Reference
The scanner checks for the 21 tracking technologies below. The determining question for each is not whether the tool is popular but whether its vendor will sign a business associate agreement, and whether the data it collects can be separated from protected health information. 11 of these have no compliant client-side configuration on patient-facing pages. 8 can be used with a signed BAA and correct exclusions. 2 are purpose-built for regulated environments.
| Tool | Vendor | BAA | Status on patient-facing pages |
|---|---|---|---|
| Google Ads Conversion | Not offered | Not compliant | |
| Google Analytics | Not offered | Not compliant | |
| Hotjar | Hotjar | Not offered | Not compliant |
| LinkedIn Insight Tag | Not offered | Not compliant | |
| Meta Pixel | Meta | Not offered | Not compliant |
| Microsoft Ads UET | Microsoft | Not offered | Not compliant |
| Microsoft Clarity | Microsoft | Not offered | Not compliant |
| Pinterest Tag | Not offered | Not compliant | |
| Snapchat Pixel | Snap | Not offered | Not compliant |
| TikTok Pixel | TikTok | Not offered | Not compliant |
| X / Twitter Pixel | X | Not offered | Not compliant |
| Drift | Salesloft | Available | Conditional |
| FullStory | FullStory | Available | Conditional |
| Google Tag Manager | Not offered | Conditional | |
| Heap | Heap | Available | Conditional |
| HubSpot Tracking | HubSpot | Available | Conditional |
| Intercom | Intercom | Available | Conditional |
| Mixpanel | Mixpanel | Available | Conditional |
| Segment | Twilio | Available | Conditional |
| Curve | Curve | Available | Compliant |
| Freshpaint | Freshpaint | Available | Compliant |
These vendors do not offer a business associate agreement covering the product. Running them in the browser on patient-facing pages discloses protected health information without a lawful basis.
Google Ads Conversion is not HIPAA compliant on patient-facing pages. Google does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Reports conversion events and user signals to Google from the browser, where the page context often is the PHI.
Remediation. Move to Enhanced Conversions through server-side GTM, or import conversions offline after scrubbing.
Google Analytics is not HIPAA compliant on patient-facing pages. Google does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Collects IP address, full page URLs, and behavioral data. Google will not sign a BAA covering Analytics, so patient-facing use has no contractual basis.
Remediation. Move to an analytics tool that will sign a BAA — self-hosted PostHog, Freshpaint, or Piwik PRO. If GA has to stay, route it through server-side GTM with URL and parameter scrubbing.
Hotjar is not HIPAA compliant on patient-facing pages. Hotjar does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Records sessions including cursor movement, clicks, and keystrokes in form fields. On intake or booking flows this captures PHI directly.
Remediation. Remove it from every patient-facing page. If you need session replay, use a vendor that will sign a BAA and configure field-level exclusions.
LinkedIn Insight Tag is not HIPAA compliant on patient-facing pages. LinkedIn does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Tracks page visits and can associate browsing with a named LinkedIn profile. No BAA is offered.
Remediation. Remove the tag and use the Conversions API for server-side event reporting.
Meta Pixel is not HIPAA compliant on patient-facing pages. Meta does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Sends page URLs, clicks, and form interactions to Meta. On patient-facing pages this can transmit conditions searched, providers viewed, and appointments booked.
Remediation. Remove the browser-side pixel and move to the Conversions API, with PHI stripped server-side before any event leaves your infrastructure.
Microsoft Ads UET is not HIPAA compliant on patient-facing pages. Microsoft does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Reports page visits and conversions to Microsoft Advertising. No BAA covers the standard UET tag.
Remediation. Remove the tag and use offline conversion import instead.
Microsoft Clarity is not HIPAA compliant on patient-facing pages. Microsoft does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Free session recording and heatmaps. Microsoft does not offer a BAA covering Clarity.
Remediation. Remove it from every patient-facing page.
Pinterest Tag is not HIPAA compliant on patient-facing pages. Pinterest does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Sends browsing activity to Pinterest. No BAA is offered.
Remediation. Remove the tag and use the Conversions API server-side.
Snapchat Pixel is not HIPAA compliant on patient-facing pages. Snap does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Reports page views and events to Snap. No BAA is offered.
Remediation. Remove the tag and use the Conversions API server-side.
TikTok Pixel is not HIPAA compliant on patient-facing pages. TikTok does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Transmits page visits and user identifiers to TikTok. No BAA is offered.
Remediation. Remove the browser-side pixel and use the Events API server-side with PHI stripped.
X / Twitter Pixel is not HIPAA compliant on patient-facing pages. X does not offer a business associate agreement, so there is no lawful basis for the disclosure.
Exposure. Reports page visits and conversions to X. No BAA is offered.
Remediation. Remove the tag and report conversions server-side instead.
These vendors will sign a business associate agreement on qualifying plans. The agreement alone is not sufficient — capture rules still have to exclude protected health information.
Drift can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from Salesloft and PHI excluded from what it captures.
Exposure. Chat captures visitor identity and conversation content.
Remediation. Confirm BAA availability for your plan, and keep clinical conversations out of the widget.
FullStory can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from FullStory and PHI excluded from what it captures.
Exposure. Session replay. A BAA is available on enterprise plans, but recordings still capture PHI unless exclusion rules are set on every health-related field.
Remediation. Confirm the BAA, then audit that exclusion classes cover all intake, symptom, and booking inputs.
Google Tag Manager carries HIPAA risk on patient-facing pages.
Exposure. A container rather than a tracker. The exposure comes from whatever it loads, which is usually Analytics and one or more ad pixels.
Remediation. Inventory every tag in the container, then move the container server-side so scrubbing happens before data reaches any vendor.
Heap can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from Heap and PHI excluded from what it captures.
Exposure. Autocaptures every interaction by default, which means it captures PHI by default. A BAA is available on Pro and Premier only.
Remediation. Confirm the plan and BAA, then replace autocapture with an explicit allowlist of events.
HubSpot Tracking can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from HubSpot and PHI excluded from what it captures.
Exposure. Captures page views, form submissions, and visitor identity. HubSpot will sign a BAA, but only on Enterprise with the HIPAA add-on enabled.
Remediation. Confirm the HIPAA add-on is active and the BAA is executed. Without it, pull the tracking code off patient-facing pages.
Intercom can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from Intercom and PHI excluded from what it captures.
Exposure. Chat captures conversation content and browsing context. Patients routinely describe symptoms in chat.
Remediation. Confirm the BAA covers your plan, and route anything clinical to a channel built for it.
Mixpanel can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from Mixpanel and PHI excluded from what it captures.
Exposure. Event tracking with user properties. A BAA is available on enterprise plans.
Remediation. Confirm the BAA and audit event properties so no health context is passed.
Segment can be used in a HIPAA-regulated environment, but only with a signed business associate agreement from Twilio and PHI excluded from what it captures.
Exposure. Routes events to downstream tools. A BAA is available on Business, but your exposure is really the sum of every destination it feeds.
Remediation. Confirm the BAA, then audit each destination. A compliant pipe into a non-compliant vendor is still a disclosure.
These are governance layers designed for healthcare advertising. They sit between the site and ad platforms and strip protected health information before forwarding.
Curve is built for HIPAA-regulated use. Curve will sign a business associate agreement.
Exposure. Server-side tracking built for healthcare advertisers.
Remediation. No action needed beyond confirming the BAA is executed.
Freshpaint is built for HIPAA-regulated use. Freshpaint will sign a business associate agreement.
Exposure. A governance layer built for healthcare. It sits between the site and ad platforms and strips PHI before forwarding.
Remediation. No action needed beyond confirming the BAA is executed and the blocking rules cover every destination in use.
It depends on what the page reveals. A pixel on a general marketing page carries limited risk. The same pixel on a page about a specific condition, a provider's profile, or an appointment booking flow transmits the fact that an identifiable person sought care for something. That combination — an identifier plus a health context — is protected health information, and sending it to a vendor without a business associate agreement is a disclosure.
Generally yes. HIPAA's identifier list includes IP addresses and device identifiers. Most tracking tools transmit both by default, alongside the page URL, which is what supplies the health context.
No. Server-side tracking relocates where the data is assembled; it does not decide what gets sent. A server-side setup that forwards the same URLs and identifiers to the same vendor creates the same disclosure. What makes it compliant is the scrubbing applied before forwarding, plus a business associate agreement with any vendor still receiving data.
Not on its own. HIPAA requires a valid authorization, which is a specific document with defined elements. A cookie consent banner does not meet that standard, and the Office for Civil Rights has said as much in its guidance on tracking technologies.
No. A scan of server-returned HTML cannot see scripts injected later by JavaScript, loaded by a tag manager after a delay, or held back by a consent manager until a visitor interacts. A clean result narrows the question. It does not close it.