HHS OCR Tracking Guidance in 2026: What Still Applies After AHA v. Becerra
The HHS OCR tracking guidance is the most misread document in healthcare privacy. A 2024 court ruling, AHA v. Becerra, struck down part of it — and headlines turned that into "tracking is fine now." It isn't. The vacatur was narrow and specific: it removed one theory about one kind of page. Everything else — patient portals, forms, appointment pages, the BAA requirement — still stands, and in 2026 OCR's scrutiny has only intensified. Here's exactly what the guidance requires now.
Key takeaways
- The guidance was partially vacated, not struck down. AHA v. Becerra removed only the "Proscribed Combination" — the claim that an IP address plus a visit to an unauthenticated public health page is, by itself, PHI.
- Almost all of the bulletin survived. Trackers on authenticated pages (patient portals), on forms, and anywhere a user types health information still trigger HIPAA — and vendors receiving PHI still need a BAA.
- OCR never replaced it. As of 2026, the bulletin remains the baseline courts reference for whether a covered entity "knew or should have known" its pixels transmitted PHI.
- OCR scrutiny intensified. Meta Pixel, Google Analytics and ad SDKs on portals and scheduling pages are specifically flagged; entities must demonstrate control of their data flows.
- The real risk shifted to private lawsuits. The ruling helped on public pages but did nothing to stop class actions, state health-data laws, the FTC, or CIPA.
What the HHS OCR tracking guidance is
The HHS OCR tracking guidance is a bulletin — formally, "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" — issued by the Office for Civil Rights within the US Department of Health and Human Services. OCR first published it on December 1, 2022, and revised it on March 18, 2024. It exists to spell out when the everyday web technologies on a healthcare site — Meta Pixel, Google Analytics, ad SDKs, session-recording scripts — collide with HIPAA.
The bulletin's core message is straightforward. When a tracking technology on a regulated entity's site collects information that qualifies as protected health information (PHI) and transmits it to a third party, two things follow: that third-party vendor becomes a business associate who must sign a Business Associate Agreement (BAA) and implement HIPAA safeguards, and transmitting PHI to a vendor without one is an impermissible disclosure. That principle — PHI going to a vendor needs a BAA — was never in dispute and remains fully in force.
What was disputed was one specific, aggressive claim the bulletin made about the least-obvious case: public pages.
What AHA v. Becerra actually changed
Here is the precise ruling, because the entire "are we covered now?" question turns on getting it exactly right. In November 2023, the American Hospital Association — joined by the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System — sued HHS over one part of the bulletin. On June 20, 2024, the US District Court for the Northern District of Texas ruled that OCR had "acted in clear excess of HHS's authority under HIPAA," and vacated the guidance — nationwide, but only to a narrow extent.
What the court removed was what the bulletin called the "Proscribed Combination": the claim that HIPAA obligations are triggered when an online technology connects (1) an individual's IP address with (2) a visit to an unauthenticated public webpage addressing specific health conditions or providers. The court held that this, on its own, isn't individually identifiable health information — the closest it gets, in the court's words, is "a speculative inference." HHS appended an update to the bulletin, filed a notice of appeal, and then withdrew that appeal on August 29, 2024, making the AHA's win final.
Look at the proportions in that diagram, because they're the whole point. The vacated slice is real relief — but it's one theory about one kind of page. The lawsuit only ever challenged the Proscribed Combination; the AHA didn't contest the rest of the bulletin, and the court left it standing. So the accurate headline isn't "the OCR guidance was struck down." It's "one aggressive claim about public pages was removed, and everything else survived intact."
What still applies — the part that matters most
If you take one thing from this guide, make it this list. These obligations were never touched by the ruling and remain fully in force in 2026:
The guidance in 2026: still the baseline, and sharper
Two years on, where does the guidance actually stand? Three facts define its 2026 status.
First, OCR never replaced it. Rather than reissue a revised bulletin, HHS left the guidance in place minus the vacated portion. That matters because the bulletin remains the regulatory baseline courts reference when deciding whether a covered entity "knew or should have known" that its trackers were transmitting PHI. In other words, the document you might assume is defunct is still the yardstick in litigation.
Second, a reissue is legally harder now. The same year as Becerra, the Supreme Court's decision in Loper Bright ended Chevron deference — the doctrine that led courts to defer to agencies' interpretations of ambiguous statutes. With less deference available, HHS faces a steeper climb to revive the vacated theory through new sub-regulatory guidance. The Proscribed Combination isn't likely to quietly return.
Third, and most important operationally, OCR's tracking scrutiny has intensified rather than eased. Through 2026, OCR has specifically flagged Meta Pixel, Google Analytics, and third-party ad SDKs on patient portals and appointment-scheduling pages, and now expects covered entities to demonstrate knowledge and control of their pixel, SDK, and analytics data flows. Alongside its Risk Analysis Initiative — under which nearly every settlement cites a missing or inadequate risk analysis — the message is that the surviving guidance is being enforced, not shelved.
Can you demonstrate control of your data flows?
OCR now expects you to show what your trackers do and where. See which trackers fire on your site — and before consent — in about 10 seconds, no account. It's the fastest way to know whether a pixel is running where the guidance still bites.
Scan your site free →The risk that grew instead
Here's the irony that makes the "we're covered now" reading so dangerous: even where Becerra genuinely reduced OCR risk on public pages, it did nothing to touch the threat that has actually grown — private litigation. Regulatory enforcement was never the biggest financial danger; plaintiffs' firms were.
So the honest way to read Becerra is that it trimmed one branch of regulatory risk while the litigation tree kept growing. We track the wiretapping side on our CIPA Lawsuit Tracker, and cover the "can I actually be sued?" question in can you be sued for a HIPAA tracking violation? This is general information, not legal advice.
The line that matters: authenticated vs public
Strip the guidance down to something operational and it comes to a single line running through your website: authenticated versus unauthenticated. That line is where the guidance's teeth are, and it's the map you actually need.
Patient portals and logged-in pages · appointment-booking and scheduling flows · intake and symptom forms · anywhere a user types health information. Trackers and session-replay here still trigger HIPAA, untouched by the ruling.
General, unauthenticated public pages (a homepage, a "conditions we treat" article). The narrow IP-only theory was vacated here — but other identifier combinations, and anything a visitor types, can still be PHI. Configure and verify, don't assume.
The reason this line is hard in practice isn't the concept — it's visibility. OCR now expects you to demonstrate knowledge and control of your data flows, and you can't demonstrate control of what you can't see. Trackers get added through tag managers and forgotten; a pixel meant for the marketing homepage ends up loading on the portal login; a scheduling widget quietly ships appointment reasons to an analytics vendor. Mapping which trackers fire on which pages — and whether they fire before consent — is the practical core of complying with the surviving guidance.
That's the prevention-first posture ConsentPixel — Privacy · Verified is built to support: it scans what fires across your pages so you can see where trackers run relative to the authenticated line, blocks non-essential third-party trackers until a visitor consents, honors opt-out signals, and logs each decision as evidence — so you can actually demonstrate control rather than assert it. To be clear about the boundary, ConsentPixel is a consent and detection layer, not a BAA and not a HIPAA authorization mechanism; keep session-replay and non-BAA analytics off authenticated and PHI-collecting pages entirely (see session replay on patient portals and HIPAA-compliant analytics). This is information, not legal advice.
What to do now
The surviving guidance turns into a short, practical sequence — and none of it depends on the Proscribed Combination coming back or staying gone.
Frequently asked questions
What is the HHS OCR tracking guidance?
It's a bulletin from the HHS Office for Civil Rights titled "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates," first published December 1, 2022 and revised March 18, 2024. It explains when web trackers — pixels, analytics, ad SDKs, session-replay scripts — collide with HIPAA. Its core rule: when a tracker collects protected health information and sends it to a third party, that vendor becomes a business associate who needs a signed Business Associate Agreement, and sending PHI without one is an impermissible disclosure. Most of the bulletin remains in force in 2026. This is general information, not legal advice.
Did AHA v. Becerra strike down the OCR tracking guidance?
No — it partially vacated it. On June 20, 2024, a federal court in the Northern District of Texas vacated, nationwide, only the "Proscribed Combination": the claim that an IP address plus a visit to an unauthenticated public webpage about a health condition is, by itself, PHI. HHS withdrew its appeal on August 29, 2024, making that final. But the court left the rest of the bulletin intact — trackers on authenticated pages, form and appointment data, other identifiable combinations, and the BAA requirement all still apply. Describing the ruling as striking down the guidance is inaccurate and, for a healthcare site, dangerous.
Can I use tracking pixels on my healthcare website now?
Only in limited ways, and not where PHI can be captured. After AHA v. Becerra, a general unauthenticated public page (like a homepage) that only exposes an IP address is lower risk under HIPAA. But trackers still cannot run on authenticated pages like patient portals, on booking or scheduling pages, or on forms where users type health information — those still trigger HIPAA. And because Meta and Google won't sign BAAs for their pixel and analytics products, those tools can't lawfully receive PHI anywhere. Separately, state laws, the FTC, and California's CIPA still apply regardless of the OCR ruling.
Is the Meta Pixel HIPAA compliant on a healthcare site?
The Meta Pixel can't be used with PHI, because Meta won't sign a Business Associate Agreement for it. Under the OCR tracking guidance, any vendor receiving PHI needs a BAA, so a tool that can't sign one shouldn't run where PHI can be captured — patient portals, scheduling pages, and health-information forms. AHA v. Becerra narrowed one theory about IP addresses on public pages, but it didn't make the Meta Pixel safe on pages that handle patient data. Healthcare pixel lawsuits, many involving the Meta Pixel, have driven settlements into nine figures cumulatively. This is general information, not legal advice.
Is the OCR tracking guidance still enforced in 2026?
Yes. OCR never replaced the bulletin after AHA v. Becerra; it remains the baseline courts reference for whether a covered entity "knew or should have known" its trackers transmitted PHI. Through 2026, OCR's scrutiny of tracking technologies has intensified — it has specifically flagged pixels, analytics, and ad SDKs on patient portals and appointment-scheduling pages, and now expects covered entities to demonstrate knowledge and control of their data flows. The Supreme Court's end of Chevron deference in Loper Bright also makes it harder for HHS to revive the vacated portion through new guidance, so the surviving bulletin is likely to remain the standard.
What's the difference between authenticated and unauthenticated pages here?
It's the line the guidance turns on. Authenticated pages require a login — patient portals, logged-in dashboards, secure messaging — so the visitor is identified and their activity is PHI; trackers there still trigger HIPAA, and AHA v. Becerra left this untouched. Unauthenticated pages are public and require no login; the ruling removed the narrow theory that an IP address alone on such a page is PHI. But even on public pages, other identifier combinations and anything a user types about their health can still be PHI. In practice: treat authenticated and PHI-collecting pages as no-tracker zones, and configure and verify public pages carefully.
The bottom line
The HHS OCR tracking guidance was narrowed by AHA v. Becerra, not repealed. The court removed one theory — an IP address on an unauthenticated public health page — and left the rest of the bulletin standing: patient portals, forms, appointment data, other identifiable combinations, and the BAA requirement are all exactly as binding as before. In 2026 OCR hasn't replaced the guidance, it remains the yardstick courts use, and enforcement scrutiny has sharpened.
Meanwhile the risk the ruling didn't touch — private class actions, state health-data laws, the FTC, and CIPA — has grown into the sector's dominant exposure. So the correct response to Becerra isn't relief; it's precision: know the authenticated line, keep trackers off the pages that still trigger HIPAA, BAA-cover the rest, and be able to demonstrate what runs where.
That last part — proving control of your data flows — is something you can see for yourself in about ten seconds.
See where your trackers fire — before OCR or a plaintiff does
ConsentPixel — Privacy · Verified scans what fires across your pages, blocks non-essential trackers before consent, and logs it as evidence — so you can demonstrate control of your data flows. It's a consent and detection layer, not a BAA. Start with a free scan, then a 14-day trial.
Scan your site free →Information, not legal advice. This article explains the HHS OCR online tracking guidance and American Hospital Association v. Becerra for general educational purposes and does not constitute legal advice or create an attorney–client relationship. The June 20, 2024 ruling (N.D. Tex., No. 4:23-cv-1110) vacated only the "Proscribed Combination" portion of the guidance; HHS withdrew its appeal on August 29, 2024. How HIPAA, the surviving guidance, state health-data laws, the FTC Act, and CIPA apply to your organization depends on your specific facts, and enforcement and case law continue to evolve. Settlement figures reflect publicly reported information as of September 2026. The $5,000-per-violation figure reflects statutory damages under California Penal Code §637.2. Confirm your obligations with qualified counsel. ConsentPixel — Privacy · Verified is not a law firm and does not sign Business Associate Agreements.