What the tracking bulletin means for dental sites

On 1 December the Office for Civil Rights at the Department of Health and Human Services published a bulletin about tracking technologies and health information. It is four pages of careful language, and the short version is that the pixels and analytics tags sitting on a medical or dental website can send information to advertising companies that the practice is not allowed to send.

Nothing about this is a new law. It is guidance on how the existing rules apply to something almost every practice website has been doing for years without thinking about it. That is precisely why it matters now: the regulator has written down its reading, and “everybody does it” stopped being an answer three weeks ago.

We are not lawyers and this is not legal advice. Talk to yours. Here is what the bulletin says, what it means in practice on a dental website, and what we have been changing on client sites since it came out.

What the bulletin actually says

A few points carry most of the weight:

• Information collected on a practice’s website can count as protected health information even when the visitor is not yet a patient, and even when no treatment is discussed. An IP address, a device identifier, an email address or a page visit can be enough when it is tied to the reason someone came.
• Pages behind a login, like a patient portal, are treated as the clearest case. Tracking there has access to information that is obviously protected.
• Public pages are not automatically fine. The bulletin calls out portal login and registration pages, pages about specific symptoms or conditions, and pages where someone searches for a provider or requests an appointment.
• Sending that information to a tracking vendor requires either a business associate agreement with the vendor or a valid authorization from the individual. A cookie banner is not an authorization, and the bulletin says so directly.

The practical problem is the second half of that last point. The large advertising platforms do not offer a business associate agreement for their advertising pixels, so for those tools the choice is not “sign something”, it is “change what the pixel can see”.

Where the pixels sit on a dental website

Walk your own site the way a nervous patient does and you can usually find the exposure in ten minutes.

1. The appointment request form. Often the same page and the same form for a cleaning and for an emergency extraction, with an ad pixel firing on submit and the reason for the visit in a field.
2. Condition pages. Implants, root canals, sleep apnea, emergency care. A pixel on those pages records who read them.
3. The thank you page. The confirmation people reach after booking, which is usually where conversion tracking is deliberately placed.
4. The portal link. Many practice sites hand off to a portal on another domain, and the tags follow visitors right up to the door.
5. Advanced matching. The setting that quietly passes a hashed email address or phone number from your form to the ad platform. Plenty of practices have it on without knowing it exists.
6. Everything else that listens. Chat widgets, call tracking, session recording tools that capture what people type. Recordings of a form being filled in are the worst of the lot.

What we are changing this month

The goal is to keep measuring the marketing without handing a third party the ability to connect a person to a health topic.

• Remove ad platform pixels from portal login pages, booking confirmation pages and any page a patient reaches after identifying themselves.
• Turn off advanced matching and any automatic event setup that scrapes form fields. Do not pass names, email addresses, phone numbers or the appointment reason into events or URLs.
• Stop putting the treatment in the query string. A booking link that reads with the procedure spelled out in the address is the easiest leak to fix and the most common one we find.
• Separate the emergency and treatment-specific forms from the general contact form, so the sensitive paths can be measured differently or not at all.
• Review the chat tool and the call tracking vendor. Ask each one whether they will sign a business associate agreement and what they retain. Turn off session recording on any page with a form.
• Write the inventory down. Every tag, what fires it, what it sends, who the vendor is. When someone asks the question in six months, you want a document, not a memory.

Measuring without the pixel

Practices ask the fair question next: how do we know the ads work?

Count the thing that actually matters, further down the funnel and inside systems you control. Calls answered and booked, from your phone system. New patients in your practice software, tied to the month and the source the front desk records. Form leads counted in your own CRM. A generic conversion event that says “someone submitted the general contact form” without saying who or why is still useful for bidding, and far less of a problem.

Campaign structure does some of this work too. If emergency, implants and general dentistry are separate campaigns, the campaign name tells you what converted without the pixel reporting anything about the person. That is a better way to run Meta and Google campaigns for a practice anyway.

And the chat tool everyone is trying

Three weeks ago a company called OpenAI opened up a chat tool called ChatGPT, and by the following week half our client emails mentioned it. It writes fluent paragraphs about anything, including dentistry, at no cost and in seconds.

Two things we are telling practices. First, do not paste anything about a patient into it. It is a website run by a third party, you have no agreement with them, and this is the same conversation as the one above. Second, published pages written by it and left unedited read like every other page written by it, and Google ran another helpful content update on 5 December. Use it to draft an outline or rewrite your own clumsy paragraph, then make it specific to your practice or do not publish it.

What to do this month

• Inventory every tracking tag, pixel and widget on your site, with what each one sends and who receives it.
• Remove ad pixels from portal, confirmation and identified-patient pages, and turn off advanced matching.
• Strip names, contact details and treatment names out of URLs, form field tracking and event parameters.
• Ask your chat, call tracking and scheduling vendors in writing whether they sign business associate agreements.
• Move your reporting to booked appointments counted in your own systems, before next year’s budget conversation.
• Send the bulletin to your attorney and your compliance contact, and put the fixes in writing for your file.

This is an awkward one to hand to a web developer who does not work with practices, because the fix is half marketing and half compliance. It is the sort of thing we handle for the dental practices we work with, usually alongside the rest of the website work that has been waiting for a quiet week.