HIPAA Enforcement Is Increasing: Why Third-Party Scripts Are the Next Big Target

A healthcare marketer adds a “simple” tracking pixel to an appointment page.

Nothing exotic. Just a script to measure conversions, tune campaigns, and report ROI. The site still looks fine. The forms still submit. Patients keep scheduling.

And somewhere in the background, a third-party script is quietly collecting the kind of context HIPAA teams care about: what page a patient visited, what they clicked, what they typed, what protected information they may have shared and which device they used to do it.

That is the uncomfortable truth about modern tracking: it does not live in analytics dashboards. It lives in the browser, alongside your patient experience, with the ability to observe what patients do in real time.

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) has been signaling for a while that this is not a theoretical problem. Tracking technologies can create compliance exposure when they disclose protected health information (PHI) to third parties. That includes information the individual types, shares or selects while using a regulated entity’s website or app.

The Enforcement Story Has Shifted Toward “Invisible” Disclosures

HIPAA enforcement is often associated with breaches: ransomware, stolen laptops, insider access, misconfigured systems. Those are still very much on the menu, and OCR continues to resolve cases through corrective actions, resolution agreements, and civil money penalties.

But tracking technologies pulled HIPAA into a new kind of enforcement narrative: one where data can leak without a breach event, without an attacker, and without anyone “intending” to disclose PHI.

OCR’s tracking technology guidance frames the issue plainly: tracking technologies are scripts or code on websites and mobile apps that gather information about users or their actions, and regulated entities can end up disclosing PHI to tracking technology vendors through them.

Then OCR and the Federal Trade Commission (FTC) did something that made the point harder to ignore: they sent joint warning letters to roughly 130 organizations about online tracking tools and “serious privacy and security risks,” including impermissible disclosures of sensitive health information.

“But Those Are Just Marketing Tools” Is Not a Defense

The reason this keeps getting messy is that healthcare teams often categorize tracking as “marketing,” and compliance as “HIPAA (Health Insurance Portability and Accountability Act).” Different owners, different budgets, different priorities. Regulators don’t care how your org chart is drawn.

From OCR’s perspective, the question is whether the data disclosed through tracking technologies is PHI, and whether disclosures are permitted under HIPAA (or require a business associate agreement, an authorization, or both depending on the facts).

And from the FTC’s perspective, the question is whether companies are sharing sensitive health data for advertising in ways that contradict consumer expectations or their own promises (the BetterHelp case is the poster child here).

The Court Case Narrowed One Point, Not the Risk

In American Hospital Association v. Becerra, a federal court invalidated a key part of OCR’s bulletin as applied to certain unauthenticated webpages, and OCR ultimately withdrew its appeal. Some organizations treated that as a green light to go back to business as usual, and THAT was a risky interpretation.

Even legal analyses that describe the decision as meaningful generally stress the narrowness: the decision did not wipe out the broader compliance problem, and it does not end the wave of pixel lawsuits. Most importantly, it does not change the highest-risk scenario: authenticated experiences (patient portals, MyChart pages, billing portals, telehealth flows) where users are logged in and the “what they did on the page” context is more likely to be PHI.

Plaintiffs’ Attorneys Already Moved In

Even when regulators move carefully, plaintiffs move fast. Hospitals and health systems have been sued for allegedly disclosing patient information to third parties via pixels and similar tracking technologies. Some have settled.

A few examples that show how expensive this can get:

• Advocate Aurora’s settlement notice describes allegations tied to tracking pixels on its websites (and the covered time period), the exact kind of fact pattern plaintiffs build cases around.
  
• The Christ Hospital’s settlement site likewise frames the dispute as alleged disclosure of PHI, which is exactly the narrative these cases hinge on.
  
• Becker’s compiled multiple pixel-related settlements across health systems, underscoring that this is not an isolated “one weird lawsuit” trend.
  

Regulators do not need to “win” every edge case to make this painful. Litigation and reputational damage do that on their behalf.

Why Third-Party Scripts Are the Next Big Target

Third-party scripts are an easy enforcement and litigation target because they sit at the intersection of three realities:

First, healthcare websites are no longer just “content.” They are interactive systems where patients schedule appointments, look up conditions, message providers, pay bills, register for services, and fill out forms.

Second, tracking technologies are code that runs in the user’s browser. They can observe user actions and page context at the moment it happens, including information users type or select.

Third, those scripts often transmit data off-domain to vendors that were never vetted as business associates, and that do not expect to be treated like HIPAA-bound recipients.

That combination creates a compliance risk that behaves a lot like a supply chain issue: one line of third-party code can expand data exposure in ways your internal teams did not model.

Where “Tracking Exposure” Usually Shows Up in Healthcare

Not every page carries the same risk. The danger clusters around pages that combine (1) identity or device data with (2) health context.

Common hotspots include:

• Appointment scheduling and “find a doctor” flows
• Patient portal and billing portal pages (especially authenticated areas)
• Telehealth registration and waiting rooms
• Symptom checkers and intake questionnaires
• Campaign landing pages that imply a condition or service line (for example, oncology, fertility, behavioral health)

OCR’s guidance is explicit that, in some cases, tracking on unauthenticated webpages can still involve PHI, depending on what the tracking technology can access and disclose. So the safer assumption is not “public page equals safe.” The safer assumption is “assess what data is actually being disclosed.”

What To Do Now (Without Burning Down Marketing)

The goal is not to ban analytics. The goal is to stop accidental PHI disclosure through third-party code and to be able to prove you did the work.

Here’s a practical starting point:

• Inventory every tracking technology and third-party script across web and mobile, including what is deployed via tag managers. (If you cannot list it, you cannot control it.)
  
• Map data disclosure, not just vendors. Identify what each script collects (URLs, form field values, button clicks, identifiers) and where it sends data. OCR specifically warns that disclosures can include information a user types or selects.
  
• Separate high-risk experiences from “marketing-safe” pages. Patient portals, billing portals, and intake flows should be treated differently than generic news pages.
  
• Decide whether vendors are business associates. If a vendor is receiving PHI on your behalf, HIPAA expectations change (and “they’re just analytics” stops being relevant).
  
• Treat this as a Security Rule risk analysis topic, not just a privacy policy update. OCR routinely brings enforcement actions tied to risk analysis and risk management failures, even outside the tracking context.
  
• Put monitoring and change control around scripts. Today’s “approved” tag stack can drift next week through marketing changes, A/B tests, or vendor updates.
  

If your organization is still thinking about pixels as a marketing optimization issue, you are already behind the enforcement curve. Regulators and plaintiffs have moved on. They are treating third-party scripts as a data disclosure mechanism.

And that is exactly why they are the next big target.

The complexity of third-party script behavior often creates a compliance blind spot on sensitive healthcare pages. Source Defense provides visibility and control over client-side execution, helping teams inventory scripts, map data disclosures, and protect patient information at the point of input. This proactive approach helps support HIPAA risk management requirements and simplifies audit preparation by identifying unauthorized script modifications in real time. Schedule a demo with a security expert to see how our platform helps reduce compliance exposure: https://sourcedefense.com/request-demo/