HIPAA, Tracking Pixels and the Court Ruling Clinics Misread

"This is a case about power."

That is how a federal judge summed up the ruling that has some health marketers breathing out. On June 20, 2024, Judge Mark Pittman of the Northern District of Texas sided with the American Hospital Association against HHS's online tracking bulletin, writing that the case was not really about HIPAA, but about agency power.¹ Some marketers took that as the end of the pixel problem.

It is not. A court told a federal agency it went too far in one specific place, and a narrow ruling is not a permission slip. It did not tell anyone that sending health information to an advertising platform is safe. This is educational, not legal advice, and you should talk to a healthcare privacy attorney about your own setup. Here is what the ruling decided, and what it left standing.

What did the June 2024 court ruling actually decide?

Less than the headlines implied.

The case, American Hospital Association v. Becerra, challenged the HHS Office for Civil Rights bulletin on online tracking technologies. The AHA said OCR issued updated guidance in March in response to its lawsuit, argued the revised bulletin was still unlawful, and the court agreed.¹ The judge granted declaratory judgment that what he called the "Proscribed Combination" in the March 18, 2024 bulletin was unlawful, as promulgated in clear excess of HHS's authority under HIPAA.¹

What exactly was vacated

HHS now carries a notice at the top of its own page. It says the court declared unlawful and vacated a portion of the guidance, specifically the part saying HIPAA obligations are triggered where an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. HHS also says it is evaluating its next steps.²

What was not

The same HHS page still discusses tracking on user-authenticated pages, such as patient portals, and tracking within mobile apps, along with the general rule that regulated entities cannot make impermissible disclosures of protected health information to tracking vendors.² The notice describes the vacatur as covering the unauthenticated-page portion. The court did not rewrite HIPAA, and it did not address the FTC or any state.

Why do some marketers read it as a green light?

Because "vacated" sounds like "gone," and a headline is easier to repeat than a footnote.

The narrow slice and the wide claim

The vacated part is narrow: an IP address plus a visit to a public page. A telehealth funnel is not that. People fill in forms, answer questions about symptoms and goals, book consults and enter an email address on the same pages where the pixel fires. The ruling says nothing that makes it acceptable to send that kind of information to an ad platform.

The "we are not a hospital" argument

Another misread is that this was a hospital case, so it does not touch a marketing-led telehealth company. That reasoning skips a step, because the answer depends on whether you are a HIPAA covered entity or business associate, and many telehealth arrangements are complicated. The honest answer is "ask your lawyer," not "it does not apply to me."

What does a tracking tool actually send?

More than most marketers picture. HHS's bulletin describes the information a tracking technology can disclose to a vendor as including an individual's medical record number, home or email address or dates of appointments, as well as an IP address or geographic location, device IDs or any unique identifying code.² HHS also says that tracking technologies commonly include cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts, and that many of these are not apparent to the user.²

Why that matters on an intake page

On a public article about a condition, a visitor reads and leaves. On a booking or intake page, the visitor is acting: typing an email, picking a service, choosing a time. Every script on that page is a candidate to receive some of it. A marketer thinks of the pixel as a way to count conversions. A regulator thinks of it as a pipe to a third party. Both are describing the same code.

Does HIPAA apply to your telehealth marketing at all?

It depends on who you are and what the data is.

HIPAA's rules apply to covered entities and business associates, and the HHS bulletin focuses on the obligations of those regulated entities.² If you are one, impermissible disclosures of protected health information to tracking vendors are a problem under the Privacy Rule, and HHS says disclosures to tracking technology vendors for marketing without HIPAA-compliant authorizations are impermissible.²

If you are not, HIPAA is not the end of the analysis. It is where another set of laws takes over.

What does the FTC's Health Breach Notification Rule add?

A second federal regime for the companies HIPAA does not reach.

On April 26, 2024, the FTC finalized changes to the Health Breach Notification Rule. The changes clarify that the rule applies to health apps and similar technologies not covered by HIPAA, and that a "breach of security" covers unauthorized acquisition of identifiable health information from a data security breach or an unauthorized disclosure.³ The FTC said the final rule takes effect 60 days after publication in the Federal Register, and that date has now passed.³

That second phrase, an unauthorized disclosure, is the one that matters for pixels. A breach is no longer only a hack. Sharing health information with a third party without the person's authorization can count.

What has the FTC already done to health companies over ad-platform data?

A lot, and in this order.

The pattern

In GoodRx, the FTC announced a $1.5 million civil penalty and a permanent ban on sharing user health information with applicable third parties for advertising.⁵ In BetterHelp, the FTC said the company gave Facebook email addresses and the fact that people had been in therapy so Facebook could find similar users, and it must pay $7.8 million.⁶ In Cerebral, a telehealth firm (the same case I touched on in my Hims & Hers read), the FTC alleged it provided sensitive information of nearly 3.2 million consumers to third parties by integrating tracking tools on its website or apps.⁷

None of those cases depended on the HHS bulletin. The FTC acted under its own authority, and the court ruling does not touch it.

What do state laws like Washington's add?

Consent, and a way for individuals to sue.

Washington's My Health My Data Act, HB 1155, passed the Legislature on April 17, 2023 and was signed on April 27, 2023. Regulated entities that are not small businesses were required to comply with its main provisions by March 31, 2024, and small businesses by June 30, 2024.⁴ The Attorney General's office says any violation is a per se violation of the Washington Consumer Protection Act, enforceable by the Attorney General and through private action.⁴

Wider definition of health data

The Act defines consumer health data broadly. It includes information that identifies a person's past, present or future physical or mental health status, includes the use and purchase of prescribed medication, and can include health inferences drawn from non-health data.⁴ Selling consumer health data requires valid authorization from the consumer.⁴ If you market to Washington residents, ask your attorney whether the Act reaches you even if your business sits elsewhere. Other states have their own rules, so ask your attorney which apply.

What should a telehealth operator do now?

Treat the ruling as a footnote and treat your data flows as the main event.

The rules around health data have only tightened since I started running Meta ads in 2014. Ads can still work in this space, as long as the claims are clean too (see what a clinic can and cannot say) and server-side signal is sent with care (see the Conversions API baseline). They just have to be built around what you are allowed to know, not what you can technically capture. If you want to talk through the funnel and the data side, write to me. The legal side is for your attorney.

Keep building.Ekai