanism is what matters for your site.
Meta's own terms point the same way. Its Business Tools Terms (opens in a new tab) require advertisers not to share data that "includes or is based on, directly or otherwise, health information." If your pixel sends health information, you're in breach of Meta's terms as well as exposed under privacy law.
What HHS's tracking-technologies guidance says
HHS's Office for Civil Rights (OCR) issued a bulletin on online tracking technologies in December 2022 and a revised version on March 18, 2024, as the court's opinion records. The revised bulletin says it does "not have the force and effect of law."
Its core message rests on rules that predate it. If a tracking vendor receives PHI from your site, that's a disclosure the Privacy Rule must permit, and a vendor that receives PHI on your behalf is a business associate under 45 CFR 160.103 (opens in a new tab). Ad platforms aren't set up to take that role: Meta's terms bar health data outright, and Google states it "does not offer Business Associate Agreements" for Google Analytics (opens in a new tab).
The distinction that runs through the guidance and Google's own statement is between two kinds of pages:
- Authenticated pages, such as patient portals, require a login. Google says these "are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages."
- Unauthenticated public pages, such as service pages, blogs and location pages, need no login. The court's ruling concerns these.
What changed after AHA v. Becerra (2024)
On June 20, 2024, the US District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra (opens in a new tab). The court called one part of the bulletin the "Proscribed Combination": treating a tracking technology that connects a visitor's IP address with a visit to an unauthenticated page "addressing specific health conditions or healthcare providers" as protected information.
The court declared that the Proscribed Combination, "as set forth in the HHS Bulletin of March 18, 2024, is UNLAWFUL," because it was issued "in clear excess of HHS's authority under HIPAA," and vacated it. It denied a permanent injunction. A footnote adds that the vacatur should not be read as "limiting the legal operability of other guidance in the germane HHS document."
What that leaves for a practice:
- An IP address plus a visit to a public condition page is no longer, by itself, treated as PHI under that guidance.
- Everything else still applies: PHI typed into forms, booking flows, portals and anything tied to a known patient is protected.
- FTC enforcement and state laws are untouched by the ruling.
The case record on govinfo.gov (opens in a new tab) lists the June 20, 2024 opinion. Check HHS's bulletin page for its current notice on the ruling before relying on any part of it.
State law can reach further. Washington's My Health My Data Act defines "consumer health data" to include data that identifies a consumer seeking health care services and health information inferred from non-health data (RCW 19.373.010 (opens in a new tab)). It exempts HIPAA PHI (RCW 19.373.100 (opens in a new tab)), so its reach is greatest for data that isn't PHI, such as browsing on public pages, and for businesses HIPAA doesn't cover.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Where pixels are riskiest on a practice site: forms, booking, condition pages
| Page or event | What can leak | Risk |
|---|---|---|
| Patient portal (authenticated) | Anything the patient sees or does | Highest: keep all ad and analytics tags off |
| Intake, contact and appointment-request forms | Field values via advanced matching; "Lead" events tied to a service | High |
| Thank-you and confirmation URLs | URLs like "/thank-you?service=ivf" or "/booked/vasectomy" | High |
| Online booking widgets | Appointment type, clinician and time slot as events | High |
| Site search results | Query strings such as "?q=herpes+testing" | Medium to high |
| Condition and service pages | Page URL and title combined with identifiers | Lower after the 2024 ruling, still sensitive under state law |
| Home, about, contact info, blog | General browsing | Lower |
The pattern: risk rises as a page moves from "someone read about a condition" toward "this specific person asked us for care." For the nuance on identifiers, see is an IP address PHI. Lead forms inside Meta carry their own considerations, covered in our guide to Facebook lead ads.
A 30-minute pixel audit for your website
You need a laptop with Chrome and access to your Google Tag Manager account, if you have one.
- Inventory the scripts (5 minutes). Open your home page, right-click, choose View Page Source and search for "fbq", "gtag", "googletagmanager", "tiktok" and "linkedin". List each one. Do the same on a form page.
- Open Tag Manager (5 minutes). List every tag in the container and the trigger that fires it. Look for "All Pages" triggers on ad tags.
- Check forms and thank-you URLs (5 minutes). Submit a test request with a fake name. Read the confirmation URL: does it name a service or condition?
- Watch what fires (10 minutes). Open Chrome DevTools (F12), go to the Network tab, filter for "facebook" and "google", then submit the test form and click a booking button. Note every request that fires and whether it carries the page URL, an event name like "Lead" or "Schedule", or hashed user data.
- Remove or block (3 minutes). Remove ad tags from forms, booking, portal, search and thank-you pages, or change their triggers to exclude them. Turn off automatic advanced matching in Meta Events Manager for this site.
- Document it (2 minutes). Record the date, what you found, what you changed and who did it. Repeat the check after any website or agency change.
A free marketing audit runs a version of this check from the outside: its ads section flags privacy risks such as pixels on patient forms.
Measuring ads without sending patient data
You can still learn which ads produce patients. The difference is where the counting happens:
- Count conversions as generic events on a page that reveals nothing: "form_submitted" or "call_click," with no service name. Our guide to conversion tracking without PHI shows the Google Ads setup.
- Keep the record of who asked for what inside a system covered by a BAA, and report results to ad platforms only in aggregate.
- Don't send hashed contact details from health forms. Hashing makes data harder to read, not anonymous, because the platform's purpose is to match it to a person.
- Rethink retargeting. Audiences built from condition-page visitors carry both HIPAA and ad-policy problems; see remarketing restrictions.
Google Analytics raises its own questions, covered in Google Analytics and HIPAA. For the wider rule set, start at HIPAA marketing rules.
Medfy is built around this separation. Its website forms are HIPAA-compliant, and patient information is stored in separate, encrypted HIPAA databases in the US or Canada. First-party website analytics count calls, forms, bookings and directions, and ad platforms never receive patient data. See Medfy's patient-data safeguards.
Frequently asked questions
Is the Meta Pixel a HIPAA violation?
Not by itself. The problem is where it fires and what it sends. On a page where patients enter health details, book a visit or log in to a portal, the pixel can pass PHI to Meta, and Meta's Business Tools Terms forbid advertisers from sending health information at all. Keep it off those pages, or remove it entirely. Confirm your setup with your compliance officer or attorney.
Can a medical practice use Google Tag Manager?
Yes. Tag Manager is a container that loads other tags, so the risk depends on what you put in it and which pages trigger it. Use triggers that exclude forms, booking, portal and thank-you pages, review every tag in the container, and limit who can publish changes. Audit it again whenever an agency or vendor adds something. Check your setup with your compliance officer or attorney.
Is an IP address PHI on a public web page?
Not automatically. In June 2024 a federal court vacated the part of HHS's guidance that treated an IP address plus a visit to a public page about a health condition or provider as protected information. An IP address is still one of HIPAA's 18 identifiers, and it becomes PHI when tied to health information you hold, such as a form submission or portal login. Confirm specific cases with your attorney.
What should a practice do if a pixel captured form data?
Stop the flow first: remove or pause the tag and confirm in your browser that nothing fires on submit. Then treat it as a possible breach. Your privacy officer runs the four-factor risk assessment in 45 CFR 164.402, and if notification is required, patients must hear within 60 days of discovery. Document the scope, dates and fix, and involve your attorney before deciding.