I read all 186 on 29 September 2026, from the outside, with no access to anything. 24 of them carry a Meta pixel — and Meta does not offer a business associate agreement for it at any price.
No practice is named on this page. Yours gets named only in the report I hand you.
Protected health information is the combination of an identifier with health information, sent somewhere that has not agreed to protect it. A tracker takes the visitor's IP address and the page URL automatically. On a procedure page, that is both halves in a single request — so the only open question is who is on the receiving end.
In AHA v. Becerra the Northern District of Texas vacated the Office for Civil Rights' position that an IP address collected on an unauthenticated marketing page is protected health information, and HHS dropped its appeal in 2024. So a tracker on a public page is a risk to weigh, not a proven breach. Anyone selling you certainty here is selling.
Meta and Google will not sign a business associate agreement for their pixel and tag products. Enforcement over tracking technologies has produced real settlements: GoodRx $1.5M, BetterHelp $7.8M, Aspen Dental $3.5M. And the practices most exposed are usually the ones marketing well — a pixel, an intake form and a procedure-specific page is the combination.
Some of the practices with no analytics at all did not forget. They stripped it deliberately, because Google will not sign a BAA, and they chose blindness over exposure. That is a real decision made by people who looked at the problem properly — and it is a false choice. Server-side collection keeps the measurement and removes the exposure. It has been the standard pattern in regulated acquisition for years.
Take the client-side pixel off the patient-facing pages. This is the only step that removes the exposure rather than managing it.
Capture the click id — gclid or fbclid — into your own system when the visitor arrives.
Report the conversion from your server rather than the browser: a hashed email, the click id, and nothing else.
Name the conversion action generically. lead_generated carries no health information. implant_consult_booked does.
Hold a BAA with every vendor that touches the combination — the CRM, the scheduler, call tracking, the chat widget.
Published third-party result, not my work: Ideal Dental moved cost per form submission from $168 to $92 while doubling total conversions after rebuilding on this architecture. I include it because it answers the only real objection — that doing this properly costs you performance.
A two-week review of everything your marketing stack sends about your patients. You get a branded report with specific findings, severity ratings, and a fix roadmap your team or agency can execute — or I can.
Client-side tracking inventory (pixels, tags, scripts on every patient-facing page, not just the homepage). Conversion action naming across Google Ads and Meta. Form data flows — what leaves the browser when a patient submits an intake or appointment request. Lifecycle email content for PHI references in subject lines, body copy, and link parameters. Vendor BAA inventory — CRM, scheduler, call tracking, chat widget, review platform.
A branded PDF report: every finding, what it exposes, how to fix it, and in what order. A prioritized fix roadmap your existing agency can follow. A 30-minute walkthrough call to review findings with your team.
If the audit does not surface at least three actionable findings, you pay nothing. Full refund, no questions. In the 186 sites I have read so far, this has not come close to happening.
If you want the fixes implemented rather than handed off:
Server-side tracking rebuild — Meta CAPI + Google Ads API offline conversion import. Your ad platforms keep getting conversion data; the browser stops sending PHI. $7,500–$12,000 depending on stack complexity.
Lifecycle email build — six compliant campaigns (indoctrination, booking conversion, feedback routing, winback, ascension, recall). $5,000–$10,000.
Ongoing compliant PPC management — $2,500–$5,000/mo.
Five years at Tranzact, a Willis Towers Watson company, running Medicare acquisition for Humana, Aetna, Elevance and Blue Cross Blue Shield plans. Regulated acquisition under business associate agreements, where what you may send an ad platform is the first question rather than the last. Seven years in paid media overall, $100M+ in managed spend.
This page is a read of public websites, not legal advice and not a compliance certification. I am not a lawyer. What the audit gives you is a list of what is observable from outside — which is the same list anyone else could assemble, including someone building a claim.
Twenty minutes. I will have read your site before we speak, and you keep the findings whether we work together or not.