The December 2022 HHS guidance on tracking technologies clarified a question hospital marketing directors had debated for years: when does website analytics create HIPAA exposure? The answer depends on whether visitors are authenticated and what data flows to third parties.
Public marketing pages — service line descriptions, physician directories, location pages — generally fall outside HIPAA scope when using standard analytics. A visitor browsing your cardiology page hasn't provided individually identifiable health information simply by visiting.
Authenticated portals and forms create different obligations. When a patient logs into MyChart or submits an appointment request that includes their name and reason for visit, that combination constitutes Protected Health Information. Any vendor receiving that data through pixels, chat widgets, or form integrations requires a Business Associate Agreement.
The practical distinction for SEO: you can typically run Google Analytics 4 on public pages without BAA concerns, but custom event tracking that captures what condition someone clicked on before scheduling may cross the line. Many hospitals resolved this by implementing consent management platforms that suppress tracking on appointment flows.
This is educational content reflecting current HHS guidance — verify specific implementations with your compliance officer and legal counsel, as enforcement interpretations evolve.