When a patient books an appointment online, they may provide their name, email address, phone number, appointment date and the type of healthcare service they need. Depending on the booking system, the website may also collect their IP address, device information, and browsing activity.

The information does not necessarily stay within the healthcare provider's website. Third-party technologies embedded in the page may collect or transmit information to analytics providers, advertising platforms or other external services.

 

The role of third-party tracking technologies

Websites use cookies, tracking pixels and other technologies to collect information about visitors. According to the Federal Trade Commission (FTC), these technologies can track browsing activity, record the pages people visit and gather information about their devices. Third-party tracking occurs when a website allows another company to collect information about visitors. This data may be used for website analytics, personalised advertising and other purposes.

These technologies can create privacy risks when they are used on healthcare appointment pages. For example, a patient may visit a healthcare website to book a consultation for a specific medical condition. A tracking pixel embedded on the page could transmit information about the visit to an advertising or analytics platform. Depending on how the technology is configured, the information shared could include the page URL, browsing activity, IP address or other online identifiers.

The concern is that this information could reveal details about a patient's healthcare interests or the services they are seeking. If the data identifies an individual and relates to their health or healthcare, it may qualify as protected health information (PHI) under HIPAA.

 

What does HIPAA say about third-party tracking technologies?

The US Department of Health and Human Services (HHS) states that the Health Insurance Portability and Accountability Act (HIPAA) Rules apply when information collected or shared through online tracking technologies includes PHI. In its guidance on the use of online tracking technologies by HIPAA-covered entities and business associates, HHS warns that healthcare organisations cannot use these technologies in ways that result in impermissible disclosures of PHI to third parties.

This is particularly relevant to online appointment booking. HHS explains that tracking technologies on appointment pages may automatically transmit information about an appointment and the patient's IP address to an external vendor. The guidance states, “In this case, the tracking technology vendor is a business associate, and a BAA is required.” This applies when the vendor meets the definition of a business associate by handling PHI on behalf of a regulated entity.

Healthcare providers must ensure that any disclosure of PHI to a tracking technology vendor is permitted under the HIPAA Privacy Rule. They must also implement appropriate safeguards to protect electronic PHI (ePHI) under the HIPAA Security Rule. HHS makes clear that simply disclosing tracking practices in a privacy policy is not sufficient, stating that the Privacy Rule “does not permit disclosures of PHI to a tracking technology vendor based solely on a regulated entity informing individuals in its privacy policy” that it plans to share the information. Cookie consent banners also do not, by themselves, constitute valid HIPAA authorisation.

However, not every tracking technology used on a healthcare website violates HIPAA. The rules apply when the information collected or disclosed qualifies as PHI and the relevant HIPAA requirements are triggered. HHS distinguishes between general public webpages that do not involve an individual's healthcare and appointment booking pages that collect identifiable information related to their care.

To reduce the risk of PHI exposure, healthcare providers should review tracking technologies on appointment booking pages, determine what information is shared with third parties and assess whether those disclosures are permitted. Where a tracking vendor qualifies as a business associate, providers must establish a BAA and ensure that appropriate safeguards are in place. If a vendor will not sign a required BAA, the provider should not disclose PHI to that vendor without the individual's HIPAA compliant authorisation or another applicable legal basis.

 

What are the risks of exposing PHI through appointment booking?

When patient information is shared with unauthorised third parties, it can create privacy and security risks for both patients and healthcare organisations. For patients, the exposure of appointment details could reveal sensitive information about their health, particularly when they book consultations for specific conditions. If this information is linked to their name, email address or other identifiers, it could be used to target them with unwanted advertising or disclose details about their healthcare to people who should not have access to it.

The information could also be combined with data from other sources to learn more about a patient's health interests. For example, details about an appointment for a specific medical condition could be used to target the patient with related adverts. If the data is exposed in a breach, sensitive information about the patient's healthcare could end up in the wrong hands.

Healthcare organisations may also face regulatory and reputational consequences if they disclose PHI in violation of HIPAA. Depending on the circumstances, an impermissible disclosure may require an assessment under the HIPAA Breach Notification Rule and could lead to investigations, corrective action or financial penalties.

These risks indicate why healthcare providers should assess both the security of their appointment booking systems, and the third-party technologies that collect information from those systems.

 

How can healthcare providers prevent PHI exposure when booking appointments online?

Healthcare providers can reduce the risk of PHI exposure by reviewing their appointment booking processes and limiting the information shared with third parties.

  • Audit tracking technologies: Identify cookies, tracking pixels, analytics scripts and other third-party technologies operating on appointment booking pages. Review what information they collect and where it is sent.
  • Limit unnecessary data sharing: Avoid including patient names, appointment details or other sensitive information in URLs, analytics events and tracking parameters. Disable tracking features that collect information unnecessarily.
  • Review third-party booking platforms: Before using an external scheduling service, assess its privacy and security practices, data handling arrangements and access controls. Determine whether the provider qualifies as a business associate and whether a BAA is required.
  • Separate marketing from patient scheduling: Where possible, keep advertising and marketing trackers away from booking forms, patient portals and other pages that handle sensitive information.
  • Test the booking process: Check what information is transmitted when patients select a service, enter their details and confirm an appointment. Website network requests and browser developer tools can help identify unexpected data transfers to third parties.
  • Conduct regular risk assessments: Review the technologies used on healthcare websites whenever new integrations are introduced or existing services change. Include potential disclosures through tracking technologies in the organisation's HIPAA risk analysis where applicable.

Healthcare providers should also establish clear procedures for responding to suspected PHI disclosures. If patient information has been sent to an unauthorised third party, the organisation should investigate the incident, assess its obligations under HIPAA and take appropriate steps to prevent further exposure.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

Does removing a patient's name prevent PHI exposure?

Not necessarily. Information such as appointment details, IP addresses and unique online identifiers may be combined to identify a patient or reveal information about their healthcare. Removing names alone does not guarantee that information has been de-identified under HIPAA's standards.

 

Who is responsible for protecting PHI when a third-party booking tool is used?

The healthcare provider remains responsible for complying with the HIPAA requirements that apply to its activities. A third-party vendor may also have obligations as a business associate when it handles PHI on behalf of a covered entity. A BAA helps establish the vendor's responsibilities, but it does not remove the healthcare provider's own compliance obligations.

 

Can patients opt out of tracking on healthcare websites?

Some websites offer cookie settings or other controls that allow visitors to opt out of certain tracking technologies. However, these controls do not replace a healthcare provider's obligation to comply with HIPAA. Providers must ensure that PHI is collected and disclosed lawfully, regardless of whether a patient accepts or rejects optional cookies.

 

What should a healthcare provider do if PHI is accidentally shared with a third party?

The provider should investigate the disclosure, determine what information was shared and identify the parties involved. It should also assess whether the incident constitutes a breach under HIPAA and whether notification is required under the Breach Notification Rule. Appropriate corrective measures should be taken to prevent similar incidents.