HIPAA-compliant website analytics: the 2026 buyer's guide

This guide covers what HIPAA actually requires of an analytics vendor, the three ways healthcare organizations solve it, and a straight comparison of 13 tools: which sign a BAA, on which plan, at what price, and what you give up with each. We built one of the 13, and we've said so everywhere it's relevant. The comparison is the same one we'd want if we were buying.

HIPAA does not ban analytics. It bans handing protected health information to a company that has not signed a contract agreeing to protect it. That contract is a Business Associate Agreement. Under the Privacy Rule, a vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate, and you need a signed BAA before that data flows. No BAA, no lawful flow. It is a binary.

This is where most of the genuine confusion lives, and where the law moved recently. In December 2022, HHS OCR published a bulletin on tracking technologies, revised in March 2024, saying that an IP address combined with a visit to a page about a health condition could itself be protected information, even on a public, unauthenticated page. The hospital industry challenged it, and the plaintiffs' complaint gave that pairing a name the court later adopted: the "Proscribed Combination."

Headlines said a court struck down the HIPAA tracking rules. Three things are wrong with that sentence. It was guidance, not a rule. Only part of it was vacated. And HHS was never where the money came from: almost all of it rests on state wiretap statutes, medical confidentiality laws, common-law privacy claims and the FTC's deception theory. State law kept moving the other way. Washington's My Health My Data Act carries a private right of action. Nevada has its own consumer health data law, and Connecticut added consumer health data protections to its privacy act. California's Invasion of Privacy Act, a wiretapping law from 1967, is the engine behind several of the largest healthcare settlements of the past two years.

Vocabulary matters here, and a lot of marketing content gets it wrong in ways a general counsel will catch. A class settlement is not a fine. Refunds are not a penalty. A pending complaint is an allegation. Start with the fact nobody puts in these articles: HHS OCR has never announced an enforcement action premised on website tracking technologies. The FTC has been the active federal enforcer, and the money has come from private class actions.

In September 2026 we ran an informal audit of the homepages of 30 healthcare organizations, a mix of health systems, multi-location groups and behavioral health networks. We're not publishing the site list, but the shape of the results is worth reporting, because it wasn't what the headlines predict.

Note the shape of this. Three years of litigation removed the tag that was in the headlines, and left the one that carries most of the traffic data: half the sample was still sending page-level behavior to a company that states plainly it will not sign a BAA.

There are only three real architectures. Everything on the market is a variation of one of them.

Everything below was checked against each vendor's own public pages in September 2026. Where a vendor doesn't publish something, we say so rather than guessing. Prices change; verify before you sign.

Which raises the question this guide has been circling: if self-hosting is a legitimate path, why buy anything? Because self-hosting moves the work rather than removing it. Someone owns the servers, the encryption, the access controls, the audit logs, the patching, the backups and the security review, permanently. Organizations with an infrastructure team and a security function can carry that. A five-person marketing team at a regional health system cannot, and shouldn't pretend otherwise to save a subscription. That gap is the entire reason managed, BAA-backed platforms exist, ours included.

The objection that stops most of these projects isn't legal. It's a CFO asking why the marketing budget should survive if nobody can say which campaigns produce patients. It's a fair question, and the honest answer is that the individual-level attribution most teams think they have is mostly an illusion anyway. Cross-device journeys break it. Cookie lifetimes break it. Consent gates break it. A patient who sees a billboard, searches your brand three weeks later on a phone, and books from a laptop is credited to direct traffic on every platform you own.

Ten questions. Any vendor worth buying answers all ten without a follow-up call.

If you're switching, this is the sequence that avoids a gap in the data and an argument with legal. Start with the inventory: open DevTools on your homepage, an appointment page, a condition page and your portal login, reload, and look in the Network tab for googletagmanager, google-analytics, gtag, doubleclick, connect.facebook.net, tiktok, snapchat, linkedin, bing, clarity.ms, hotjar and criteo. Anatomy of a PHI Leak walks through it screen by screen.

If you want to see what's currently firing on your own site, the inventory step above costs nothing and takes about ten minutes. Anatomy of a PHI Leak shows you exactly what to look for. If you want to see the product this guide's authors build, pricing is public, the BAA is on every plan, and a demo is one booking away.

This guide is general information about HIPAA and website analytics, not legal advice. Settlement figures and vendor terms were checked against primary sources on September 16, 2026 and are updated monthly. Ghost Metrics is one of the vendors compared.