Recent Warning about Website Tracking Tools Like HubSpot for Healthcare

Marketing & Content Hub
1

We are seeing a growing number of marketing agencies send urgent warnings to medical and dental practices about website tracking tools like Google Analytics, Facebook Pixels, HubSpot, and session recording software.

The urgency feels unrealistic given that roughly 99 percent of healthcare practices use standard tracking tools for marketing. However, that is not a good enough reason to not be proactive, even if it is just for “better safe than sorry” reasons.

Has anyone else come across this? If so, what actions, if any, are you taking?

2

The warnings from agencies are valid due to HHS guidelines regarding PHI (Protected Health Information) leakage via client-side trackers (Meta Pixel, GA4, Hotjar). Standard client-side scripts send IP addresses, URLs, and form parameters directly to 3rd-party servers, which triggers compliance violations.

However, completely turning off marketing analytics is not necessary. Leading healthcare practices are transitioning to a First-Party Server-Side Tracking Architecture.

Here is the compliant setup strategy being adopted:

  1. Remove Browser-Level Trackers:
    Strip out standard JavaScript pixels (Meta Pixel, GA4 scripts) from the website front-end to prevent direct browser-to-ad-network data transmission.

  2. Implement First-Party Server-Side GTM (sGTM):
    Route all web events through a custom first-party server container (hosted on a subdomain of the practice, e.g., tracking.practice.com).

  3. Data Stripping & Anonymization (Redaction):
    Before forwarding data to ad platforms via Conversions API (CAPI) or GA4 Measurement Protocol:

  • Strip out sensitive URL parameters (e.g., condition/service names in query strings).
  • Anonymize or drop raw IP addresses.
  • Hash required user parameters (Email, Phone) using SHA256 before egress.
  • Exclude session replay tools (Hotjar, Clarity) on pages containing forms or health-related content.

This “Server-Side Middleware” approach allows practices to maintain ad attribution (ROAS) via Meta CAPI and Google Ads while eliminating third-party client-side PHI exposure.