PHI in page URLs
When the address of a page names a condition, a service or a provider, a script that sends that address can send health information with it.
Not legal advice. This is a plain definition, not a legal test. Whether data is protected health information depends on who holds it and why. Ask your counsel.
PHI in page URLs describes a page address that, on its own or together with other data, could reveal something about a person’s health. For example, example.org/programs/alcohol-detox/verify-insurance names a service. When a tracking script sends that address to an ad network along with an IP address or a cookie, the network learns that a specific browser looked at that service.
Most ad pixels send the full page address with every event. Query strings can add more: a form that puts answers in the URL, such as ?program=detox, sends those answers too.
- Page URL
- example.org/programs/alcohol-detoxremoved
- Referrer
- example.org/conditions/opioid-useremoved
- Click ID
- Cj0KCQ_sample_click_idkept
- Event code
- c_7f3akept
The fix is usually not renaming every page. It is making sure page details never leave in the first place: hold scripts until the visitor opts in, and report conversions from the server with only a click ID and an opaque code.
Key takeaways
- A page address can name a condition, a service or a provider.
- Most ad pixels send the page address with every event.
- Keep page details out of the request instead of trying to rename every page.