How Tracking Technologies Work, and Why They Cost Healthcare Millions

Since 2022, healthcare organizations have faced more than $200 million in publicly reported settlements as a result of lawsuits over tracking technologies on their own websites and patient portals. 

It started in June 2022, when The Markup and STAT found the Meta Pixel on the appointment pages of 33 of the top 100 U.S. hospitals, and inside password-protected patient portals at seven of them. Patients sued within weeks. Regulators followed with new guidance, enforcement actions against companies like GoodRx, BetterHelp, and Cerebral, and warning letters to healthcare organizations. The original case against Meta is still open more than four years later, and new ones are popping up every week. 

At this point, the danger is clear: If you run Meta, Google Analytics, or Google Ads tracking on your site, you’re exposed to the same claims. But without these tools for advertising measurement and analytics, healthcare marketers are practically flying blind. 

The good news is that the risk isn’t the tracker itself. It’s what the tracker sends. Once you understand that, you can fix it.

How Tracking Technologies Work in Healthcare Marketing

Trackers are built to collect identifiers like name, email, IP address, and device ID. Pair any of those with health information, even something as innocuous as the title of a page someone visited, and the combination can become protected health information. (For the full breakdown, see our guide to what is considered PHI.) 

Say you’re adding Meta’s Pixel to your site. (We’re using it as our example because it’s the most common and best documented, but Google Analytics, Google Ads, and most other trackers work the same way.) It starts with adding this code to your website:

<!-- Facebook Pixel Code -->
<script>
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window, document,'script',
'https://connect.facebook.net/en_US/fbevents.js');
fbq('init', '{your-pixel-id-goes-here}');
fbq('track', 'PageView');
</script>
<noscript><img height="1" width="1" style="display:none"
  src="https://www.facebook.com/tr?id={your-pixel-id-goes-here}&ev=PageView&noscript=1"/></noscript>
<!-- End Facebook Pixel Code -->

Those few lines hand control of the page to Meta. The snippet pulls in Meta’s full tracking script, which runs on every page where it’s installed and decides what to collect and send back.

So, once Meta has control, what does it collect? According to Meta’s own documentation, the Pixel collects:

• HTTP headers: IP address, browser information, page location, and referrer
• Pixel-specific data: Your Pixel ID and the Facebook cookie
• Button clicks: Which buttons visitors click, their labels, and the pages they lead to
• Form field names: The names of the fields on your forms, such as “email” or “phone”
• Optional values: Anything else you choose to send through custom events, like conversion value or page type

Then there’s Advanced Matching. This allows the Pixel to capture the information that visitors type into those fields, like their name, email, and phone number. Meta uses it to tie a visitor’s activity on your website to their Meta account.

On a healthcare site, you might have a “schedule appointment” form on a page that’s being tracked by the Meta Pixel. The fields are name, email, date, and doctor. Depending on how you’ve set up Advanced Matching, the Meta Pixel could be collecting this personal information, which could constitute a violation of any number of privacy laws, including HIPAA. 

Why Meta’s Safeguards Won’t Protect You

Part of the challenge is that Meta does little to help healthcare marketers avoid these pitfalls. Its tutorials and guides are written for ordinary websites, with no healthcare-specific guidance on what not to send. Follow them exactly, and you could still share data you never intended to.

If PHI does reach Meta, the company points to two safeguards. Neither one protects you.

1. Meta filters sensitive data, after it receives it. 

Meta says its systems filter out sensitive data, and in 2025 it went further by limiting the custom parameters and URL details it uses from data sources it categorizes as health and wellness. But those are Meta's choices about what to use and the sources it chooses to categorize under health and wellness. You’re still responsible for what’s shared with the platform. And plaintiffs' experts say they've found at least 664 hospital or provider web properties where Meta received patient data via the Pixel.

2. Meta hashes the data, but hashing isn’t anonymizing. 

The problem with this approach is that, though SHA-256 hashes are unbreakable, they are also deterministic, meaning that the same plain text will always produce the same encrypted text. So all you need is a long list of plain text with associated encrypted text and you can quickly look up and decrypt the code. For instance, if we SHA-256 hash the word ‘pregnancy’ with this tool we get: F1d6a553546aa7a9682463059f40e5a2a737b53719f0301b93ddaae3fb8efaf6

Which we can decrypt with this tool:

Hashing and filtering are about the data visitors type into forms. But many of the riskiest pages on a healthcare site don’t have a form at all, and the Pixel still collects plenty from them.

Start with button clicks, which the Pixel collects by default. A visitor who clicks “Contact psychiatry” or “Schedule a consult” on an oncology page has just told Meta what kind of care they’re looking for, without typing a word.

That’s because of those HTTP headers. This is the fundamental trap of tracking technologies—their entire raison d’etre is to track a person on a page. To do that, they need some way to identify a person, so they use the IP address, and a way to identify the page, so they use the URL. The URL itself often contains health context with a structure like: healthcarewebsite.com/cancer-care/medical-oncology.

When the IP address, which is one of those HIPAA identifiers, is paired with a page that relates to someone's health, especially an authenticated page like a patient portal or appointment confirmation, the combination can constitute a violation of the HIPAA privacy rule.

It’s Not Just Meta

Meta isn’t the only problem. Google Ads’ tracker, the third most common in our data, works the same way. So do far less obvious ones, like the trackers built into accessibility overlays and widget platforms used across healthcare.

Like Meta’s Pixel, misuse of these trackers has real-world consequences. Concord Hospital in New Hampshire recently agreed to an $800k settlement related to Google Analytics and Geonetric pixels usage. Christ Hospital in Ohio settled similar claims and agreed to remove tracking from its patient portal, assessment, booking, and form pages, and to use only BAA-covered vendors in future. 

For the full list of trackers we flag most often, and what to do about each one, see our analysis of the Top Ten Web Tracking Technologies. 

Before You Can Fix It, You Need to Diagnose the Problem

Running tracking technologies on your website carries clear compliance risks, but investing millions in advertising without measurement can be just as costly. Modern healthcare marketers need a way to understand campaign performance while managing risk. 

The first step is to understand which trackers are on your site. It sounds obvious, but many healthcare marketers have trackers installed by agencies, vendors, embedded tools, and other teams without their knowledge. 

For example:

• Widgets like Elfsight's review feeds and social embeds, and accessibility overlays like UserWay and accessiBe, usually arrive via a web team, agency, or plugin—not marketing
• Meta’s in-app browser has been found to inject scripts that run outside of consent controls when a person clicks through from Facebook or Instagram

Freshpaint’s Web Tracker Monitoring (WTM) makes it easy to identify the trackers on your website, understand whether they create compliance risk, and get findings to the people in your organization who can take action. 

Unlike crawlers, WTM observes trackers that fire during real visitor sessions. It also covers authenticated pages, like patient portals, that a crawler can't reach—and is where many recent settlements have focused.

Fixing It Without Flying Blind

Once you know which trackers are on your site, the next question is which ones to keep. Freshpaint sits between your website and your ad platforms, so instead of trackers sending data straight to Meta and Google, the data goes through Freshpaint first, and only what you approve gets through.

• A signed BAA. Freshpaint is built to handle sensitive data and signs a BAA.
• Nothing leaves by default. No data goes to Meta, Google, or other destinations until you choose which events and fields to send.
• Identifiers are removed before they reach ad platforms. Freshpaint masks user identifiers irreversibly. No downstream analytics tool will have access to raw identifiable information about a user.
• Server-side delivery. Meta’s and Google’s scripts no longer run on your pages. Freshpaint sends data to them from its servers, so they only receive what you’ve approved. They can’t collect IP addresses, button clicks, or form fields on their own.

Freshpaint’s approach allows you to leverage your ad platforms and analytics tools in a compliant way. By getting ahead of compliance risk, you can keep running data-driven marketing programs with a clear view of what's on your site and control over what leaves it.

Learn more about Web Tracker Monitoring and take the first step to privacy-safe marketing here.