Healthcare websites often hear that a 2024 court ruling "struck down" the federal government's guidance on tracking pixels. The ruling was narrower than that. This guide sets out what the court vacated, what HHS's guidance still says, and what the ruling did not decide.
The guidance
The HHS Office for Civil Rights publishes a bulletin titled "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates." It explains how the HIPAA Privacy, Security, and Breach Notification Rules apply when a hospital, practice, or health plan uses tracking code on its website or app. The version the court reviewed is the revised bulletin of March 18, 2024.
What the court vacated
In American Hospital Association v. Becerra, 738 F. Supp. 3d 780 (N.D. Tex. 2024), No. 4:23-cv-01110-P, decided June 20, 2024, hospital associations challenged one part of the bulletin. The court called it the "Proscribed Combination": identifying information such as an IP address, combined with a visit to an unauthenticated public web page "addressing specific health conditions or healthcare providers."
The court held that this combination falls outside HIPAA's definition of individually identifiable health information, declared that part of the bulletin unlawful as issued in excess of HHS's authority, and vacated it. HHS appealed and then dismissed its own appeal, No. 24-10775 (5th Cir. Sept. 4, 2024).
HHS now prints a note at the top of the bulletin describing the vacated part and saying it "is evaluating its next steps in light of that order."
What the court did not vacate
The court limited its order to that one part. It said the vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." The rest of the bulletin still says, among other things:
- Logged-in pages. Tracking technologies on pages that require a login, such as a patient portal or telehealth platform, "generally have access to PHI," and a covered entity must configure them to use and disclose it only as the Privacy Rule permits.
- Booking and symptom tools. Tracking on a public page that lets a person schedule an appointment or use a symptom checker may collect protected health information, such as an email address or the reason for seeking care typed or selected by the visitor.
- Login and registration pages. Credentials or registration details entered on a patient portal's login or sign-up page are individually identifiable health information, so tracking that collects them is a disclosure subject to HIPAA.
- Banners are not authorizations. "Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization."
- A privacy policy is not permission. A covered entity may not disclose protected health information to a tracking vendor just because its privacy policy says it will.
- A vendor's promise to strip data is not enough. HHS says it is insufficient for a tracking vendor to agree to remove or de-identify the information after receiving it.
- Business associate agreements. A vendor that receives protected health information on a covered entity's behalf is a business associate and needs a signed agreement.
What the ruling did not decide
Becerra was a challenge to agency guidance under the Administrative Procedure Act. It decided what HHS could say HIPAA requires. It did not decide whether sending patient information to an advertising platform is lawful under other statutes, and the opinion does not mention the federal Wiretap Act.
Federal courts have since let Wiretap Act claims over hospital pixels go forward. In Cooper v. Mount Sinai Health System, Inc., 742 F. Supp. 3d 369, 379 (S.D.N.Y. 2024), decided after Becerra, the court denied the motion to dismiss a Wiretap Act claim over the Meta Pixel on a health system's website, holding the crime-tort exception plausibly alleged because disclosing individually identifiable health information for commercial advantage would violate 42 U.S.C. Section 1320d-6. Gay v. Garnet Health, No. 7:23-cv-06950, 2024 WL 4203263 (S.D.N.Y. Sept. 16, 2024), reached the same result on appointment, condition, test-result, and portal information. See Federal Wiretap Act for Websites.
State wiretap and consumer protection laws, the FTC Act, and the FTC's Health Breach Notification Rule were not before the court either.
What a healthcare website should take from it
- Treat patient portals, telehealth pages, appointment booking, symptom tools, intake forms, and login and registration pages as places where tracking code can collect protected health information.
- Keep advertising pixels off those pages entirely. A cookie banner does not make them permissible under HIPAA.
- Do not rely on a vendor's promise to filter health information after it arrives.
- Do not rely on Becerra for pages about conditions and doctors. It removed one statement from HHS's guidance; it did not make those pages safe under every other law.
Our guide to removing the Meta Pixel from patient pages shows how to do this without losing campaign reporting.
Sources
Links checked on October 22, 2026. The HHS quotations are from the bulletin as published that day; the court's are from its order of June 20, 2024.
- HHS: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
- American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. June 20, 2024)
- Cooper v. Mount Sinai Health System, Inc., 742 F. Supp. 3d 369 (S.D.N.Y. 2024)