{"page":"/blog/pixel-problem-healthcare-marketing","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Page or event","What the tag typically captures","HIPAA (covered entities)","FTC Act and HBNR (everyone)","State CHD laws","Litigation theories seen"],"rows":[["Patient portal login and logged-in pages (MyChart and similar)","Login event, portal URLs, name, provider, appointment time, test result pages","PHI; OCR bulletin position not affected by the 2024 ruling (Shook Hardy & Bacon, 22 March 2024)","Deception if the privacy policy promised otherwise","Health data; sharing without separate consent","Wiretap Act, state wiretap, CMIA, breach of confidence (Advocate Aurora, Novant, Atrium, Wellstar portals)"],["Appointment scheduling and \"find a doctor\"","Specialty, provider name, location, date, button text","PHI once an identifier is present; NewYork-Presbyterian case (NY AG, 27 December 2023)","Same","Health data (seeking health services)","Same; AmWell booking tool case (HIPAA Journal, 24 September 2026)"],["Condition and treatment pages (unauthenticated)","URL path with condition name, time on page, IP","Not PHI for an anonymous visitor after AHA v. Becerra; PHI if the visitor is identifiable to the entity (AHA, 20 June 2024)","Healthline: article titles revealing a diagnosis treated as sensitive (California AG)","Health data under \"status\" definitions (WA, NV, MD); depends on specificity elsewhere","Wiretap claims survive pleading in some courts; Sweat v. Houston Methodist dismissed only after discovery (S.D. Tex., 22 September 2025)"],["Symptom checkers, quizzes, eligibility and intake forms","Answers, score, field names, \"form completed\" event","PHI if a covered entity","Core of GoodRx, BetterHelp, Cerebral, Hims & Hers allegations (IAPP, 31 July 2026)","Health data at the moment of input","Deception, unfairness, HBNR breach"],["Pharmacy, prescription and refill flows","Drug name, refill event, order value","PHI","GoodRx ($1.5M) and Cerebral facts","Health data; sale rules if monetized","Wiretap, CMIA (CVS and Criteo case)"],["Mental health, substance use, reproductive and sexual health services","Service pages, booking, chat starts","PHI; 42 CFR Part 2 may add restrictions for substance-use programs","BetterHelp ($7.8M), Monument, Cerebral, Premom","Highest-sensitivity category; geofence bans around these facilities in CT and MD","Same; highest settlement values per class member"],["Telehealth visit start, chat, video","Session start, provider, reason for visit","PHI","Cerebral; Hims & Hers","Health data","CIPA (recording), wiretap"],["Billing and payment","Account number in URL, amount, insurer","PHI (payment for care is PHI)","Deception","Health data where it reveals services","Wiretap, breach of contract"],["Health-condition email and SMS links","Click with campaign ID that encodes the condition","PHI if the list is patient-derived","HBNR for non-covered entities","Health data; CAN-SPAM and TCPA apply separately","Wiretap"],["Loyalty and front-store purchases at a pharmacy","SKU-level purchases (e.g., test kits, supplements)","Not PHI unless tied to the pharmacy record","Inference of health status","\"Status\" definitions reach inferred health (Holland & Knight on loyalty records, 25 August 2026 (H&K))","Emerging"],["Geolocation near a facility","Device location, dwell","Not HIPAA for most actors","FTC orders against Gravy Analytics and Mobilewalla, 14 January 2025 (Hunton, 4 February 2025)","Geofence bans: WA 2,000 feet; NV, CT, MD 1,750 feet","MHMDA class action against Amazon SDK (filed 10 February 2025)"]],"sourceUrls":[["https://www.shb.com/intelligence/client-alerts/pds/march-2024-revised-ocr-bulletin-saikali"],["https://ag.ny.gov/press-release/2023/attorney-general-james-secures-300000-newyork-presbyterian-hospital-failing","https://www.hipaajournal.com/cvs-health-criteo-american-wellness-corp-data-breach-settlements/"],["https://www.aha.org/news/news/2024-06-20-judge-rules-favor-aha-vacating-hhs-online-tracking-bulletin-unlawful-and-beyond-agency-authority","https://oag.ca.gov/privacy/privacy-enforcement-actions","https://blogs.duanemorris.com/classactiondefense/wp-content/uploads/sites/56/2025/09/Sweat-v.-Houston-Methodist-Hospital-Opinion.pdf"],["https://iapp.org/news/a/a-view-from-dc-the-ftc-sues-hims-over-pixel-tracking"],[],[],[],[],[],["https://www.hklaw.com/en/insights/publications/2026/08/the-pixel-problem-advertising-triggers-health-data-obligations"],["https://www.hunton.com/privacy-and-information-security-law/ftc-finalizes-orders-against-data-brokers-over-sensitive-location-data"]]}