HIPAA Compliant Retargeting: What You Can and Cannot Do With Healthcare Ads

The two mistakes practices make with this

Healthcare organizations tend to land in one of two places on retargeting ads, and both are mistakes. One group runs standard e-commerce style pixels across the entire site, including condition specific and treatment specific pages, without realizing that page view data tied to an identifiable visitor can constitute protected health information the moment it reveals what condition or service that person was researching. The other group hears "HIPAA" and abandons retargeting entirely, giving up a genuinely useful, compliant tactic out of caution that goes further than the regulation actually requires.

The accurate position sits between those two. HIPAA restricts the connection between an identifiable individual and specific health information, not advertising as a category. A pixel that only knows "someone visited our website" carries a different risk profile than a pixel that knows "someone visited our oncology consultation page," because the second one, combined with enough identifying signal to retarget that specific person, starts to look like protected health information moving through an ad platform without the safeguards that information requires.

Where the actual exposure lives

The risk is concentrated at the page level, not the platform level. A business associate agreement with the ad platform is a necessary piece of a compliant setup, but it does not by itself make the tracking safe, because the agreement covers how the platform handles data it receives, not what data gets sent to it in the first place. The real exposure sits in implementation: which pixels fire on which pages, and whether any of those pages reveal something specific enough about a visitor's condition, treatment, or appointment type to create identifiable health information once it reaches an ad platform's systems.

The practical fix is straightforward once this is understood correctly. General site retargeting, a pixel that fires site-wide and only knows someone visited the practice's website broadly, is a normal, low risk, widely used tactic. Condition specific or treatment specific retargeting, where the pixel or the audience segment reveals what a visitor was researching, is the version that requires real caution, and in most cases should not fire on pages that name a specific condition, procedure, or appointment type at all.

A working approach

Run general retargeting at the site level, so a visitor who browsed the practice's website sees a general brand ad later, without that ad or its targeting logic revealing anything about what they specifically looked at. Keep pixels off any page that names a specific condition, diagnosis, or treatment, and if a campaign needs to speak to a specific service line, build that through the ad's audience and creative strategy, not through a pixel that fires on the page revealing the condition itself. This preserves most of the value of retargeting, staying in front of people who have already shown interest, without the specific exposure that comes from tying an identity to a condition inside an ad platform's data.

This same caution applies to Google Ads cost per lead measurement broadly: the goal is accurate attribution without over-collecting sensitive signal, which is a compliance question and a measurement question at the same time, not two separate problems.

This is not legal advice, and a practice's specific risk tolerance and legal counsel should weigh in on any implementation. It is the operating framework Healthcare Marketing by Velocity uses when building paid media for healthcare clients under its Digital Advertising & Media Buying pillar: measure what can be measured safely, and do not collect what does not need to be collected to run an effective campaign.