A 2024 court decision vacated part of HHS's guidance on online tracking, the part about public, unauthenticated pages. Tracking on patient portals and in apps that handle PHI is still covered, most ad and analytics vendors will not sign a BAA, and the FTC brings its own cases. What is still risky and the setup we would use instead.
In December 2022 HHS told providers that tracking technologies on their websites and apps could disclose PHI to vendors such as ad platforms, and updated that guidance in March 2024. On June 20, 2024, a federal court in Texas (American Hospital Association v. Becerra) vacated the part covering one scenario: a visitor's IP address combined with a visit to a public page about a health condition, where the visitor has no relationship with the provider. The rest still stands.
Authenticated pages: patient portals, scheduling flows, bill pay, telehealth. Data there is tied to a patient.
Mobile apps offered by covered entities that handle PHI.
Any page or app where the provider knows who the visitor is, such as from a login, a form or an appointment link.
Consumer health apps outside HIPAA, under the FTC's Health Breach Notification Rule and its enforcement against health companies that shared data with advertisers.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
If PHI reaches a vendor, that vendor needs a BAA. Most advertising and mainstream analytics vendors do not offer one for those products. Google, for example, states that it does not offer BAAs in connection with Google Analytics. So the practical rule is simple: no third-party tags where PHI can be present, unless the vendor has signed a BAA for that product.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your Health App Is Not Covered by HIPAA. The FTC's Breach Rule Probably Covers It
Consumer health apps that are not covered entities or business associates still fall under the FTC's Health Breach Notification Rule, amended in 2024 to name health apps and connected devices explicitly. A "breach" includes sharing data without authorization, such as through analytics and ad SDKs. Who is covered, the 60-day clock, penalties of up to $53,088 per violation, and what to check in your app.
Read
EKS for HIPAA in 2026: What the BAA Covers and What You Still Have to Configure
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.