Tracking, page by page
Not every page is the same. A visiting-hours page and an appointment form carry very different risk. Pick a page and a tracker to see what the federal guidance says.
Your site
June 20, 2024: a federal court (American Hospital Ass'n v. Becerra, N.D. Tex.) vacated the part of the HHS bulletin saying HIPAA is triggered when tracking links an IP address to a visit to a public page about specific conditions or providers. HHS said it is evaluating next steps. The rest of the bulletin, including portals and pages where patients enter information, was not vacated.
Source: HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. General information, not legal advice.
Three common misunderstandings
The bulletin says website banners that ask users to accept or reject cookies are not a valid HIPAA authorization.
Mentioning trackers in a privacy policy or terms doesn't, by itself, permit disclosing patient information to a vendor.
A vendor promising to remove or de-identify information after receiving it isn't enough without a business associate agreement.