HHS OCR · 45 CFR Parts 160 and 164
Online tracking guidance
HHS guidance on tracking technologies for HIPAA-regulated entities, revised in 2024 and partly vacated by a federal court. [VERIFY CURRENT STATUS]
Read on HHS.govNot legal advice.
For healthcare practices
Fill the schedule from your ads. Keep patients out of the data.
Practice sites run on appointment requests, calls and online booking, often across several locations. COMPLI3D reports each one to your ad networks as a click ID and an opaque code, after the visitor opts in.
- /services/hormone-therapyURL sent to 2 platforms
- /request-appointmentReason for visit captured
- /patient-portal/loginPixel fires on portal page
- booking_widget.jsLoads before consent
What typically leaks
Four places a practice site gives itself away.
Service pages
Paths like /services/hormone-therapy pair a visitor with a treatment in every page view.
Appointment requests
Request forms ask for a reason for visit, which auto-capture can pick up as the form is sent.
Patient portal links
Pixels on login and portal pages can record that a visitor is already a patient.
Location pages
Each office has its own page and phone number, and often its own copy of every tag.
The fix
Each leak, mapped to the part that closes it.
Where it leaksProductWhat changes
Service pages
ProductConversion Relay
What changesPage URLs are removed before any conversion is sent.
Appointment requests
ProductConversion Relay
What changesThe request becomes an opaque code. The reason for visit never leaves.
Patient portal links
ProductTag Management
What changesEvery script runs through one control point, so portal and login pages can stay free of ad tags.
Location pages
ProductTag Management
What changesOne policy covers every location, so a new office page starts with the same rules.
Conversions that matter
The four events that fill your schedule.
Each one keeps its full name in your dashboard and reaches the ad network as a code.
Appointment requests
Forms sent from any location page.
Sent to ad networks as c_5b17Calls
Qualified calls to each office, from CallTrackingMetrics.
Sent to ad networks as c_a61cOnline bookings
A visit booked through your scheduling tool. [VERIFY BOOKING TOOL SUPPORT]
Sent to ad networks as c_9c02Directions
Taps on get directions. A code per office, not the address.
Sent to ad networks as c_e4a8
Regulations to know
What applies to healthcare practices.
HIPAA · 45 CFR § 164.504(e)
Business associate contracts
Vendors that handle PHI for a covered entity need a business associate agreement. Most ad platforms do not offer one for advertising data. [VERIFY]
Read 45 CFR § 164.504 on eCFRNot legal advice.
18 U.S.C. § 2511 · state wiretap laws
Wiretap claims
The statutes cited in pixel class actions and demand letters, which have reached practices as well as hospitals.
Read 18 U.S.C. § 2511Not legal advice.
We have several locations. Do we need several accounts?
No. Each location's site is added to one dashboard with one consent policy. How sites count toward your plan is on pricing.
Our agency runs our ads. What do they need to do?
Connect the ad accounts and map conversions to codes in the dashboard. They keep running campaigns as before. Agencies can also partner with us.
Our booking tool has its own pixel. What happens to it?
Consent Gateway holds it until the visitor opts in. Bookings relay through Conversion Relay instead. [VERIFY BOOKING TOOL SUPPORT]
Do you sign a business associate agreement?
A business associate agreement is available. [VERIFY PLAN SCOPE] See security for details.
Free tracking scan
See what your practice site sends today.
A report of every script that loads before consent and where it sends data.