BetterHelp’s intake form was a privacy promise the ad stack broke

The week

On March 2, 2023, the Federal Trade Commission, the federal agency that polices unfair and deceptive business practices, announced a proposed order against BetterHelp, an online counseling service owned by Teladoc. The FTC alleged that BetterHelp had promised consumers it would keep sensitive information private, including answers to an intake questionnaire about their mental health.

That is the kind of form people fill out late at night because they are struggling. It asks whether they have felt hopeless, whether they have thought about hurting themselves, whether they have been in therapy before. The site tells them their information will be kept private, so they answer honestly.

According to the complaint, it nonetheless shared email addresses, IP addresses and health questionnaire information with advertising platforms, including Facebook, Snapchat, Criteo and Pinterest, to target ads. An IP address is the numeric address that identifies a device on the internet. Combined with an email address, it can help an advertising platform recognize a specific person.

The complaint described a familiar marketing technique. BetterHelp allegedly uploaded the email addresses of existing and former clients to Facebook so that the platform could find other people who resembled them and show those people ads. It also alleged that the company used the fact that visitors had been in therapy before to target ads. And it said BetterHelp placed few limits on how the platforms could use what they received, including for their own purposes.

The complaint also took issue with how the company presented itself. It alleged that BetterHelp had displayed seals suggesting that a government body had reviewed its privacy practices against HIPAA standards, when none had. That detail mattered for the legal theory. It made the case about what consumers were led to believe, not about which statute governed the company.

Information like that usually travels through small pieces of code, often called tags or pixels, that advertising and analytics companies provide for websites to embed. When a visitor loads a page or submits a form, the tag sends information back to the platform in the background. The visitor never sees it happen.

Under the proposed order BetterHelp would pay $7.8 million for consumer refunds and would be banned from sharing consumers’ health information for advertising. The FTC described it as its first action to return money to consumers whose health data had been compromised. The order would also require the company to get affirmative consent before sharing personal information with third parties for other purposes. It would have to instruct the platforms to delete the data they had received, limit how long it kept data, and run a privacy program.

BetterHelp settled without admitting the allegations, and the company said publicly that its practices had been standard across the industry. As with other FTC administrative settlements, the proposed order was published for a 30-day public comment period before the Commission could make it final.

The case did not arrive alone. A month earlier, on February 1, the FTC had brought its first case under the Health Breach Notification Rule, against GoodRx, over similar sharing. That rule requires certain health apps and services to notify people when their health information is disclosed without authorization. GoodRx agreed to a $1.5 million civil penalty.

Hospitals had their own version of the problem already in view. In June 2022, an investigation by the news organization The Markup found the Meta Pixel on the websites of about a third of a list of leading US hospitals. In some cases it was sending details of appointment bookings. Several health systems, including Advocate Aurora Health and Novant Health, later notified patients that tracking code had sent information to outside companies. In December 2022, HHS issued guidance on tracking technologies on websites run by HIPAA-regulated organizations.

Neither BetterHelp nor GoodRx was treated as a HIPAA covered entity for this conduct. HIPAA, the main federal health privacy law, applies to hospitals, doctors, insurers and their vendors. The FTC’s message was that falling outside HIPAA did not mean falling outside the law.

Health systems sometimes file FTC privacy actions under consumer apps rather than organizations governed by HIPAA. A hospital’s compliance officer might read about BetterHelp and think: that is a direct-to-consumer startup, not us. That misses why the case mattered to them.

The case turned on the gap between what a sign-up experience told people and what the technology behind it did. Every hospital, ambulatory network and payer with online scheduling, a symptom checker or a patient app manages the same gap. It opens at three points in the patient’s digital journey: the moment of sign-up, the data captured along the way, and the measurement that follows. First, the technology that creates the gap.

The article therefore starts with two sections of groundwork: how tracking code works, and why no single team inside a health organization sees all of it. The three points of the patient journey follow, one section each. The closing sections cover what a broken promise costs, what a well-run program looks like, and the questions leaders should ask.

Observers in the aisles

Most modern websites are assembled from many pieces, some written in-house and some supplied by outside companies. Among those outside pieces are analytics tools, which count visitors and track how they move through a site. Others are advertising tools, which help the organization reach people with ads and measure whether those ads worked.

These tools arrive as small snippets of code, called tags, pixels or scripts. When a page loads in a visitor’s browser, the tags load too, and they can see much of what happens on the page. They can record which page was visited, what the web address says, which buttons were clicked and, depending on how they are set up, what was typed into forms. The tags then send that information to the outside company’s servers.

Tags behave like market research observers stationed in a shop’s aisles. Each observer was invited for a narrow purpose, perhaps to count foot traffic. But unless the shop gives them clear instructions, they write down everything they see, including which aisle a customer lingered in and what they put in their basket. In a hardware store, that is mostly harmless. In a pharmacy or a clinic, it is a disclosure.

What a tag actually sends

A single page view can carry a surprising amount. The tag typically sends the full web address of the page, the address of the page the visitor came from, and the page title. It sends a cookie identifier that links this visit to earlier ones, along with the visitor’s IP address and browser details. If the visitor is logged in to the advertising platform in the same browser, the platform can often tie all of this to a named account.

Some tags go further. Major advertising platforms offer features that look for email addresses or phone numbers in forms on the page and send them along, usually in hashed form. Hashing turns an email address into a fixed string of characters. It sounds protective, but the platform hashes its own users’ email addresses the same way and matches the two. Hashing hides the address in transit; it does not stop the platform recognizing the person.

Button clicks add context. A tag set to record “events” may log that a visitor pressed “Book appointment” on a page for a named specialty, or reached a confirmation page. Each event is small. Together they describe a person’s health interest, a date and a likely diagnosis.

Many organizations manage these tags through a tag manager, a central control panel that lets marketing and web teams add or remove tags without changing the website’s underlying code. It is convenient, and it also means tags can be added quickly, sometimes by outside agencies, without anyone in privacy or security seeing them.

All of this happens in the visitor’s own browser. The information travels directly from the patient’s device to the advertising platform. The health organization’s own systems often never see the transfer and keep no record of it.

Behind the login

The patient portal raises the stakes. HHS’s December 2022 guidance said that tracking code on pages behind a login generally has access to protected health information, because the visitor is a known patient. A hospital that allows a vendor’s code to collect such information needs a business associate agreement with that vendor and must meet HIPAA’s other requirements. Most large advertising platforms do not sign such agreements.

Portals are often built by the electronic health record vendor and configured by the hospital, with marketing analytics added afterward to measure portal sign-ups. Each layer can introduce tags. The safest rule is the simplest: no third-party advertising code behind the login at all, and analytics there only from vendors operating under a business associate agreement.

Five owners, one website

In most hospitals and health plans, the public website and patient app have several owners at once. Marketing owns the brand, the campaigns and usually the tag manager. A digital or web team builds and maintains the pages. IT and security look after the servers and the patient portal behind the login. Legal and privacy write the notices. Outside agencies run advertising and often have access to the site’s tools.

Each group does its own job well. The trouble is that no single group sees the whole picture. Marketing adds a tag to measure a campaign for a new orthopedic clinic. The agency copies the same setup onto the behavioral health pages because the template is shared. The web team publishes a new online intake form with the condition name in the page address because that helps search engines find it. The privacy notice, written two years earlier, still says patient information is kept confidential. Nobody has done anything wrong in isolation, and yet the promise and the practice have drifted apart.

This is why the problem tends to surface from outside: a journalist runs a scan, a regulator sends a letter, or a researcher publishes findings. Inside, everyone assumed someone else was checking. The fix is less about new technology than about giving one forum the job of reconciling what is promised with what is sent. That forum also needs the authority to remove a tag when the two do not match.

Giving one forum the authority

The forum can be small. A privacy lead chairs it, with the heads of digital, marketing operations and security, and a representative of the main agency. It meets on a fixed schedule and before major launches. Its decision rights should be written down. It approves new outside recipients of data, it can order a tag removed without waiting for a campaign to end, and it escalates disputes to a named executive.

Its effectiveness can be measured. Useful figures include the number of flows in the register with a recent test and the number of tags found by scans that were not in the register. A third is the time between finding an unapproved tag and removing it. Those numbers tell leaders whether the forum has teeth or is a meeting.

How the ownership problem differs by organization

The shape of the problem depends on who builds the site. An academic medical center usually has an in-house digital team, a large marketing department and several agencies. Its risk is volume: hundreds of pages, many campaigns and frequent changes. A community hospital often has one web manager and an agency that does most of the work. Its risk is that the agency’s defaults become the hospital’s practice without anyone reviewing them.

Ambulatory networks and physician groups frequently run their sites on templates from a practice-marketing vendor. The same tag configuration may be deployed across hundreds of practices at once, and the practice may not know what the template contains. Health plans add member apps and enrollment sites, where questions about eligibility and plan choice can reveal conditions. Direct-to-consumer telehealth companies sit closest to BetterHelp: marketing is central to their business model, and many operate partly or wholly outside HIPAA.

Public health departments and county hospitals face their own version. Their websites run on government content platforms that include analytics by default, and state public records and privacy laws apply on top of any federal rules. The common thread across all of them is that the person who can change a tag is rarely the person who wrote the privacy promise.

The moment of sign-up

The FTC’s complaint leaned heavily on what BetterHelp told users. Its intake asked sensitive questions about mental health, and its site carried assurances about privacy. The alleged problem was that practices did not match those assurances. That is a deception theory under Section 5 of the FTC Act, and it does not depend on HIPAA. The FTC did not need a health privacy law; it needed only a promise and evidence that the promise was broken.

What counts as a promise

Deception analysis looks at the overall impression a reasonable consumer takes away, as well as the words of the privacy policy. Statements on the intake page, reassurances next to a form field, badges and seals, and the design of the flow all contribute. A page that shows a lock icon and the word “confidential” beside a mental health questionnaire makes a promise, whatever the policy linked in the footer says.

The FTC also used unfairness, a separate theory. An unfair practice is one that causes substantial injury consumers cannot reasonably avoid, without benefits that outweigh it. Sharing health information for advertising without consent was alleged to meet that test. Unfairness does not depend on any statement at all, so a careful privacy policy does not fully protect an organization whose practices are themselves harmful.

HIPAA-covered organizations also run digital properties, such as public marketing sites and some consumer tools, where their statements can be tested the same way. A hospital’s “find a doctor” page or wellness newsletter sign-up may sit partly outside HIPAA’s reach, but a privacy promise made there is still a promise.

Privacy language in an intake flow is part of the product, not boilerplate. When a scheduling page says information is confidential, a patient reasonably believes it applies to everything they type. Many health organizations write that language in legal and marketing, while digital and security teams decide what the page actually sends. The people making the promise and the people building the plumbing may never be in the same room.

Joint sign-off and the flow register

The control is a joint sign-off: the people who write the promise and the people who know the data flows review each patient-facing flow together. They do it before launch and whenever tags, forms or vendors change. A short register listing each flow, its stated promise and its actual recipients makes the review repeatable.

The register does not need special software. A shared table with one row per flow works. Columns cover the page or app screen, the business owner, the privacy statement shown and the categories of data collected. Further columns list each outside recipient, the legal basis or agreement for that recipient, and the date of the last test. The discipline lies in updating it as part of every release, not in the tool.

Consent that means something

Consent design matters as much as wording. A cookie banner that loads tags before the patient chooses, or treats continued browsing as agreement, undermines the promise on the same page. A cookie is a small file a website stores in your browser to remember you; consent banners are supposed to let visitors decide which of them, and which tags, are allowed. Where the organization relies on authorization for any sharing, the request should be separate, specific and easy to decline.

Banners are only as good as their wiring. Each tag must actually wait for the visitor’s choice, and that needs testing, because tags added later through the tag manager can bypass the consent tool. Some states also require businesses to honor browser-level opt-out signals, such as Global Privacy Control, which a visitor sets once rather than on every site.

Consent has limits in health care. A patient booking urgent care is not in a position to read a cookie notice carefully. HIPAA authorizations have their own formal requirements, and a banner does not meet them. For pages involving protected health information, the better design is to avoid needing consent for advertising at all, by not sending the data.

The data captured along the way

BetterHelp’s questionnaire existed to match people with therapists. Its answers were useful for care and, as the complaint described, useful to advertising systems. Health organizations collect comparable signals across their digital front door, the collection of websites, apps and portals through which patients find and reach them. They capture the service line searched, the provider booked, the condition page read and the text typed into a symptom checker. Much of it is collected not because anyone chose to, but because analytics and advertising tools capture page views, form events and URLs by default.

Suppose a visitor searches a community hospital’s site for “addiction treatment,” reads the substance use program page, and books an intake appointment. The page address contains the words “substance-use-intake.” The confirmation page title says “Your appointment with Behavioral Health.” Without anyone intending it, every advertising tag on those pages may have received a record of the visit. That record names a specific browser, tied to an IP address and possibly an email. No one at the hospital decided to share that. The defaults did.

BetterHelp added a further test: whether data could be pulled back once it had gone. The proposed order required the company to direct third parties to delete the data it had shared. Most health organizations could not do that. They could not say which identifiers had gone to which platform, when, or under which account, because the transfer happened in the browser and was never logged on their side.

Controls that keep data at home

Minimizing capture is therefore partly about keeping a record of what leaves:

• Build forms so sensitive answers are processed server-side and never exposed to third-party scripts. Server-side means on the organization’s own computers, out of reach of the tags running in the browser.
• Keep condition names and appointment types out of URLs and page titles, which tags routinely collect.
• Configure analytics to record that a step was completed, not what was entered.
• Where any data is sent to an outside platform, send it from a server the organization controls, so there is a log of each field, recipient and date.

That log is what makes a deletion request, a regulator’s question or a patient’s access request answerable. Without it, the organization is left asking its vendors what they received, and hoping the answers are complete.

Beyond the pixel: chat, replay, email and calls

Advertising pixels drew the headlines, but other tools collect as much. Chat widgets on scheduling and symptom pages send whole conversations to the chat vendor, and patients type freely in them. Session replay scripts record mouse movements, clicks and sometimes keystrokes so that designers can watch how visitors use a page. Unless they are configured to mask form fields, they capture what patients typed.

Marketing email carries its own tracking. Open and click tracking tells the email platform which recipient read a message about, say, a diabetes education class. Call-tracking services assign unique phone numbers to campaigns and can record and transcribe calls to measure which ads produce bookings. Each of these tools needs the same treatment as a pixel: an entry in the register, a decision about sensitive service lines and an agreement that matches the data involved.

The vendors behind these tools are often chosen by marketing or patient access teams, outside the usual procurement review for clinical systems. Bringing them under the same third-party review is one of the cheaper fixes available.

Server-side tagging is a tool, not a cure

Moving tags to the server gives control, but only if the control is used. A server-side tag manager can forward every field it receives to the same platforms the browser tags used to reach. Configured carelessly, it simply hides the same disclosure from anyone inspecting the browser. The value comes from rules on the server that strip identifiers, drop sensitive pages entirely and record what was sent.

The server itself becomes a system that handles health information. It needs an owner, access controls, change management and, where a vendor hosts it, appropriate agreements. Organizations that adopted server-side tagging to escape scrutiny gained nothing; those that adopted it to enforce rules gained a lot.

Testing what the page actually sends

Policies describe intent; testing shows practice. Anyone with a modern browser can open its developer tools, load a page and watch the network requests leave. Commercial scanners do the same across a whole site on a schedule. The most useful tests follow real patient journeys, such as searching for a condition, booking an appointment and completing an intake, and record every outside destination.

Mobile apps need the same scrutiny through different tools. Apps embed software development kits from analytics and advertising vendors, and those kits send data from the phone directly to the vendor. Testing means running the app through a proxy that shows its outbound traffic, and reviewing each kit’s configuration before release. App store privacy labels should match what the testing finds.

Testing works best as a release gate. A new page or campaign does not go live until a scan shows that its outside recipients match the flow register. Periodic scans of the live site then catch tags added outside the release process, which is where agency changes usually appear.

Vendor contracts are the backstop. Analytics and advertising vendors should be bound to restrict their use of any data received and to delete it on request, with confirmation in writing. Organizations should also know whether each vendor will sign a business associate agreement for pages that may involve PHI, meaning protected health information under HIPAA. Many will not, which settles whether their tags belong on those pages.

Behavioral health, reproductive health and substance use pages deserve the strictest treatment. The harm from disclosure there is greatest, and state laws were starting to single these categories out. A practical rule is that these service lines get no third-party advertising tags at all. Measurement there runs through first-party, aggregate tools, meaning tools the organization runs itself that report totals rather than individuals.

The measurement that follows

The third point is campaign measurement. BetterHelp’s alleged sharing served a familiar purpose: telling ad platforms who had signed up, so they could find similar people and report on campaign results. Advertising platforms use these signals to find “lookalike” audiences, people who resemble those who already converted, and to show marketers which ads produced results. Health marketing teams face the same pressure to prove that digital spend produces appointments.

The pressure is real. Hospitals compete for elective procedures, primary care patients and specialty referrals, and boards want evidence that marketing budgets work. Advertising platforms have made their optimization tools depend on conversion signals sent back from the advertiser’s site. Without those signals, the platform’s automated bidding performs worse and reported results look weaker.

There are ways to measure without handing health context to ad platforms:

• Aggregate conversion counts can be reported without individual-level signals. “Forty people booked this week” tells the platform far less than forty individual records.
• Server-side measurement can strip identifiers and sensitive parameters before anything leaves the organization.
• Platforms’ own privacy-preserving options can be used where contracts and configurations have been reviewed.

Each comes with trade-offs. Targeting and attribution get less precise, campaign costs per booked appointment may look higher, and marketing teams lose some optimization tools. Those trade-offs should be decided explicitly by marketing, privacy and patient experience leaders together, and recorded. They should not be left to tool defaults. A chief marketing officer asked to accept less precise numbers deserves to know why, and a privacy officer asking for it deserves to know what it costs.

The case for keeping the pixels

The strongest counter-argument comes from marketing. Health systems are businesses with thin margins, digital advertising is how many patients now find care, and competitors keep using full tracking. Removing pixels, the argument runs, hands patients to rivals and to direct-to-consumer companies with fewer scruples.

Part of that is true. Measurement does get worse, and some campaigns will look less efficient. But the argument assumes the choice is between full tracking and no measurement, and it is not. Aggregate and server-side methods keep most of the useful signal for general service lines. The strict rule applies only to the most sensitive pages, where the reputational and legal downside is largest and the advertising upside is smallest.

The argument also understates the cost on the other side. A hospital that has to notify hundreds of thousands of patients that a tracking pixel shared their appointment details faces legal bills, regulator inquiries and lost trust that no campaign efficiency recovers. The comparison should be made with both sets of numbers on the table.

How the measurement trade-off varies

The trade-off does not weigh the same everywhere. An academic medical center marketing transplant or cancer programs to patients across several states depends heavily on digital campaigns and feels the loss of precision most. A community hospital with a local catchment relies more on referrals and reputation, and can usually accept aggregate measurement with little effect. Health plans marketing to members during enrollment periods face their own marketing rules on top of privacy law.

Direct-to-consumer telehealth companies feel it most, because their growth often depends on paid acquisition. They are also the organizations the FTC has focused on. For them, the trade-off is a strategic decision about the business model, and it belongs with the chief executive rather than the marketing team.

Marketing agencies need the same rules written into their statements of work. They often hold tag manager credentials and launch campaigns on short notice, so they are where new tracking most often appears without review.

Patient experience leaders have a direct stake. A privacy failure in a digital channel is experienced as a breach of trust, and it lands on the brand that made the promise. Patients do not distinguish between the hospital and its analytics vendor. Measuring trust, through complaint themes, opt-out rates and portal abandonment on sensitive steps, gives the experience team evidence to weigh against marketing’s attribution numbers.

A promise regulators can enforce

The BetterHelp case showed that a privacy statement is not a legal formality buried in a footer. It is a commitment the organization makes to every person who uses its digital services, and regulators can hold it to that commitment whether or not HIPAA applies.

The risks run in several directions at once. There is regulatory exposure, under the FTC Act and increasingly under state law. There is financial exposure, in refunds, legal costs and remediation work. There is operational disruption, when tags must be stripped out quickly and marketing campaigns paused. And there is the hardest cost to repair: patients who decide that a hospital’s website is not a safe place to ask for help, and who delay care as a result.

Which enforcer reaches whom

The FTC’s reach depends on corporate form. The FTC Act generally applies to for-profit companies, so it reaches telehealth firms, digital health apps, for-profit hospital operators and many vendors. Most nonprofit hospitals fall largely outside the FTC’s Section 5 authority. That does not leave them unregulated.

For HIPAA-covered organizations, HHS’s Office for Civil Rights enforces the privacy and security rules, including where tracking code collects protected health information. State attorneys general enforce state consumer protection and privacy laws, and they can also bring HIPAA actions. Private plaintiffs have filed class actions against hospitals over tracking pixels, often under state wiretap and privacy statutes, which can apply regardless of HIPAA status.

The result is that every type of health organization faces at least one enforcer for a broken digital promise. A for-profit telehealth company faces the FTC and the states. A nonprofit health system faces HHS, the states and the plaintiffs’ bar. A public hospital faces HHS and its own state’s laws. The rulebook changes; the exposure does not disappear.

That last point is especially sharp in mental health and other sensitive services, where people may already hesitate to reach out. A privacy failure there embarrasses the organization and can also discourage exactly the people the service exists to help.

Matching the promise to the plumbing

An organization in good shape keeps a register of every patient-facing flow, each one listing the privacy promise made and the outside parties that actually receive data. Legal, marketing, digital and security teams sign off together before launch and after changes, so the promise and the code are no longer written in different rooms. Sensitive forms process answers on the organization’s own servers, and tags are configured deliberately, since by default they capture far more than anyone asked them to. Sensitive service lines carry no third-party advertising tags. Any data sent to outside platforms goes through a server that logs it; without that log, a deletion demand or a regulator’s question cannot be answered with confidence.

Agencies work under written rules, because outside partners with tag manager access are a frequent source of unreviewed tracking. Leaders have explicitly agreed the trade-off between measurement precision and patient privacy. And nobody assumes that “not HIPAA” means “not regulated”: the FTC Act and state laws reach privacy promises regardless.

Sequencing the cleanup

Organizations starting from scratch can work in three steps. First, scan the live sites and apps and remove third-party advertising tags from sensitive service lines and from anything behind the login. That step needs no new technology and cuts the largest exposure within weeks.

Second, build the flow register from the scan results, assign owners and add the release gate. Third, rebuild measurement on aggregate and server-side methods, with marketing involved from the start so that the new numbers are trusted. The third step takes longest and is where projects stall, usually because marketing was handed a decision instead of being part of making it.

The evidence a regulator would ask for

A regulator or plaintiff’s lawyer would ask for the inventory of tags on each property, with dates. They would want the agreements with each recipient, records of what was sent, and the privacy statements shown at the time. They would look for evidence of testing and of decisions about sensitive pages. An organization that can produce the register, the scan history and the signed trade-off decision is in a strong position. One that must reconstruct them from vendor dashboards is not.

Mapping every patient-facing flow, tag and promise

1. Do we have a list of every patient-facing digital flow, with the privacy promise it makes and the outside companies that actually receive data from it, and who signs off that the two match?
2. Which third-party tags run on our behavioral health, reproductive health and substance use pages today?
3. If a regulator asked us to have shared data deleted, could we say exactly what went to which platform, and when?
4. Who outside the organization, including agencies, can add tags to our sites, and what review do those changes get?
5. Have marketing, privacy and patient experience leaders agreed, in writing, how much measurement precision we are willing to give up to protect patients?

The answers belong in a standing report rather than a one-time audit. Tag counts on sensitive pages should stay at zero, the register should show recent test dates for every flow, and new agency work should arrive with documented review. Movement in those numbers tells leaders whether the promise and the plumbing are staying aligned.

The BetterHelp case was about a counseling app, but its reach was wider. Any organization that asks people sensitive questions online and tells them their answers are private has made the same kind of promise. The work is making sure the technology behind the page keeps it.

With hindsight

The FTC finalized the BetterHelp order in July 2023, and in May 2024 it said about 800,000 consumers were eligible for refunds from the settlement. That figure gave a sense of how many people had passed through a single sign-up experience, and how widely a gap between promise and practice can spread.

The FTC kept going in the same direction. In May 2023 it brought a second Health Breach Notification Rule case, against the maker of the Premom fertility app, over sharing health data with third parties. In April 2024 it announced an order against the telehealth company Cerebral, which had disclosed patients’ information to advertising platforms through tracking tools. Each case applied the BetterHelp logic to a different corner of digital health. The Cerebral order, like BetterHelp’s, restricted the company’s use of health information for advertising, which suggested that such bans had become the FTC’s standard remedy rather than a one-off.

In April 2024 the FTC adopted amendments to the Health Breach Notification Rule that confirmed the rule reaches many health apps. For organizations that had assumed consumer health tools sat in a regulatory gray zone, the amendments narrowed that zone considerably.

Regulators also addressed hospitals directly. In July 2023 the FTC and HHS’s Office for Civil Rights sent a joint letter to about 130 hospital systems and telehealth providers. It warned them about the privacy and security risks of online tracking technologies. Hospital disclosures continued. In 2024 Kaiser Permanente reported to HHS that tracking code on its websites and apps may have sent member information to outside companies, affecting more than 13 million people.

States moved too. Washington’s My Health My Data Act, signed in April 2023, took broad effect in March 2024. It requires consent for collecting and sharing consumer health data and gives individuals a private right of action, meaning people can sue directly rather than waiting for a regulator to act. Other states added their own health data provisions, including Nevada and Connecticut. For a health organization operating across state lines, that turned privacy from a single federal question into a patchwork of state ones.

State attorneys general used existing laws as well. In 2024 the New York attorney general announced a settlement with NewYork-Presbyterian Hospital over tracking pixels on its website that had sent visitors’ health-related information to third parties. Class actions against health systems over pixels multiplied, many brought under state wiretap and privacy statutes.

HHS’s separate guidance on tracking technologies on HIPAA-regulated websites was narrowed by a federal court in 2024 for unauthenticated pages, the public pages anyone can see without logging in. HHS did not pursue its appeal. Some read that as a reprieve. Deception claims under the FTC Act and state law did not depend on it. A broken promise remained a broken promise, whichever rulebook applied. The ruling also left the guidance on pages behind a login, such as patient portals, in place.

Federal rules on the most sensitive categories kept shifting. HHS finalized changes to the confidentiality rules for substance use disorder treatment records in February 2024, aligning them more closely with HIPAA. A 2024 HIPAA rule protecting reproductive health information was vacated by a federal court in Texas in 2025. That instability is a reason to anchor practice on the promise made to patients rather than on any single rule.

Privacy statements in patient-facing journeys have remained enforceable commitments, whichever regulator is involved. The practical shift is to stop asking “which law applies to this page?” and start asking “what did we tell people, and does the technology behind the page match it?” That question works under every regime, and it is one a board can ask without any technical knowledge at all.

It is also a question worth repeating every time a new form, app or campaign goes live.