Tracking Exposure Scan

Three findings that matter most

Findings

Severity assumes a health-context site with no verified mitigation (consent gating, BAA, server-side relay). Everything below is observable by any visitor’s browser — this scan used no privileged access.

Side by side: what a compliant setup looks like

The same scan, run the same day, against a HIPAA-conscious build we operate for a Medicare telehealth practice (name available on request). It meets the stricter covered-entity bar — and still measures everything.

The legal backdrop

• Who HIPAA actually covers — and the cash-pay misconception. HIPAA coverage is decided at the entity level, never by how a patient pays. A provider that transmits health information electronically in connection with any covered transaction (billing a health plan, checking eligibility) is a covered entity for every patient — cash-pay patients included (45 CFR §160.102). Only a practice that never conducts those transactions sits outside HIPAA — a structure some DTC telehealth companies attempt; it is fragile, unverifiable from the outside, and the technology platform serving covered providers is typically still regulated as a business associate. Where HIPAA genuinely does not apply, the FTC and state laws below take over.⁹
• FTC enforcement — HIPAA status irrelevant. FTC v. GoodRx — $1.5M and FTC v. BetterHelp — $7.8M, for sharing health data with ad platforms via pixels; FTC v. Cerebral — $7M and Monument followed. All are cash-pay or direct-to-consumer businesses — the FTC’s Health Breach Notification Rule and Section 5 reach companies whether or not HIPAA applies to them.^1,2
• Private litigation is the larger exposure. In re Meta Pixel Healthcare Litigation spans dozens of suits; disclosed health-system settlements run roughly $4M–$12.2M each, with new settlements continuing through mid-2026. In July 2026 a federal court rejected the consent defense and sent prescription-pixel claims against Google and Meta into discovery.^5,6,7,8
• Intake funnels are the current focus. A congressional inquiry is examining telehealth companies whose trackers shared visitors’ answers to medical intake questions. Trackers on assessment and consultation flows are the highest-scrutiny placement on a health site.⁶
• Wiretap statutes keep claims alive. State wiretap and pen-register theories (California’s CIPA — $5,000 per violation — and peers) continue to generate filings through 2026; the pending California amendment narrows only pen-register private claims, and no earlier than 2027.
• HIPAA still applies where real health data flows. A 2024 federal ruling (AHA v. Becerra) vacated OCR’s position that an IP address plus an unauthenticated health-page visit is itself PHI, and HHS dropped its appeal. But for covered entities, transmitting actual identifiable health information — form entries, quiz answers, authenticated-page activity — through trackers remains regulated.^3,4
• State health-privacy laws ignore payment entirely. What matters to the states is the health data, not the payment rail. California deems any business offering consumers software to maintain medical information a “provider of health care” under CMIA §56.06 — with $1,000-per-person nominal damages, no proof of harm required, up to $250,000 where information is used for financial gain. Washington’s My Health My Data Act keys entirely on “consumer health data,” including inferences about health conditions, regardless of who pays or whether HIPAA applies — and carries a private right of action.^10,11