Last verified: October 2026, against Contentsquare's and Microsoft's own documentation. General information, not legal advice — confirm with your compliance officer or attorney.
Is Hotjar HIPAA compliant? We found no business associate agreement (BAA) for Hotjar, and Microsoft doesn't cover Clarity under its BAA either. Both are session-recording tools: they replay what visitors see and do on your site, page by page. On a blog post that's harmless. On an appointment form, a booking confirmation or a page about a specific condition, a recording can carry protected health information (PHI) to a vendor that hasn't agreed to protect it.
Short answer for Hotjar and Microsoft Clarity
Short answer (verified October 2026): Hotjar: no BAA found. Hotjar's legal and privacy pages now redirect to Contentsquare, which "incorporated" Hotjar. Contentsquare's Master Service Agreement (opens in a new tab) says its service "is not intended for the processing of any Personal Data of Visitors other than the Permitted Personal Data" (IP address, cookie ID, technical and behavioral data), and the customer must "prevent the transfer" of anything else. Hotjar's help center blocked our checks.
Short answer (verified October 2026): Microsoft Clarity: not covered. Clarity is absent from Microsoft's list of HIPAA in-scope services (opens in a new tab). Clarity's FAQ (opens in a new tab) says it "operates as a data controller" and that "Microsoft/Clarity has access to the data." That's Microsoft using data in its own right, not a vendor working for you under a BAA.
One oddity: Contentsquare's security page (opens in a new tab) shows a HIPAA logo among its compliance badges, but doesn't say what it covers, mention a BAA, or name Hotjar. A badge isn't a contract. If Contentsquare offers you a BAA covering Hotjar, get it in writing.
What session recordings capture on a practice site
A recording script rebuilds the page and logs clicks, scrolls and movement. On a practice website, three places carry the most risk:
- Contact and appointment forms. Names, phone numbers and "reason for visit" answers. Clarity masks input boxes in every mode; we couldn't confirm Hotjar's current default.
- URLs that name conditions. A page path like
/hiv-testing/thank-youor a query string carrying a name. Clarity's FAQ notes URL masking "only applies to page URL," not referrer URLs or clicked URLs. - Confirmation and portal pages. Text on screen, such as "Thanks, Maria, see you Tuesday at 3:00 for your consultation." Clarity's default Balanced mode masks only numbers and email addresses, so names and conditions displayed as text can be captured.
HHS's position on tracking technologies on health websites applies here too; tracking pixels and HIPAA explains it and its current legal status.
Masking, suppression and page exclusions
Clarity's masking documentation (opens in a new tab) offers three modes:
| Clarity mode | What's masked |
|---|---|
| Strict | All content |
| Balanced (default) | Numbers and email addresses, plus inputs and drop-downs |
| Relaxed | Only input boxes and drop-downs |
You can also mask specific elements by CSS selector in Settings > Masking, or by adding data-clarity-mask="True" to an element in your page code. Microsoft notes three limits: changes take up to an hour, they don't apply to past recordings, and content inside style sheets isn't masked. Clarity also supports excluding internal IP addresses.
For Hotjar, we couldn't read the current suppression documentation. Contentsquare's agreement refers to customers implementing blocking scripts "as stated in the CS Documentation," so ask your developer to show you, in a test replay, exactly what's suppressed.
The simplest mitigation works for both: don't load the recording script on form, booking, portal, thank-you or condition pages at all. Masking can fail when a page changes; a script that isn't there can't capture anything.
Terms that restrict health data
- Contentsquare (Hotjar): customer must have "a valid lawful basis" for visitor data and must stop non-permitted personal data reaching the service. If it arrives anyway, the parties cooperate to delete it.
- Clarity: Microsoft is a data controller for Clarity data, keeps recordings available to site owners for up to 30 days, and stores data in Azure. We couldn't retrieve the text of Clarity's terms of use, which loads only in a browser, so we don't characterize it.
Neither vendor documents a BAA for its recording product. That puts session recording on PHI pages outside HIPAA's business associate rules, which is why page exclusion matters more than masking.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Do you need session recording at all?
Most practices installed a heatmap tool once, looked at it twice and forgot it. Before you configure masking, ask what decision the recordings are informing. The common questions have answers that don't need recordings:
- Which pages produce patients? Count calls, form submissions, booking clicks and direction requests per page.
- Where do visitors drop off? Aggregate funnels in your analytics; see Google Analytics and HIPAA for its own limits.
- Is the site slow or broken on phones? That's a website performance problem, measured with speed data, not replays.
Medfy's first-party website analytics count calls, forms, bookings and directions, including visits from AI assistants, without session recording; measuring marketing covers the wider approach. Work through the HIPAA website checklist, read how Medfy handles patient data, or start with a free marketing audit, which flags tracking on patient forms. More vendor checks are in HIPAA-compliant software.
Frequently asked questions
Is Microsoft Clarity safe on a medical website?
On pages with no health information, such as a home page or blog, the risk is low. Microsoft doesn't list Clarity among the services its HIPAA BAA covers, and Clarity's FAQ says it operates as a data controller. So keep it off form, booking, portal and condition pages, use Strict masking anywhere it runs, and confirm the setup with your compliance officer or attorney.
Does Hotjar record what people type in forms?
We couldn't confirm Hotjar's current defaults, because its help center blocked our automated checks. Contentsquare, which now owns Hotjar, says its service isn't meant for visitor personal data beyond a short permitted list and makes you responsible for blocking the rest. Record a test session with fake data, watch the replay, and review the result with your compliance officer before trusting any setting.
Can session recordings cause a HIPAA breach?
They can. If a recording captures a visitor's name with a condition, an appointment or a form answer and sends it to a vendor without a BAA, that can be an impermissible disclosure of protected health information. Whether it's a reportable breach depends on the facts and a risk assessment, so involve your compliance officer or attorney as soon as you find one.
What can replace heatmaps on a practice website?
Aggregate numbers answer most of the same questions: which pages lead to calls, forms, bookings and directions, where visitors drop off, and how fast pages load. Run usability tests with volunteers using fake details for the rest. If you keep a heatmap tool, limit it to pages without health information and use its strictest masking. Medfy's first-party analytics count these conversions without recording sessions.