10 Common (And Risky) Web Trackers on Healthcare Websites

Do you know which web trackers are collecting data on your website? 

If you don’t, you’re not alone. A recent scan of one healthcare organization’s domains uncovered multiple unknown trackers across three websites, many of which were high risk, meaning they were definitely collecting consumer health information without authorization. But even after those web trackers were flagged, one of them sat unresolved for six weeks because no one knew who owned it.

Trackers are often just small snippets of code, but they can create big legal exposure, from HIPAA violations to claims under state privacy laws, state wiretap laws, and the federal Electronic Communications Privacy Act (ECPA). 

Modern healthcare marketers need to be aware of the trackers accumulating on their website, how they’re processing data, and where they’re creating risk. But trackers aren’t always clearly labeled, making it hard to know which ones matter and how to handle them. 

Trackers rarely announce themselves, which makes it hard to know which ones matter. When healthcare organizations scan their sites for the first time, they often find dozens they didn't know about. Across hundreds of scans, the ones below come up most often. For each, we cover what it collects, whether the vendor signs a Business Associate Agreement (BAA), and how to keep using it without the legal exposure.

The usual suspects: Trackers from Meta and Google

These trackers may come from familiar household names, like Meta and Google, but they still create significant compliance risks and deserve your attention. 

Domains:

• connect.facebook.net
• www.facebook.com

Meta’s trackers allow the platform to track user behavior on your website, including clicks and conversions, so that it can be tied back to activity across Facebook, Instagram, and its other platforms. When you have this tracker installed, you can leverage the data collected in Meta Ads Manager for better audience building, analytics, remarketing, and more. 

Meta doesn't sign BAAs, and its pixel has become a compliance flashpoint. It has drawn scrutiny under HHS guidance, been central to dozens of class-action lawsuits against health systems, and represents the kind of data sharing that new state health privacy laws restrict. 

But removing it means giving up visibility into Meta ad performance and opportunities for optimization. 

Instead of abandoning Meta tracking, leading healthcare marketers are leveraging tools that allow them to govern what data is shared with Meta, keeping the performance while cutting the risk.

Domains:

• maps.googleapis.com
• maps.gstatic.com

Embedding Maps on your website provides users with a seamless way to find health services, but it also gives Google access to user locations and other personal identifiers. When Maps trackers are placed on pages that also contain health information, this tracking can be considered as exposure of PHI.  

To manage risk, run legal/compliance reviews that identify any pages where Google Maps trackers could access health information. And if location services and health information can’t be kept apart, privacy-safe alternatives, like Freshpaint Maps, enable you to guide patients to care without sending sensitive health data to Google or other third parties.

Domains:

• googleads.g.doubleclick.net
• static.doubleclick.net

Google Ads is one of the most widely adopted ad platforms in healthcare marketing, partly because its detailed tracking allows Google to measure specific conversion actions users take on your website.

But that specificity also creates risk. Such granular tracking grants Google access to user data which, when combined with health information, can be considered PHI. And as Google doesn’t sign BAAs for Google Ads, that risk sits on your shoulders. 

As with Meta Ads, healthcare marketers are replacing Google’s trackers with privacy-safe alternatives that make it possible to control which data is shared externally. That means Google gets the data it needs to measure campaign performance—and nothing more. 

Domains:

• www.youtube.com
• i.ytimg.com
• yt3.ggpht.com

Embedded video content has become a staple of the online patient experience. YouTube is one of the most widely adopted video platforms, but embedding YouTube videos—and the trackers they contain—on your website can increase risk. These trackers can link what a viewer watches, including health-related videos, to their identifiers and activity, and YouTube (owned by Google) does not sign BAAs. 

Instead of abandoning video altogether, you can explore privacy-safe video alternatives, like Freshpaint Video, a self-hosted streaming platform that fully replaces YouTube, Wistia, and other third-party players with a compliant, embedded video experience.

Domains:

• www.google.com
• www.google-analytics.com
• analytics.google.com

By this point, you know that any tracker owned by Google should raise a red flag when it comes to HIPAA compliance. And Google Analytics is no exception. 

Google Analytics trackers collect a range of user activity such as on-page behavior, location and device data, and conversions. Any of this, when combined with health information, can count as PHI. Google doesn’t sign BAAs for Analytics, and HHS and the FTC have specifically called out Google Analytics as a non-compliant tool for HIPAA.

Five trackers you don’t expect, but need to know about

These trackers might not look like ad tech, but they could still be collecting sensitive patient data. Ranging from accessibility widgets to performance and security tooling to UX analytics, these tools can slip past marketing-led review and cause compliance concerns down the line. 

Domains:

• cdn.userway.org
• userway.org
• acsbap.com
• acsbapp.com

Accessibility overlays provide accommodations for users with common disability profiles, from vision impairments to dyslexia. They’re installed for the right reasons, so sometimes they get left off the compliance radar. 

But these solutions collect a wide range of data, and neither UserWay nor AccessiBe has a publicly disclosed BAA program. It’s critical to confirm the data they’re collecting and, if necessary, explore whether it’s possible to get a BAA in place. 

Domains:

• static.cloudflareinsights.com
• cloudflareinsights.com

Cloudflare is one of the most widely used cloud networks, and several of its solutions, including their web analytics tool, collect user information that could be considered PHI. 

Cloudflare will sign BAAs, but only for Enterprise-tier customers. Healthcare organizations must therefore confirm whether they’re covered, as Cloudflare’s Free, Pro, and Business plans aren’t eligible for BAAs. 

Domains:

• static.elfsight.com
• apps.elfsight.com
• elfsightcdn.com

Elfsight makes it easy to install review widgets, social feeds, forms, and more without writing a line of code. When it’s so simple to add new widgets, it’s easy to lose track of the data each widget is collecting and where that data is going. 

Elfsight does not have a publicly disclosed BAA program, so sharing health information through Elfsight widgets creates HIPAA risk. It’s important for healthcare marketers using Elfsight to catalog the widgets they have installed, remove any unused widgets, and keep widgets off pages handling sensitive health information. 

Domains:

• www.clarity.ms
• clarity.ms

Microsoft Clarity is a user behavior analytics tool favored by UX and product teams. With detailed heatmaps, session recordings, and AI insights, Clarity provides teams with a clear picture of how users are interacting with websites and apps. 

But detailed insights often mean detailed data tracking, and while Microsoft offers BAAs across Azure and Microsoft 365, Clarity has no BAA program and its terms of service explicitly exclude sensitive health content. 

To comply with HIPAA and Clarity’s terms of service, healthcare organizations must at minimum remove Clarity from sensitive pages, or consider replacing it with a tool that will sign a BAA.

A scan finds trackers. A process fixes them.

Look back at the second half of this list. Marketing probably didn't install the accessibility overlay, the Cloudflare analytics, or the Clarity heatmaps, and marketing may not be able to remove them. That's how a flagged tracker sits unresolved for six weeks.

Freshpaint’s Web Tracker Monitoring continuously monitors your sites, surfaces what’s new and what needs attention, and makes it easy to get findings to the right people, even if they don’t have access to Freshpaint.

So instead of relying on periodic audits and scattered handoffs, marketing, privacy, IT, and other stakeholders have an organized, proactive process for managing tracker risk and a clear record of the decisions they’ve made.

Getting started is simple: Request a free web tracker scan for your website from Freshpaint. 

You’ll get a complete list of the trackers across your sites, the risk level for each, and a prioritized remediation plan to reduce risk without breaking analytics or campaigns. Request a scan here.