HHS OCR · 45 CFR Parts 160 and 164
Online tracking guidance
HHS guidance on tracking technologies for HIPAA-regulated entities, revised in 2024 and partly vacated by a federal court. [VERIFY CURRENT STATUS]
Read on HHS.govNot legal advice.
For mental health providers
Grow your programs. Keep conditions out of ad platforms.
Program and condition pages say a lot about the person reading them. COMPLI3D reports appointment requests, calls and finished screeners to your ad networks as a click ID and an opaque code, after the visitor opts in.
- /conditions/bipolar-disorderURL sent to 2 platforms
- /programs/iop-adolescentTitle in page view event
- screener_completeScore in event parameters
- booking_widget.jsLoads before consent
What typically leaks
Four places a mental health site gives itself away.
Condition and program pages
Paths and page titles like /conditions/ptsd travel with every page view a pixel records.
Online screeners
Self-assessments can send answers or a score as event parameters when a visitor finishes.
Booking widgets
Third-party scheduling tools often bring their own pixels, with the program or clinician in the URL.
Paid search landing pages
Campaign and keyword names, like a condition plus near me, ride along in UTM parameters.
The fix
Each leak, mapped to the part that closes it.
Where it leaksProductWhat changes
Condition and program pages
ProductConversion Relay
What changesPage URLs and titles are removed before any conversion is sent.
Online screeners
ProductConversion Relay
What changesA finished screener becomes an opaque code. Answers and scores never leave.
Booking widgets
ProductConsent Gateway
What changesThe widget's own tracking is held; booked appointments relay server-side.
Paid search landing pages
ProductConversion Relay
What changesUTM and query parameters are stripped. The click ID is the only link to the ad.
Conversions that matter
The four events intake teams care about.
Each one keeps its full name in your dashboard and reaches the ad network as a code.
Appointment requests
Requests for a first visit or an intake call.
Sent to ad networks as c_5b17Calls
Qualified calls by duration, from CallTrackingMetrics.
Sent to ad networks as c_a61cScreeners finished
A visitor completes a self-assessment. Nothing about the answers is sent.
Sent to ad networks as c_2c84Intakes
Completed intakes from your CRM, matched by click ID. [VERIFY CRM SUPPORT]
Sent to ad networks as c_7f3a
Regulations to know
What applies to mental health providers.
Washington · RCW 19.373
My Health My Data Act
Covers consumer health data, including mental health information, and requires consent before it is collected or shared. It reaches organizations HIPAA does not and allows private lawsuits. [VERIFY]
Read RCW 19.373Not legal advice.
18 U.S.C. § 2511 · state wiretap laws
Wiretap claims
The statutes cited in pixel class actions brought against healthcare providers, including behavioral health organizations.
Read 18 U.S.C. § 2511Not legal advice.
We run a dual-diagnosis program. Does 42 CFR Part 2 apply?
It can, if the program is federally assisted and provides substance use disorder treatment. Ask your counsel. COMPLI3D treats every program page the same way: nothing about it is sent. [VERIFY]
Our online screener brings in a lot of leads. Can we still measure it?
Yes. A finished screener is reported as a code with the click ID. Answers and scores stay on your site.
We use a third-party booking tool. What happens to its tracking?
Consent Gateway holds it until the visitor opts in. Booked appointments relay through Conversion Relay instead. [VERIFY BOOKING TOOL SUPPORT]
Will Meta still let us optimize for appointment requests?
Meta applies its own rules to health-related advertisers and events. Custom conversions built on codes may still be usable. Check your account in Events Manager. [VERIFY]
Free tracking scan
See what your mental health site sends today.
A report of every script that loads before consent and where it sends data.