10 places your practice website may be leaking patient data

Practices running Google Analytics or a Meta pixel on their websites got what looked like a clean win in 2024. A federal judge in Texas vacated a core portion of federal regulators' guidance on online tracking technologies, holding that the agency had exceeded its authority under HIPAA, and the Office for Civil Rights withdrew its appeal two months later.

The win was narrower than the headlines suggested. The court struck a specific theory: that an IP address combined with a visit to an unauthenticated page about a health condition amounts to protected health information. The rest of the guidance survived, including its treatment of authenticated patient portal pages. And none of it touched the plaintiffs' bar, which has kept filing under state wiretapping and privacy statutes. Kaiser Permanente agreed to pay up to $47.5 million to resolve consolidated claims over trackers on its websites and mobile apps.

That is the part most practices have missed. The federal question got easier and the civil exposure did not move. Meanwhile very few independent practices have ever inventoried what is actually running on their own site, and the marketing vendor who installed it is often long gone. Here are 10 places to look.