Tracking pixels and analytics tags on a booking page can send what a client types to an ad or analytics company. That includes an email address and the treatment or reason for the visit. Whether HIPAA governs that depends on whether your med spa is a covered entity.
(A tracking pixel is a small piece of code that reports visitor activity back to the company that wrote it.) Picture a stranger at your front desk, reading over a client's shoulder while they fill out an intake card. Nobody would allow that in the lobby. Online, the same thing can happen without anyone noticing.
How Booking Page Tags Can Share Client Details
In a 2023 post, the FTC's Office of Technology noted that pixels can send personal data, including "information users have typed within a form." That post explains how the technology works and is not a rule.
Your booking page is a form. So is a consultation request, a treatment menu with checkboxes, or a chat box. Each one can hand a tag something personal as a client fills it in.
Every outside tool you connect to your website is another place client data can travel, and this guide covers the risks of connecting outside tools.
Does HIPAA Apply to Your Med Spa?
Nobody can answer that from outside your front office. The regulation at 45 CFR 160.103 says a covered entity includes a health care provider who sends health information electronically tied to a covered transaction. Those transactions include health care claims, eligibility for a health plan, and payment and remittance advice.
Does your spa send standard electronic transactions, such as insurance claims? If it does, HIPAA may reach your booking page. HHS's covered entities page says an entity that isn't a covered entity or business associate "does not have to comply with the HIPAA Rules."
Find out which side of that line you're on before you change a single tag. Start there first. This post is general information, not legal advice. Ask a health care attorney to review your own setup.
HHS Tracking Guidance and the 2024 Court Ruling
HHS guidance says tracking tools on a booking page with no login may have access to protected health information in certain circumstances. Its example is a client making an appointment. The tools "might collect an individual's email address, or reason for seeking health care typed or selected by an individual." In that case, HHS says, "the HIPAA Rules apply."
The guidance speaks to regulated entities, meaning covered entities and business associates. It also says cookie banners that ask visitors to accept or reject tracking "do not constitute a valid HIPAA authorization."
Two limits matter here. First, the bulletin says its own contents "do not have the force and effect of law." Second, a federal court in Texas cut part of it.
In American Hospital Association v. Becerra, decided June 20, 2024, the court held one piece of the bulletin unlawful and vacated it. (Vacated means the court threw it out.) The court called that piece the Proscribed Combination. It paired an IP address with a visit to a public, no-login page about specific health conditions or providers.
The court said its ruling should not be read as limiting other guidance in the same HHS document. HHS appealed, then dropped the appeal, and the Fifth Circuit granted that dismissal on September 4, 2024. HHS's page now shows a notice of the ruling at the top.
The vacated piece dealt with IP addresses and page visits. HHS's booking example involves details a client types. That example is still on the page as guidance. Guidance without the force of law still shows how the agency reads its own rules.
When the FTC Health Breach Notification Rule May Matter
If HIPAA doesn't cover your spa, a different federal rule may come into play. The FTC's Health Breach Notification Rule is a regulation. It requires certain organizations not covered by HIPAA to notify customers, the FTC and sometimes the media after a breach.
The rule applies to vendors of personal health records and related entities, but it does not apply to HIPAA covered entities. FTC guidance says a breach goes beyond cybersecurity intrusions and includes "a company's disclosure of covered information without a person's authorization." The amended rule took effect on July 29, 2024.
When might it apply to you? It may, if HIPAA doesn't cover your spa and your spa counts as a vendor of personal health records or a related entity. Your attorney should make that call.
Before-and-After Photos Need a Second Look
For covered entities, the regulation at 45 CFR 164.508 requires an authorization for any marketing use or disclosure of protected health information. The exceptions are narrow: face-to-face communication and a promotional gift of nominal value.
A patient's face matters too. Another regulation, 45 CFR 164.514, lists "Full face photographic images and any comparable images" among the identifiers that must be removed before health information counts as de-identified. Cropping may not settle it, since the list also names comparable images.
The FTC's Endorsement Guides, guidance published in federal regulations, say an ad showing a consumer's experience will likely be read as what consumers generally achieve. The Guides' own before-and-after example makes that point, and they call a "Results not typical" disclosure insufficient.
Before a photo goes live, check three things: who signed off on marketing use, whether a face shows, and whether the result reflects what clients generally see.
A Booking Page Checklist
A booking page should collect what the appointment needs and send it only where it has to go. A plugin sold as HIPAA ready is a sales pitch until someone shows you where the form data actually goes. Know what you're sending.
- Ask your web team for a list of every pixel, tag and script on your booking and intake pages.
- Remove ad and analytics tags from those pages unless someone confirms they receive nothing a client types.
- Collect only what the appointment needs, since a free-text reason box invites detail you may not want.
- Don't treat a cookie banner as HIPAA permission; HHS guidance says it isn't a valid authorization.
- Check the tags again whenever a new plugin, widget or chat tool goes live.
- Keep marketing permission on file for every before-and-after photo you post.
For the rest of the picture, see these website security basics.
A booking form exists to book an appointment. That's the test. Anything it tells a third party beyond that needs a reason you'd say out loud to a client.
See how our team approaches med spa and spa websites.
Frequently asked questions
Can a med spa booking page send client details to ad companies? Yes. The guide says tracking pixels and analytics tags on a booking page can send what a client types, including an email address and the treatment or reason for the visit.
Does HIPAA cover my med spa booking page? It depends. The guide says HIPAA may reach your booking page if your spa is a covered entity, such as a health care provider that sends health information electronically tied to a covered transaction.
Is a cookie banner enough for HIPAA permission? No. The guide says HHS guidance states cookie banners that ask visitors to accept or reject tracking do not count as a valid HIPAA authorization.
