A clinic website can leak patient information without anyone typing a record into it. Every ad pixel, analytics tag and retargeting list is a pipe to a third party, and what travels down it is the real subject of healthcare data privacy marketing.
This guide covers what regulators have done, what a federal court took away, and how to set up your tracking so an audit finds nothing awkward. We're a marketing agency, not a law firm, so use it as a map for the conversation with your own counsel.
Where healthcare data privacy marketing goes wrong first
Mostly in what gets sent to ad platforms, not in what gets stored. The FTC's two best-known cases, against GoodRx and BetterHelp, both turned on health details passed to advertising companies after the businesses had told users they wouldn't do it.
In February 2023, the FTC's action against GoodRx alleged that the company shared users' medications and health conditions with Facebook, Google, Criteo, Branch and Twilio. It also uploaded lists of people who had bought heart disease and blood pressure medications, with emails and phone numbers, so it could target them with ads. The penalty was $1.5 million, the first ever under the Health Breach Notification Rule.
BetterHelp's case ran along the same lines. In March 2023 the FTC announced a proposed order after BetterHelp sent email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest. It had also used its customers' email addresses and past-therapy status to have Facebook find lookalike audiences. The $7.8 million went to partial refunds for people who paid for the service.
| Matter | What the sources say happened | Money | What it means for your campaigns |
|---|---|---|---|
| GoodRx (FTC, 2023) | Health data and customer lists shared for ad targeting | $1.5 million penalty | Customer lists built from health purchases are health data |
| BetterHelp (FTC, 2023) | Emails and questionnaire answers sent to ad platforms | $7.8 million for refunds | Lookalike audiences seeded from patients carry the same risk |
| AHA v. Becerra (court, 2024) | One HHS rule on public-page tracking vacated | None | Narrow relief; the rest of the risk remains |
In both FTC cases the orders bar sharing health information for advertising, and they require the companies to get affirmative express consent before sharing it for other purposes.
What did the Texas court actually change?
Less than many marketers assumed. On June 20, 2024, a federal court in the Northern District of Texas ruled in American Hospital Association v. Becerra that one piece of HHS's tracking bulletin exceeded the agency's authority and vacated it.
That piece is the "Proscribed Combination": a tool linking a visitor's IP address to a visit to an unauthenticated public page about a specific condition or provider. The court found HHS had created substantive legal obligations it had no power to create. It also refused to bar HHS from enforcing, and HHS had already revised the bulletin to say it "does not have the force and effect of law."
Then came the appeal. According to Morrison Foerster's summary, HHS filed one on August 19, 2024 and about ten days later moved to dismiss it. The same piece expects wiretap lawsuits against healthcare organizations to continue, calling them a "tsunami," even though plaintiffs may have a harder time using the HHS guidance to argue that tracking data is protected health information.
Our reading: for healthcare data privacy marketing, the ruling removes one argument for one kind of page, and nothing else. It doesn't make a Meta pixel on your appointment form a good idea.
Which pages carry the most risk?
Pages behind a login carry the most risk in healthcare data privacy marketing. Morrison Foerster's advice is to minimize or eliminate tracking technologies on authenticated pages, and the reasoning is easy to follow: once someone is signed in, every click belongs to a named patient.
The same logic applies to anything that collects symptoms, insurance details or a reason for visit, even before a login. A public page about knee replacement with a standard analytics tag is one situation. A booking form that passes the chosen condition to an ad platform is a different one.
A tracking audit you can run this week
A healthcare data privacy marketing audit doesn't need a legal team to find the problems. You need a list of everything your site sends out, and a willingness to delete.
- Inventory every tag. Use your tag manager and a browser's network panel to list each pixel, script and chat widget, and the company behind it.
- Map tags to pages. Note which ones fire on the portal, booking flow and any form that asks about a condition.
- Remove tags from those pages. Keep the ad pixel on the homepage if you must. Take it off everything where a visitor describes their health.
- Review your audience uploads. If a customer or patient list feeds an ad platform, ask what it reveals about their health. Both FTC cases involved exactly this.
- Make your policy match reality. Both companies had promised users something different from what their code did. Write the privacy notice from the audit, not the other way round.
Keep the audit file. If a regulator or a plaintiff's lawyer asks, a dated record of what you removed and why is worth more than a clean-sounding policy.
One more step belongs after the removal: ask the vendors that already received data to delete it. The GoodRx order required the company to direct third parties to delete the health data it had shared, which tells you what the FTC considers a proper clean-up.
Don't borrow trust you haven't earned
Photo by Centre for Ageing Better on Pexels
GoodRx displayed a seal on its telehealth homepage that suggested HIPAA compliance, and the FTC called it false. In healthcare data privacy marketing, skip the badge unless you can show what stands behind it.
The same case found that the company lacked sufficient written privacy and data-sharing policies until a consumer watchdog exposed its practices in February 2020. A policy written after the fact is the weakest form of defence.
Growing patient volume without feeding ad platforms
Healthcare data privacy marketing doesn't have to shrink your patient volume, because plenty of channels work without tracking patients across the web. Structured data helps search engines understand your practice, as we cover in our guide to healthcare schema markup. A well-kept profile does the same job locally; see how to optimise a healthcare Google Business Profile.
AI answers are the newer front. Our piece on appearing in Google AI Overviews for healthcare explains how to earn citations from content alone. And if your team feeds patient or lead data into AI tools, AI data privacy for business covers that exposure.
When paid campaigns are worth keeping, build them around anonymous page-level performance rather than patient lists. Our digital marketing and growth team builds campaign reporting this way, and the audit above is the place to start.
Frequently asked questions
Does the Texas ruling make tracking pixels safe on a clinic site?
No. The court vacated only the rule about linking IP addresses to visits to unauthenticated public pages. Wiretap lawsuits are expected to continue, and the FTC cases show regulators still care about health data sent to ad platforms.
Can a HIPAA badge on my website protect me?
Only if it's true. The FTC alleged GoodRx's homepage seal falsely suggested HIPAA compliance, and that claim was part of the case against it.
Can I use patient lists to build lookalike audiences?
It's a risk. BetterHelp used customers' email addresses and past-therapy status to find similar people on Facebook, and the FTC's proposed order bans it from disclosing health information for advertising, retargeting included. Ask your counsel before uploading any list.
What does the FTC require after a violation like GoodRx's?
The proposed order required GoodRx to stop disclosing health information for advertising, get affirmative express consent for other sharing, keep a posted retention schedule and run a privacy program.
Cover photo by https://kaboompics.com/ on Pexels
Sources
- FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising — Federal Trade Commission
- FTC to Ban BetterHelp from Revealing Consumers' Data — Federal Trade Commission
