What your website knows before HIPAA applies

A parent lands on your clinic’s marketing site at eleven at night, reads a page about early signs of autism, clicks through to a page about your assessment process, and closes the tab without filling out a form. Three weeks later she calls to schedule an intake. Between those two moments, a session replay tool recorded her mouse movements and page views, an analytics pixel sent her device identifiers to a vendor, and none of it happened inside anything that looks like a medical record. She was never logged in. She was never a patient. Was any of that data protected by anything at all?

The gap, and why it is not the same gap in every state

HIPAA’s Privacy Rule generally reaches data created or received by a health care provider in that capacity, and reaches an individual’s health information once it meets the definition of protected health information. Data a marketing website collects from an anonymous visitor, before any provider relationship exists and often through a third-party vendor’s own script, frequently does not meet that definition at all. That is not a loophole anyone built on purpose; it is simply where HIPAA’s own boundary sits.

A few states have started to regulate that same data directly, under a different name: consumer health data. This article compares five such laws. Three were named for verification: Washington’s My Health My Data Act, Nevada’s consumer health data provisions, and Connecticut’s amendments to its comprehensive privacy law. Two more were added because their own sensitive-data or health-data rules are relevant to a clinic’s website: California’s CCPA, as amended by the CPRA, and Virginia’s Consumer Data Protection Act. Only three of the five could be verified from the statute’s own text; Washington and Nevada could not, for reasons explained in their own sections below.

Here is the finding that changes the shape of the gap: the two laws verified here that have an explicit HIPAA-related carve-out, Connecticut’s and Virginia’s, both write that carve-out at the entity level. A covered entity or business associate, as HIPAA itself defines those terms, is excused from the relevant provisions outright, not only for the data that happens to be protected health information. On its face, that exemption is not limited to data collected inside a patient relationship, but whether it actually reaches a clinic’s public marketing site, and whether every activity a clinic’s website vendor performs still counts as something a covered entity is doing, are both open questions this article cannot answer and a primary source has not resolved; raise them with counsel before relying on either statute’s text alone. California’s law works differently: its carve-out is tied to how the data is handled, not only to who holds it, so the gap this article describes is more clearly present there. No law discussed here is described as making a clinic exempt or safe; every answer below is qualified, and the open questions are stated as open questions.

Three laws, three structures

Entity-level exemption: Connecticut and Virginia. Both states’ comprehensive privacy laws exclude a HIPAA covered entity or business associate from the relevant provisions by naming the entity itself, not by naming the data. Connecticut’s consumer health data section separately restricts selling consumer health data without consent, sharing it with an employee or contractor who has no duty of confidentiality, and using a geofence around a mental health or reproductive or sexual health facility, but a covered entity or business associate sits outside all of that by the exemption’s own terms. Virginia’s Consumer Data Protection Act exempts a covered entity or business associate from the entire chapter the same way, and separately applies only to a person that, during a calendar year, controls or processes the personal data of at least 100,000 Virginia consumers, or of at least 25,000 Virginia consumers while deriving over half of gross revenue from selling personal data, a threshold a clinic should check against its own consumer count. Neither state’s exemption carries language tying it to the specific data at issue; both name the entity. What is not resolved by either statute’s text: whether a clinic’s public marketing website, if operated through a separate vendor or a separate legal entity from the clinic itself, is still covered by an exemption that attaches to the clinic as a covered entity. That is a structural question worth raising with counsel before assuming either state’s exemption reaches a specific website.

Data-level exemption: California. The CCPA, as amended by the CPRA, treats health information as sensitive personal information, which gives consumers a right to limit its use. Its HIPAA-related carve-out is narrower than Connecticut’s or Virginia’s: even the clause that references a covered entity ties the exemption to data the entity maintains in the same manner as a medical record or protected health information, not to the entity’s status standing alone. Data the same covered entity collects outside that context, through a public marketing page before any patient relationship exists, is not clearly covered by this exemption on the statute’s own terms. California’s private right of action is also narrower than it first appears: it reaches only a data breach of specific unencrypted personal information caused by a failure to maintain reasonable security, not a general violation of the sensitive-data rules, which the state’s privacy regulator and Attorney General enforce instead.

Not verified from the statute itself: Washington and Nevada. Washington enacted the My Health My Data Act in 2023 as a dedicated consumer health data law, and the Washington Attorney General’s own page confirms the law’s enactment (House Bill 1155, signed April 27, 2023) and its section-by-section effective dates. Per the Washington AG’s office, a violation is enforceable through the state’s Consumer Protection Act, including by private parties; the statute’s own text on this, and its own definition of consumer health data, its geofencing provision, and the exact wording of any HIPAA-related exemption, have not yet been verified, because the legislature site that hosts the statute’s own text could not be reached. Nevada enacted its own consumer health data law in 2023 (SB 370), and that bare fact is the only one that could be confirmed; the legislature site that hosts it returned an active block on every path tried. Nothing about either law’s HIPAA relationship is stated here beyond what is explicitly sourced to Washington’s Attorney General, because neither state’s own exemption language could be verified.

The federal exposure is separate, and it still applies

None of the state comparison above changes HIPAA’s own reach. The HHS Office for Civil Rights issued a bulletin on tracking technologies describing when data collected through a pixel, a session replay script, or similar tooling is protected health information: generally, tracking on an authenticated patient portal has access to PHI; tracking on a public marketing page usually does not, unless that page lets a visitor schedule an appointment, use a symptom checker, or otherwise enter information connected to their own health or care, in which case it can.

“A parent reading about a diagnosis on your marketing page, before anyone has ever called your office, may already be the most sensitive visitor your website has that day.”

On June 20, 2024, a federal court in the Northern District of Texas vacated part of that bulletin. The part vacated is narrow: the portion stating that HIPAA obligations are triggered whenever a tracking technology connects a visitor’s IP address with a visit to an unauthenticated public page that addresses specific health conditions or health care providers, without anything more. HHS’s own current bulletin page states this precisely and says the agency is evaluating its next steps. Everything else in the bulletin is unaffected by that order: tracking on authenticated portals, tracking within a regulated entity’s mobile app, and tracking on an unauthenticated page that collects identifying information through a scheduling tool or symptom checker all remain HHS’s stated position. A clinic’s obligation to limit protected health information disclosed to a tracking vendor to the minimum necessary, to have a business associate agreement with any vendor that qualifies as one, and to treat an impermissible disclosure as a presumptive breach, is unaffected by the state-law questions above and does not depend on which state a visitor happens to be in. The breach-notification consequences of an impermissible disclosure are covered in depth here; this article does not restate those figures.

The wiretap angle

A different legal question is whether a third-party script that receives a visitor’s input before it reaches the website operator is intercepting a communication in transit, rather than merely receiving data the operator chose to share. California’s wiretap statute makes it unlawful for a person, without the consent of all parties, to read or attempt to learn the contents of a message or communication while it is in transit. A separate section gives any person injured by a violation of that chapter a civil remedy of five thousand dollars per violation or three times actual damages, whichever is greater, and does not require the plaintiff to show actual harm to sue. That is the full extent of what is stated here: the statute’s own text and its own remedy. Whether or how that statute applies to a website’s tracking tools is not addressed in this article; no lawsuit is cited, named, or implied, because none was verified from a primary court source. For how a pixel or similar tool is actually treated under federal law, see the HIPAA and OCR bulletin discussion above.

What a clinic should have in writing

Start with an inventory, not a policy. List every analytics tag, pixel, session replay script, chat widget, and advertising tag on every page of the clinic’s website and portal, which vendor each one belongs to, and which pages it runs on. Mark which of those pages require a login and which do not, because that distinction is doing real legal work above: an authenticated portal page is treated differently than a public marketing page, and a public page that happens to let a visitor book an appointment or check symptoms is treated differently than one that does not.

For any vendor whose tag could plausibly receive protected health information, confirm whether a business associate agreement is in place, not just whether a general data processing addendum or marketing contract exists; those are not the same document and do not provide the same protection. For a vendor operating only in the consumer-health-data space rather than as a HIPAA business associate, confirm whether that vendor’s own contract addresses the specific state consumer health data obligations relevant to where the clinic does business, such as consent before sale and confidentiality duties for anyone with access to the data.

Cookie and consent banners deserve a specific caution: HHS’s own bulletin states that a banner asking a visitor to accept or reject tracking does not, by itself, satisfy HIPAA’s authorization requirement for disclosing protected health information to a vendor. A banner may do real work under a state consumer-privacy law and still do nothing for a HIPAA problem on the same page.

Finally, name one person who approves adding a new tag to the website or portal, in writing, before marketing or IT adds one on their own. Every vendor relationship above started as someone pasting a snippet of code into a page, and the clinic’s exposure exists from the moment that snippet runs, whether or not anyone meant to create a new disclosure of protected health information or a new consumer-health-data relationship that day. None of this is legal advice, and nothing on this page is a compliance guarantee; confirm the specific laws that apply to a clinic’s own website, vendors, and the states its visitors are actually in with counsel.