Are they sharing health data?
It's how building a profile works. No one tells Google or Facebook "Zack likes Ferrari", but Zack's browsing of Ferrari articles tells that about him.
> Regulated entities may also have unauthenticated webpages, which are webpages that do not require users to log in before they are able to access the webpage, such as a webpage with general information about the regulated entity like their location, visiting hours, employment opportunities, or their policies and procedures. Tracking technologies on many unauthenticated webpages do not have access to individuals’ PHI; in this case, a regulated entity’s use of such tracking technologies is not regulated by the HIPAA Rules. However, in some cases, tracking technologies on unauthenticated webpages may have access to PHI, in which case the HIPAA Rules apply to the regulated entities’ use of tracking technologies and disclosures to the tracking technology vendors. Regulated entities are required to “[e]nsure the confidentiality, integrity, and availability of all electronic PHI the [regulated entity] creates, receives, maintains, or transmits.” Thus, regulated entities that are considering the use of online tracking technologies should consider whether any PHI will be transmitted to a tracking technology vendor, and take appropriate steps consistent with the HIPAA Rules.
Thankfully I’m working with a conscientious marketing firm and our client is diligent and well meaning, so it’s easy to avoid the pitfalls, but naively following many integration walkthroughs could have you sending entire form content to Google (or others). I’m sure that’s one of the reason Google explicitly says “don’t put us on your EMR pages” (paraphrased).
Just using the same massive aggregator as your metrics provider is where it gets wrong.
Most people aren’t going to be browsing the Betty Ford clinic for fun. They’re looking for something specific. That’s juicy for analytics. I’m glad I don’t have to deal with that challenge.
(Conversion matching quality isn’t a fun challenge either. We’ve landed at “the practice will have to do that themselves to avoid the privacy obstacles”.)