You've probably heard the reassurances: "Analytics tools don't collect PHI," or "It's just aggregate data." Then you read about two more hospitals settling class action lawsuits over Meta Pixel and Google Analytics, and you wonder what your team missed.
These myths persist because tracking tools are marketed as privacy-safe, IT teams implement them without consulting compliance, and technical documentation uses vague terms like "anonymized" that don't align with HIPAA's legal definitions. The result? Fairchild Medical Center settled with approximately 1,000 affected individuals, and Boone Health is paying out to patients who logged into their portal between April 1, 2021, and December 5, 2022.
Let's dismantle the myths that lead to these settlements.
Myth 1: "If we don't send names or medical record numbers, it's not a disclosure"
Reality: HIPAA defines Protected Health Information (PHI) as any individually identifiable health information. This includes IP addresses, device IDs, session timestamps, and page URLs that reveal a patient visited your cardiology appointment scheduler or logged into a diabetes management portal.
When Meta Pixel fires on a patient portal login page, it transmits the page URL, the user's IP address, and a browser fingerprint to Meta's servers. These data points can identify an individual and reveal they're seeking healthcare services at your facility. That's a disclosure under the HIPAA Privacy Rule, even if you never transmitted a name.
The California Confidentiality of Medical Information Act, which was part of the Fairchild Medical Center lawsuit, takes an even broader view. State privacy laws often define health information more expansively than HIPAA and don't require a federal covered entity relationship to trigger liability.
Myth 2: "The tracking vendor is our Business Associate, so we're covered"
Reality: Meta and Google have explicitly stated they don't sign Business Associate Agreements (BAAs) for their advertising and analytics products. Without a BAA, these vendors aren't your Business Associates under HIPAA. They're unauthorized third parties receiving PHI.
This distinction matters legally. When you disclose PHI to a Business Associate without a BAA, you've violated 45 CFR 164.502(e), which requires written contracts before any disclosure. When you disclose PHI to a party that isn't a Business Associate at all, you've made an impermissible disclosure unless you have patient authorization or another regulatory exception.
Your IT team may have checked a box saying "we agree to the terms of service," but that's not a BAA. A valid BAA must include specific HIPAA safeguard requirements, breach notification obligations, and termination provisions. Marketing platform terms of service don't include these elements because the vendors don't intend to act as Business Associates.
Myth 3: "We only use tracking on our public marketing pages, not the portal"
Reality: Review your implementation now, because many organizations discover tracking code on authenticated pages they didn't intend to tag.
Boone Health's settlement covers patients who logged into the patient portal during the relevant period. That means tracking tools were firing after authentication, capturing data about logged-in users. This often happens when:
- A site-wide tag manager includes the tracking code by default
- Developers copy template code that includes tracking scripts
- Third-party chat widgets or scheduling tools embed their own tracking pixels
- Single-page applications load tracking libraries that persist across navigation
Your marketing team may have only requested analytics on the homepage, but if the implementation uses a global header script, it's running everywhere unless someone explicitly excluded authenticated pages.
Myth 4: "Patients consented when they accepted our website terms"
Reality: HIPAA requires authorization for uses and disclosures not otherwise permitted by the Privacy Rule. That authorization must be specific, informed, and separately signed. It can't be buried in general website terms and conditions.
Both settlements involved allegations that patients didn't provide knowing consent. The lawsuits claimed patients weren't aware their data was being collected and shared with third parties. A blanket "by using this website" notice doesn't meet the HIPAA authorization standard, which requires:
- A description of the information to be used or disclosed
- The names of the persons authorized to make the disclosure
- The names of the persons to whom the covered entity may make the disclosure
- An expiration date
- The individual's signature and date
Even if you're arguing the disclosure doesn't require authorization because it falls under treatment, payment, or operations, you still need to satisfy the minimum necessary standard and document why sharing IP addresses and browsing behavior with advertising platforms serves a permitted purpose.
Myth 5: "We removed the pixel after OCR's bulletin, so we're fine"
Reality: Removing tracking tools now doesn't eliminate liability for past disclosures. The Boone Health settlement covers a 20-month period. Every page load during that time potentially created a separate disclosure event.
You're facing three compliance problems:
First, you may need to conduct breach notification. If the tracking tool transmitted PHI to an unauthorized party and you can't demonstrate a low probability of compromise under the four-factor risk assessment, you're looking at individual notifications and potentially OCR reporting.
Second, you have class action exposure. Both settlements offered affected individuals cash payments ($25 at Fairchild, $20 at Boone Health) plus enrollment in CyEx Privacy Shield Pro for monitoring. Plaintiffs' attorneys are actively seeking these cases.
Third, you have state law considerations. California's CMIA, the California Invasion of Privacy Act, and similar statutes in other states create additional bases for claims beyond HIPAA. These laws often allow private rights of action that HIPAA doesn't provide.
What to do instead
Audit every third-party script running on any page that authenticated users can access. Don't rely on what marketing says they requested. Pull the actual page source and trace what loads.
Implement technical controls that prevent tracking tools from accessing authenticated sessions. Use separate domains for marketing sites and patient portals. Configure tag managers to explicitly exclude portal pages. Set HTTP headers that block third-party cookies in authenticated contexts.
Review your Business Associate inventory and confirm you have signed BAAs for every vendor that might receive PHI. If a vendor refuses to sign a BAA, that's a signal you can't use their tool in contexts where PHI might be transmitted.
Document your minimum necessary analysis for any remaining tracking implementations. If you're using analytics on public health information pages, write down what you're measuring, why it serves treatment/payment/operations, and what technical controls limit the data collected.
Train your IT and marketing teams on what constitutes PHI in digital contexts. They need to understand that "anonymized" in marketing-speak doesn't equal de-identified under Safe Harbor or Expert Determination methods.
The cost of these settlements is small compared to the reputational damage and OCR scrutiny that follows. Your tracking tools shouldn't become your biggest privacy liability.
