If you have googled "HIPAA compliant Facebook ads" in the last two years, you have read an article citing a piece of federal guidance that a court set aside. Most of them have not been updated. Some were written after the ruling.
This is the accurate version, and then what we actually do about it.
The timeline
December 2022. The HHS Office for Civil Rights published a bulletin on the use of online tracking technologies by HIPAA covered entities. Its most aggressive claim was about unauthenticated pages — ordinary public webpages, not patient portals. OCR's position was that the combination of an IP address with a visit to, say, a page about a specific condition could itself be individually identifiable health information.
Mid-2023. OCR and the FTC jointly sent letters to roughly 130 hospital systems and telehealth providers pointing at the bulletin.
March 2024. OCR updated the bulletin, softening some language without abandoning the unauthenticated-page theory.
June 2024. In litigation brought by the American Hospital Association, a judge in the Northern District of Texas held that the rule in the March 2024 bulletin was promulgated "in clear excess of HHS's authority under HIPAA," and vacated it.
Guidance covering authenticated pages — anything behind a patient login — was not disturbed.
The bulletin's reach onto your public website was vacated. HIPAA itself was not touched, and neither was anything else that governs you.
What did not change
This is the part that gets dropped, and dropping it is how people end up in trouble.
HIPAA still applies. If you are a covered entity and you disclose protected health information to a third party without authorization or a business associate agreement, that is a HIPAA problem with or without the bulletin. The vacatur removed a particular interpretation, not the statute.
The patient portal is still the patient portal. Tracking on authenticated pages remains squarely inside the guidance that survived.
The FTC has its own authority and has used it against health companies over data sharing, under Section 5 and the Health Breach Notification Rule. That is an entirely separate track from HIPAA and it was not before the court.
State law is untouched. In California, the CCPA as amended by the CPRA treats health information as sensitive personal information and imposes obligations that have nothing to do with OCR. We covered that in California privacy law and the Meta pixel. Washington's My Health My Data Act is broader still. Several other states have followed.
What we actually run
Our position has not changed since before the ruling, because it was never built on the bulletin.
Nothing condition-level goes to an ad platform. Not page URLs that name a condition, not audiences built from who visited which treatment page, not custom events named after a procedure. It is technically easy and it is the clearest possible path to being the example in somebody's article.
Conversions run server-side. We send events through Meta's Conversions API rather than letting a browser script decide what to transmit. We chose it originally because roughly a quarter of browser pixel events never arrive — ad blockers, tracking prevention — and the server call cannot be blocked. The privacy posture is a genuine side benefit: the server sends exactly the fields we choose and nothing else.
Identifiers are hashed before they leave. Email and phone go as SHA-256, normalized first — lowercased, trimmed, digits only for phone with the country code prefixed — or the match silently fails and you have degraded your targeting for nothing.
URLs are boring on purpose. /book rather than /book/hormone-therapy.
The URL is a disclosure whether you meant it to be or not.
Consent is real where it is required. A banner that actually gates the pixel and honors Global Privacy Control, not a cookie notice that sets a flag and changes nothing.
The question to ask whoever runs your ads
Not "are we HIPAA compliant" — the answer is always yes and it means nothing.
Ask: what specific fields does our pixel send, and can you show me?
If the answer is a list, you are fine. If the answer is a reassurance, nobody has looked.
We do that audit for every clinic we take on, and we will do it as part of a call whether or not you work with us. It takes about twenty minutes and you keep the findings.