What can you say
Is the Meta pixel HIPAA compliant for a treatment or health site?
The pixel is not banned, but on the wrong page it hands Meta a disclosure you were never allowed to make.
Not by default, and rarely on a booking page. Meta uses pixel data for its own advertising and will not sign a HIPAA business associate agreement. On a page with identifiable health context, the pixel can disclose protected health information with no BAA or authorization. Compliance is a configuration problem, not a certification you can buy.
The question is not certification but whether a given page lets the pixel see protected health information. HIPAA's baseline is strict: a covered entity may not use or disclose PHI except as the Privacy Rule permits, and a disclosure that fits no permission needs the individual's written authorization. Sending data to Meta so it can target ads is neither treatment, payment, nor health care operations, and Meta processes that data for its own purposes rather than solely on your behalf, so a business associate agreement is not available to cover it. That leaves two honest paths on any page that touches health context: either no PHI reaches the pixel, or you hold a valid HIPAA authorization. A cookie banner does not close the gap, because OCR has said a banner asking visitors to accept tracking is not a valid HIPAA authorization.
A covered entity may not use or disclose protected health information except as permitted or required by the Privacy Rule; a disclosure that is not otherwise permitted requires a valid authorization.
The HHS Office for Civil Rights bulletin on online tracking technologies, issued December 1, 2022 and revised March 18, 2024, drives every pixel conversation in health care. It told covered entities that tracking vendors receiving PHI are business associates, that authenticated pages behind a login are treated strictly, and that HIPAA could attach on an unauthenticated public page when a tracker tied a visitor's IP address to a visit to a page about a specific condition or provider. That theory did not survive: on June 20, 2024, a federal court in American Hospital Association v. Becerra vacated the proscribed combination, the IP-plus-condition-page rule, as beyond the agency's authority, and OCR withdrew its appeal on August 29, 2024. The rest still stands, so authenticated pages, patient portals, and any page where a user submits health information remain covered, and the vacatur narrows the gray zone but does not bless a pixel on a page where identifiable health data is entered.
Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors.
On a standard appointment or intake page, when a visitor selects a service and submits, the pixel can fire an event carrying more than a marketer intends. The three tiers below are the payload that turns an ad tool into a HIPAA disclosure, because together they let Meta connect an identifiable person to a specific health interest. The risk lives in the fields your own form collects, which is why a generic answer about the pixel does not help a treatment advertiser.
- Who the person isIP address, and often a hashed email, phone, or Meta cookie ID, any of which can re-identify the visitor on Meta's side.
- What page they were onThe URL and page title, which on a condition or service page announce the specific treatment being sought.
- What they enteredSelected service, appointment type, or intake answers passed through the event, the health fact the disclosure is built on.
Even where the vacatur narrows HIPAA, state consumer-health-privacy law has moved in, and it does not carry HIPAA's carve-outs. Washington's My Health My Data Act reaches consumer health data far beyond covered entities, bans geofencing around health facilities, and, unusually, gives individuals a private right of action through the state Consumer Protection Act, so a misconfigured pixel becomes plaintiff-driven litigation risk, not only a regulator's file. The fix is the same everywhere: keep advertising tags off pages that collect or reveal health context, run conversions server-side with health fields stripped, and gate any remaining marketing tag behind real, informed consent. Our overview of the federal marketing layer covers how these privacy duties sit alongside EKRA and Part 2.
| State | How it differs | Citation |
|---|---|---|
| Washington | My Health My Data Act covers consumer health data beyond HIPAA, bans health geofencing, and allows a private right of action. | RCW 19.373 (eff. Mar. 31, 2024; geofencing Jul. 23, 2023) |
| California | Confidentiality of Medical Information Act and CCPA add duties and statutory damages for improper sharing of health and personal data. | Cal. Civ. Code 56 et seq.; Cal. Civ. Code 1798.100 et seq. |
| Most states | HIPAA sets the floor; a pixel that discloses PHI is exposed even without a specific state statute. | 45 CFR 164.502, 164.508 |
The scanner cannot see your tag manager, it reads the page for the signals that mean a pixel is likely receiving health context.
A booking page for outpatient detox loads the Meta pixel, so when a visitor picks a condition and submits the form, their IP, hashed email, the page title, and the treatment requested are sent to Meta with no BAA and no authorization.
That transmission tells an advertising vendor that an identifiable person sought a specific treatment, which is PHI leaving the covered entity with no Privacy Rule permission and no authorization, and no BAA is available because Meta uses the data for itself.
A tracking pixel on a booking or condition page can disclose PHI to a third party without a BAA or authorization. · 45 CFR 164.502, 164.508; HHS OCR Bulletin on Online Tracking Technologies (2022, rev. 2024)
The booking flow reports conversions server-side with health fields removed, marketing tags load only after separate informed consent that is not a cookie banner, and any vendor that could touch PHI is under a signed BAA.
No identifiable health information reaches Meta, so there is no impermissible disclosure, and consent plus a BAA cover whatever non-health signals remain.
Sources
Pre-Trip is a rigorous screen, not legal advice. Counsel decides; we help you arrive prepared.