HHS OCR · 45 CFR Parts 160 and 164
Online tracking guidance
HHS guidance on tracking technologies for HIPAA-regulated entities, revised in 2024 and partly vacated by a federal court. [VERIFY CURRENT STATUS]
Read on HHS.govNot legal advice.
For health systems
Many sites. One policy. Central control of every tag.
Hospitals, clinics, foundations and service lines each run their own sites and vendors. COMPLI3D puts every script under one consent policy and reports conversions as a click ID and an opaque code.
- /oncology/second-opinionURL sent to 4 platforms
- /find-a-doctor?specialty=Search terms in pixel URL
- giving.example.orgOwn tags, no banner
- vendor_chat.jsLoads before consent
What typically leaks
Four places a health system loses track.
Sites nobody owns
Service lines, foundations and campaign microsites each add tags, often through different agencies.
Find-a-doctor and location search
Search terms such as a specialty or a symptom ride along in URLs that pixels record.
Service-line pages
Paths like /oncology or /behavioral-health tie a visitor to a condition in every page view.
Many vendors, many scripts
Chat, scheduling, reviews and call tracking each bring their own scripts and their own idea of consent.
The fix
Each gap, mapped to the part that closes it.
Where it leaksProductWhat changes
Sites nobody owns
ProductTag Management
What changesEvery site joins one script inventory, so new tags are found and held, not discovered later.
Find-a-doctor and location search
ProductConversion Relay
What changesPaths and query strings are removed before any conversion is sent.
Service-line pages
ProductConversion Relay
What changesConversions carry a click ID and a code. No page address leaves.
Many vendors, many scripts
ProductConsent Gateway
What changesOne consent policy applies across sites, and each vendor's script waits for it.
Conversions that matter
The events service-line marketers report on.
Each one keeps its full name in your dashboard and reaches the ad network as a code.
Appointment requests
By service line and location, each with its own code.
Sent to ad networks as c_5b17Provider contacts
A visitor calls or requests an appointment from a provider profile.
Sent to ad networks as c_47f0Calls
Qualified calls to each line, from CallTrackingMetrics.
Sent to ad networks as c_a61cClass and event sign-ups
Registrations for classes, support groups and community events.
Sent to ad networks as c_2f9d
Regulations to know
What applies to health systems.
HIPAA · 45 CFR § 164.504(e)
Business associate contracts
Vendors that handle PHI for a covered entity need a business associate agreement. Most ad platforms do not offer one for advertising data. [VERIFY]
Read 45 CFR § 164.504 on eCFRNot legal advice.
18 U.S.C. § 2511 · state wiretap laws
Wiretap claims
The statutes cited in pixel class actions brought against hospitals and health systems.
Read 18 U.S.C. § 2511Not legal advice.
We have dozens of sites. How do they roll up?
Each site is added to one organization in the dashboard, with a shared consent policy and its own script inventory. [VERIFY]
Our agencies each run their own tags. Do they lose access?
No. They keep running campaigns. Their tags run through Consent Gateway, and new ones show up in the script inventory instead of going live unseen.
We already use an enterprise consent platform. Do we replace it?
Consent Gateway can be the banner and the control behind it. If you plan to keep your current platform, talk to us about how the two would fit. [VERIFY]
What will our security and procurement review need?
Start with our security page: the business associate agreement, controls and subprocessors. Send your questionnaire through contact.
Free tracking scan
See what your system's sites send today.
A report of every script that loads before consent and where it sends data.