In late 2025, Aspen Dental Management agreed to pay $18.7 million to settle a class action lawsuit. The suit claimed Aspen used tracking pixels on its website to share visitor data with Meta and Google without patients knowing or agreeing. (DrBicuspid)
The case, Donnelly v. Aspen Dental Management, covered more than 2 million people who booked appointments on Aspen's website between February 2022 and January 2025. (DrBicuspid)
Settling a case isn't the same as admitting fault. But the lesson for every healthcare marketer is clear. The same tracking code that helps your ads perform can create real legal risk on the wrong pages.
I work with marketing and operations teams at healthcare companies, so I see this from both sides. You need conversion data or your ad spend gets wasted. You also can't send patient data where it doesn't belong. The good news is you can have both.
What a tracking pixel actually does
A pixel is a small piece of code from a platform like Meta or Google. It sits on your website and reports what visitors do. It might report that someone viewed a page, filled out a form, or booked an appointment.
Ad platforms use that data to show your ads to people more likely to act. That's useful.
The problem is what else can go along for the ride:
- The page URL, which might name a condition or service
- Form fields, like a name, phone number, or reason for visit
- Event names that describe a health condition
- Identifiers that can tie that activity back to a real person
On a page about a dental cleaning, that might not seem like much. On a booking form or a patient portal, it can be protected health information.
The key fact: no BAA from Meta or Google
Under HIPAA, a vendor that receives protected health information for you usually needs to sign a business associate agreement, or BAA.
Here's the catch. Meta and Google don't sign BAAs for their standard pixel and analytics products. (DrBicuspid) Meta's own terms forbid sending it health information at all, and Google says it doesn't offer a BAA for Google Analytics. (PathwAI)
So no pixel is HIPAA compliant on its own. It comes down to where you place it and what it sends.
What the rules say today
HHS's Office for Civil Rights published guidance on tracking technologies. Parts of it were challenged in court.
On June 20, 2024, a federal court in Texas ruled in American Hospital Association v. Becerra. The court threw out part of the guidance. Specifically, it rejected the idea that HIPAA kicks in just because tracking links a person's IP address to a visit on a public page about a health condition or provider. (Census Web Studio)
That sounds like good news, and partly it is. But the rest of the guidance still stands. Here's what still applies, per the same summary of the HHS bulletin (Census Web Studio):
- Tracking on logged-in pages, like a patient portal, generally has access to protected health information.
- A tracking vendor that receives protected health information for you is a business associate and needs a BAA.
- A cookie banner isn't a valid HIPAA authorization.
- A vendor promising to strip out patient data after it gets it isn't enough.
Forms, scheduling tools, portal logins, and any place a person types or picks health information are still in scope.
I'm not a lawyer, and this isn't legal advice. Bring your counsel into this. But the operating steps below are a solid place to start.
The pages to check today
Start with the pages where patients share information. These are your highest-risk spots:
- Appointment booking pages
- Contact and "request a callback" forms
- Intake forms and health questionnaires
- Insurance verification forms
- Patient portal login pages, and anything behind a login
If a Meta Pixel, Google tag, session replay tool, or heat map runs on any of these, flag it.
Also check Google Tag Manager. Look for tags set to fire on "all pages." That one setting is often how a pixel ends up on a booking form nobody meant to track. (PathwAI)
How to keep your conversion data safely
Here's the part most teams miss. You don't have to stop measuring ads. You need to change how conversions reach the ad platforms.
These steps come from a practical guide by PathwAI (PathwAI), and they match what I recommend to clients:
- Take pixels off health pages. Keep them, if at all, only on marketing pages that ask nothing personal.
- Send conversions from your server. Meta's Conversions API and Google's Enhanced Conversions accept events from your server. Your server decides which fields go out, so the page URL, the answers, and the condition stay home.
- Send the minimum, hashed. A conversion needs an event, a time, a click ID, and a match key. Google says Enhanced Conversions hash data like email and phone with SHA-256 before it reaches Google. Hash everything you send. Send nothing else.
- Use plain event names. Call it "Lead" or "Booking." Never name an event after a condition or treatment.
- Respect consent. Only send an event for a visitor who agreed to ad tracking. Record when they agreed.
- Put a BAA-covered system in the middle. If you're a covered entity, the system that receives intake answers and builds the conversion should sign a BAA with you.
Census Web Studio adds one more simple rule I like: count that a form was submitted without sending what was typed in it. (Census Web Studio)
Who should own this
In most companies I work with, nobody fully owns the website's tracking. Marketing added some tags. An agency added more. A vendor added a chat widget. IT isn't sure what's running.
That's how a pixel ends up on a booking page for three years.
Pick one owner. Give them this job:
- Keep a list of every script on the website.
- Approve any new tag before it goes live.
- Check high-risk pages every quarter.
- Ask every vendor whether it will sign a BAA. If it won't, keep it off pages that collect health information.
Census Web Studio also suggests adding tracking tools to your HIPAA Security Rule risk analysis. The site says OCR treats that as an enforcement priority in this area. (Census Web Studio)
A one-week audit plan
If you want to move fast, here's a simple plan.
Day 1. List every page where a patient types or picks anything. Include booking, forms, portals, and chat.
Day 2. Run each page through your browser's developer tools or a tag scanner. Write down every script that loads.
Day 3. Open Google Tag Manager. Find every tag set to fire on all pages.
Day 4. Remove ad pixels and session replay from the high-risk pages. Keep a record of what you changed.
Day 5. Bring in your compliance lead or counsel. Plan the move to server-side conversion tracking.
The first four days cost almost nothing. They also cut most of your risk.
The bottom line
The Aspen Dental settlement put a price on something many healthcare marketers had ignored. Pixels on booking and intake pages can send patient data to companies that won't sign a BAA.
You don't have to choose between good ad results and patient privacy. Move pixels off health pages. Send clean, minimal conversions from your server. Give one person the job of watching it.
If you want a second set of eyes on your site's tracking, tell us what's broken. This is the kind of compliance and security work I help client teams with every week.
