HHS OCR · 45 CFR Parts 160 and 164
Online tracking guidance
HHS guidance on tracking technologies for HIPAA-regulated entities, revised in 2024 and partly vacated by a federal court. [VERIFY CURRENT STATUS]
Read on HHS.govNot legal advice.
For eating disorder treatment providers
Measure every assessment request. Keep the answers with you.
Many inquiries start with a parent or partner, and many patients are young. COMPLI3D reports assessment requests, family inquiries and calls to your ad networks as a click ID and an opaque code, after the visitor opts in.
- /programs/adolescent-phpURL sent to 3 platforms
- /free-assessment?step=3Answers auto-captured
- family_inquiryParent email hashed and sent
- chat_widget.jsLoads before consent
What typically leaks
Four places an eating disorder program gives itself away.
Assessment forms
Multi-step assessments ask about eating, weight and history. Auto-capture can pick up answers as each step is sent.
Family inquiries
A parent's form gives the patient's age and their relationship, and enhanced matching can hash and send the parent's email and phone.
Program and level-of-care pages
Paths like /programs/adolescent-php reveal the condition, the level of care and often the age group.
Chat
Chat widgets fire their own events with the page the conversation started on.
The fix
Each leak, mapped to the part that closes it.
Where it leaksProductWhat changes
Assessment forms
ProductConversion Relay
What changesA finished assessment becomes an opaque code. Answers never leave.
Family inquiries
ProductConversion Relay
What changesThe inquiry relays as a code with the click ID. No email, phone or relationship is sent.
Program and level-of-care pages
ProductConversion Relay
What changesPage URLs are removed before any conversion is sent.
Chat
ProductConsent Gateway
What changesThe widget's own tracking is held; chat starts relay server-side.
Conversions that matter
The four events admissions teams care about.
Each one keeps its full name in your dashboard and reaches the ad network as a code.
Assessment requests
A visitor finishes the assessment form.
Sent to ad networks as c_6e21Family inquiries
A parent, partner or friend asks about care for someone else.
Sent to ad networks as c_0d4bCalls
Qualified calls by duration, from CallTrackingMetrics.
Sent to ad networks as c_a61cAdmissions
Admissions from your CRM, matched by click ID. [VERIFY CRM SUPPORT]
Sent to ad networks as c_7f3a
Regulations to know
What applies to eating disorder treatment.
Washington · RCW 19.373
My Health My Data Act
Covers consumer health data, including information about health conditions and treatment, and requires consent before it is collected or shared. It allows private lawsuits. [VERIFY]
Read RCW 19.373Not legal advice.
18 U.S.C. § 2511 · state wiretap laws
Wiretap claims
The statutes cited in pixel class actions brought against healthcare providers over what their sites share with ad platforms.
Read 18 U.S.C. § 2511Not legal advice.
Many of our inquiries come from parents. Are they handled differently?
No. A family inquiry is reported as a code, like any other conversion. Nothing about the parent or the patient is sent.
Our assessment has several steps. Can we see where people stop?
Each step can have its own code if you want to measure it. Step names and answers stay in your dashboard. [VERIFY]
Should we advertise to people under 18?
That is a policy and legal question for your team and each ad network. COMPLI3D controls what your site sends back, not who you target.
Do ad networks restrict ads about eating and weight?
Several networks have their own rules for ads about weight loss and eating disorders. Check each network's current policies. [VERIFY]
Free tracking scan
See what your assessment form sends today.
A report of every script that loads before consent and where it sends data.