Tracker audit, $450
We open every page of your practice's website in a real browser, record every script and every request it makes, read your tag manager, and tell you in writing what each vendor receives and how to fix it.
What we check
- Every page on the site, up to 40, with special attention to booking, intake, symptom-checker, portal-login and thank-you pages
- Every third-party script and the network requests it sends, captured in a browser session, including scripts loaded after the page opens
- Your tag manager container: which tags fire on which pages (with read-only access)
- What forms send and where: field names, the receiving service, whether anything lands in a URL
- Cookie banner behaviour: what loads before and after someone clicks "accept"
- Embedded widgets: chat, reviews, maps, video, scheduling
What you get
- A written report (PDF), laid out like the sample below
- A page inventory, marked general or patient page
- A vendor list: what each one receives, and whether a BAA is on file (you tell us; we don't see your contracts)
- Fixes in priority order, written so your web person can act on them
- A 30-minute call to go through it
- One free re-check within 60 days
We need the site address and, if you want the tag manager reviewed, read-only access to it. We don't need logins to your portal or EHR, and we never submit real patient details in forms; we use made-up test entries.
Sample report layout
This is a sample. The practice, the website and the findings are made up to show the format; they don't describe a real site.
Summary
Patient pages
| Page | Vendors loaded | What they receive | Risk |
|---|---|---|---|
| /request-appointment/ | Meta Pixel, Hotjar, Google Tag Manager | Page URL, IP address, form events; Hotjar records clicks and keystrokes in the form | High |
| /request-appointment/thanks/ | Meta Pixel ("Lead" event), Google Ads conversion | The fact that this visitor booked, with their ad cookie | High |
| /patient-portal/ (login link page) | Google Tag Manager → Microsoft Clarity | Session recording of the login page | High |
| /new-patients/forms/ | Google Analytics 4 | Page views; PDF form downloads | Check |
General pages
| Pages | Vendors loaded | Risk |
|---|---|---|
| Home, about, team, hours, insurance (9 pages) | Google Analytics 4, Google Tag Manager, Meta Pixel | Lower |
| Service pages, e.g. /services/implants/ (5 pages) | Google Analytics 4, Meta Pixel | Check (see the 2024 court ruling) |
Fixes, in order
- Remove Hotjar from the whole site, or at least from the appointment form. Session replay can capture what patients type.
- Stop the Meta Pixel and Google Ads tags from firing on the appointment and thank-you pages. In the tag manager, add an exception trigger for those two paths.
- Remove the Clarity tag from the tag manager, or limit it to general pages.
- Ask the form vendor for a BAA, or move the appointment form to one that signs.
- Keep GA4 on general pages only and exclude the new-patient forms path.
- Re-scan after changes. Re-check included.
Audit questions
How is this different from the free scan?
The free scan reads the code your pages send and matches 27 well-known trackers. The audit runs every page in a browser, so it also catches what the tag manager and other scripts load afterwards, checks forms and thank-you pages, and comes with a written fix list.
Will the audit tell us whether we're HIPAA compliant?
No. It tells you which vendors receive what from which pages. Whether a particular disclosure is permitted, and what to do about past ones, is a question for your compliance officer or counsel. The report is written so they can use it.
Do you need access to patient data?
No. We use made-up test entries in forms and never log in to your portal or EHR. Because we don't receive patient information, an audit doesn't normally need a BAA. If your situation is different, tell us and we'll sign one first.
How long does it take?
The report arrives within 5 business days of getting the site address and any tag manager access.