Is Your Medical Website Sending Patient Data to Facebook and Google?

If your medical or dental website runs a Facebook pixel or Google ads tags, it is probably telling those companies which condition or treatment pages your visitors look at. That is the default behavior, not a bug, and the FTC has been fining health companies for it since 2023. This is what's happening, who has paid for it, and what a practice can check this week.

How a pixel ends up holding health information

A tracking pixel is a snippet of code that reports what visitors do on your site, so the ad platform can measure and improve your ads. The Meta Pixel and Google's tags both record the URL of every page by default, plus where the visitor came from.

On a hardware store site, that's nothing. On a clinic site, a URL like /services/erectile-dysfunction or /treatments/weight-loss says something about the person reading it. The platform already knows who that browser is. Now it also knows what they looked at.

The four places we see it leak

• The page address. Condition-named URLs travel with every visit.
• Advanced matching. Meta's pixel can pick up email, name, and phone from your forms and send them, hashed, so Meta can match the visit to an account. Meta documents this option.
• Ad click IDs. Google attaches an ID to each ad click that can follow the visitor around your site, tying the click to every treatment page they open.
• Form fields. Google's own help page warns that personal information can end up in analytics when people fill out forms.

Who has already paid for it

The FTC doesn't need HIPAA for this. It has used its own consumer-protection authority against health companies that told users their data was private and then sent it to advertisers. These are the cases that matter for a small practice to know about:

It isn't only settled cases. The FTC sued Hims & Hers on July 29, 2026, along with California and Utah, alleging among other things that the company ran Meta's server-side Conversions API as well as the browser pixel and sent treatment-category data to Meta. Hims denies it and the case hasn't been decided. We mention it because it undercuts the idea that going server-side makes the problem go away.

And in July 2023, HHS's Office for Civil Rights and the FTC sent a joint letter to about 130 hospital systems and telehealth providers, naming the Meta Pixel and Google Analytics as examples of tools that could expose sensitive health data.

What the court actually changed

Some people heard that "a court threw out the HIPAA tracking rules" and relaxed. The real story is narrower. In June 2024 a Texas federal court, in American Hospital Association v. Becerra, vacated one piece of HHS's guidance: the idea that connecting an IP address to a visit to a public, unauthenticated page about a condition automatically creates protected health information. HHS dropped its appeal that August.

That leaves a lot standing. Logged-in patient portals and appointment flows are still a different matter. The FTC's authority didn't change. State laws like Washington's My Health My Data Act are separate. And Meta's own business tools terms prohibit sending health information regardless of what HIPAA says, as does Google's health advertising policy for personalized ads.

This isn't just a hospital problem

A Health Affairs study published in April 2023 looked at the home pages of 3,747 US hospitals and found that 98.6% sent data to third parties. Google's code was on 98.5% of them and Meta's on 55.6%. Hospitals aren't special. A dental office or med spa running the same ad tags is doing the same thing, usually with more condition-specific landing pages and nobody watching.

The ads angle nobody mentions

There's a practical reason to clean this up even if you ignore the legal side. When a platform decides your account is health-related, it limits what it will accept. Meta restricts page detail and events, and Google bars remarketing audiences for health topics. Add three duplicate pixels left behind by old agencies and conversions get counted twice, so your bidding learns from numbers that are wrong. A tidy setup tends to perform better.

What a cleaner setup looks like

• Generic page names. The tag reports "service page," not the condition.
• Advanced matching off unless there's a documented reason for it.
• Renamed events and audiences. Meta's rules go after names that imply a condition, not just the data itself.
• One pixel, one dataset. Remove the leftovers so each conversion counts once.
• Server-side only for approved fields. It's a tool for control, not a loophole.

A checklist for this week

1. List every tag. Meta, Google, Analytics, call tracking, chat, scheduling. Most practices find at least one nobody remembers adding.
2. Read your URLs out loud. If one names a condition or treatment, assume that is being sent.
3. Check advanced matching in your Meta settings.
4. Look at logged-in and booking pages separately. They need the most care, and a legal review.
5. Change one thing at a time and confirm your conversions still record.

Sources

• FTC: Enforcement action to bar GoodRx from sharing consumers' sensitive health info for advertising
• FTC: Final approval of order banning BetterHelp from sharing health data for advertising
• FTC: Alcohol addiction treatment firm Monument banned from disclosing health data for advertising
• HHS: OCR and FTC warn hospital systems and telehealth providers about online tracking technologies
• American Hospital Association: HHS will not appeal AHA court victory in online tracking case
• Health Affairs: Widespread third-party tracking on hospital websites
• Meta: Advanced Matching for the Meta Pixel
• Google Analytics Help: Best practices to avoid sending PII
• Meta: Business Tools Terms
• Google Ads policy: Health in personalized advertising

The Valley Marketing Group is a marketing and technology firm, not a law firm. This is not legal advice. For how HIPAA or state law applies to your practice, talk to an attorney.