apointoo.
Request access
HIPAA

Healthcare Tracking Pixels After American Hospital Association v. Becerra

cmsapointoo··9 min read

The court decision in American Hospital Association v. Becerra did not give healthcare organizations general permission to use tracking pixels. The court vacated one specific position in HHS guidance: that an IP address combined with a visit to an unauthenticated public page about a condition or provider automatically triggers HIPAA obligations because that combination is individually identifiable health information.

The holding does not classify every other page or payload. Authenticated pages, appointment forms, symptom tools, user-entered details, and vendor disclosures need fact-specific review.

What did the district court actually vacate?

The June 20, 2024 opinion came from the United States District Court for the Northern District of Texas. The dispute focused on HHS guidance for online tracking technologies used by HIPAA covered entities and business associates. The court called the challenged part the “Proscribed Combination.” It joined two facts: an individual’s IP address and a visit to an unauthenticated public webpage that addressed a specific health condition or listed healthcare providers.

The court held that this combination fell outside the statutory definition of individually identifiable health information when HHS treated it as sufficient based on the visitor’s unknowable subjective reason for viewing the page. The final order declared that position unlawful because HHS had acted beyond its HIPAA authority. It denied a permanent injunction but granted vacatur of the Proscribed Combination.

The order was precise about scope. A footnote said the vacatur was not intended to limit the legal operation of other guidance in the bulletin. HHS later moved to dismiss its own appeal, and the Fifth Circuit dismissed it on September 4, 2024 under Federal Rule of Appellate Procedure 42(b). That left the district court’s vacatur operative, but the Fifth Circuit issued no merits opinion controlling later tracking disputes.

What the decision did not decide

The court did not hold that IP addresses can never be part of protected health information. It did not decide that every public healthcare page is outside HIPAA. It did not approve a particular pixel, analytics vendor, advertising platform, consent banner, business associate agreement, or data flow.

The opinion also did not erase the definitions in 45 CFR 160.103. Individually identifiable health information still turns on whether information is created or received by a listed actor, relates to health, healthcare, or payment, and identifies the individual or supplies a reasonable basis to identify the individual. Protected health information remains individually identifiable health information transmitted or maintained in a covered form, subject to stated exclusions.

Those definitions make the payload and context decisive. A page view carrying only the vacated combination differs from a request containing an email address, appointment date, selected service, symptom response, patient portal identifier, or other information tied to care. The article on health tracking outside HIPAA explains why falling outside one federal definition does not resolve every privacy or platform question.

How the current HHS bulletin should be read

HHS keeps its online tracking bulletin available and now opens it by describing the court order. The bulletin states that the court vacated the guidance to the extent it treated the Proscribed Combination as triggering HIPAA obligations. It also says HHS is evaluating next steps.

The bulletin separately discusses authenticated pages, public pages, mobile apps, permitted disclosures, business associate agreements, security safeguards, and breach analysis. HHS says trackers on authenticated pages generally have access to protected health information. It also gives appointment and symptom-checker examples involving information entered on public pages.

That material is agency guidance, not the court’s holding. The bulletin itself says its contents do not have the force and effect of law and are intended to clarify existing requirements or agency policy. A careful article should therefore label each proposition. The court’s order controls the vacatur. The regulations supply the underlying legal rules. The HHS bulletin describes OCR’s current guidance and enforcement perspective.

Why page labels alone are unreliable

Calling a page “public” does not describe everything a tracker can receive. A public location page may expose only a URL and ordinary device information. A public appointment page may add a chosen clinician, visit reason, date, contact detail, or confirmation state. Both are unauthenticated, but their payloads are different.

The same problem appears when teams classify a whole website at once. Shared scripts can run on pages with different purposes and inputs. A tag rule may include URL parameters, element text, entered values, or identifiers that a screenshot does not reveal. A server relay can add context later.

Use a page and payload inventory instead. For each route, record whether the person is authenticated, what the page reveals, what the person can enter, which scripts execute, which fields leave, who receives them, and why. This is an editorial control method, not a test prescribed by the court. It gives legal, privacy, and engineering reviewers facts they can evaluate.

How vendor and purpose analysis still applies

When a tracker receives protected health information on behalf of a regulated entity for a covered function or specified service, the business associate question remains. A signed agreement does not create a business associate relationship when the regulatory definition is not met, and the absence of an agreement does not change a vendor’s actual role. The relationship, information, and purpose need to be mapped.

Section 164.502 continues to govern permitted and prohibited uses and disclosures of protected health information. It also applies the minimum necessary standard to many uses, disclosures, and requests, subject to listed exceptions. The court did not replace those rules with a general permission for tracking.

Authorization and product permission remain separate gates as well. A cookie banner is not automatically a HIPAA authorization, and an authorization does not compel an advertising platform to accept health-related conversion data. See HIPAA authorization, privacy consent, and Google Ads permission for that boundary. Hashing also does not settle purpose or eligibility, as explained in the clinic form hashing review.

A practical review sequence after the case

  1. Identify the regulated entity and the exact website, app, or embedded flow under review.
  2. Inventory routes individually instead of assigning one label to the domain.
  3. Capture the actual outbound request with synthetic data and list every field, header, parameter, identifier, and value added by later processing.
  4. Separate the vacated IP plus public-page combination from any additional fact that may relate the visit to a person’s health or care.
  5. Map each recipient, its role, the proposed purpose, and any business associate agreement or other contract.
  6. Review the use or disclosure under the current regulation, then consult current HHS guidance without presenting it as a judicial holding.
  7. Keep delivery disabled while a material fact, permission, contract, or destination remains unresolved.
  8. Retest when page content, tag configuration, vendor behavior, URL structure, or event meaning changes.

This sequence is editorial advice. It prevents two opposite errors: treating the vacated position as if it still controlled every public page, or treating the decision as permission to send any healthcare interaction to a third party.

What evidence should support a deployment decision?

A defensible record connects the legal question to observed behavior. Keep the route inventory, synthetic capture, tag configuration, destination, vendor terms, agreement status, purpose, reviewer, source date, and approval limits together.

Use claim-specific language. A team may document that a request lacked health-related information during a defined test. It should not turn that result into “the website is HIPAA compliant.” A vendor’s promise to remove data later does not answer whether the initial disclosure was permitted.

If the proposed route reaches Google advertising products, remember that a Google Cloud agreement does not extend to Google Ads. The Google Cloud BAA boundary shows why provider, product, and destination evidence must remain separate.

Frequently asked questions

No. The court vacated one HHS position about a specific combination of information. Whether another tracker use is permitted depends on the actual information, actors, purpose, rule, and facts.

Is an IP address never protected health information after the decision?

The decision does not establish that rule. It rejected automatic treatment of the Proscribed Combination. An IP address can appear with other information and in other contexts that require separate analysis under 45 CFR 160.103.

Can a hospital keep trackers on authenticated pages?

The case did not approve that practice. HHS guidance says authenticated pages generally expose protected health information to tracking technologies. Review the actual disclosure, permission, safeguards, vendor role, and contract before deployment.

Does the HHS bulletin still matter?

Yes, as current agency guidance subject to the court’s vacatur. It is useful evidence of OCR’s published position, but it is not the court’s holding and says it does not have the force and effect of law.

References

Related articles