If your healthcare website has a cookie consent banner, no Google Analytics cookies visible in the browser, and a “clean” cookie audit, you might assume you’re in good shape from a HIPAA standpoint.
You’re probably not.
This post explains a scenario we see repeatedly on healthcare websites: tracking technologies that are genuinely invisible to standard cookie checks but are actively transmitting visitor data to third parties without a Business Associate Agreement (BAA). Understanding why this happens, and why cookie consent banners don’t fix it, is essential for anyone responsible for a healthcare organization’s digital presence.
What Looks Compliant Might Not Be
Consider a healthcare website running Google Tag Manager (GTM). The site has a cookie consent banner. A quick check in cookie-viewing tools (such as Cookie-Editor or the browser’s developer tools) shows no Google Analytics cookies (_ga, _gid) in the browser. By the most common markers people use to check for tracking, the site looks clean.
A proper HIPAA compliance scan on a site like this might tell a different story: Google Analytics 4 (GA4) found on all pages, Meta Pixel on several pages, Google Ads on a couple of pages, HubSpot Analytics across all pages, and YouTube embeds site-wide. Every one of these is flagged as a high-risk HIPAA violation.
How can all of that be present when the cookies are nowhere to be seen?
The answer has two parts: 1) how Google Tag Manager works, and 2) what cookie consent banners actually do.
Google Tag Manager Is a Delivery Container, Not a Tracker
Google Tag Manager is not itself a tracker. It’s a container, a delivery system that lives in your website’s HTML as a single snippet and then dynamically injects other scripts after the page loads.
When a developer “installs GA4,” they often don’t add GA4 code directly to the website’s HTML. Instead, they publish a GA4 tag inside GTM. The HTML only shows the GTM snippet. GA4 itself is injected into the live DOM by GTM’s JavaScript at runtime, after the browser has loaded the page.
This is why GA4 is invisible in the page source but fully present in the rendered page. A scanner running as a headless browser, executing JavaScript the way a real visitor’s browser would, sees everything GTM injects. Someone reading the raw HTML, or checking the static source, sees only the GTM container.
The same logic applies to Meta Pixel, Google Ads conversion tracking, and any other tag deployed through GTM. None of them leave a footprint in the HTML. They all arrive via GTM after load.
This means a source-code review or a “View Page Source” check is not a reliable method for auditing tracking on a modern website. Any audit that doesn’t execute JavaScript and inspect the live DOM will miss GTM-delivered tags entirely.
Cookie Consent Banners Block Cookies, Not Data Transmission
The second piece of the puzzle is what cookie consent tools actually do versus what most people think they do.
A properly configured consent management platform (CMP) (such as Cookiebot, OneTrust, or Usercentrics) can be set up to block third-party scripts from loading until consent is granted. In this “prior consent” mode, GTM won’t fire tracking tags until a visitor clicks Accept.
However, many implementations operate in a softer mode: scripts load and run, but they’re prevented from writing persistent cookies. The tracker fires, transmits data, and then doesn’t leave a cookie in the browser. This is why cookie-audit tools shows a clean slate, there are no cookies to show. The tracking happened at the network level before a cookie was ever written.
This distinction matters enormously. Cookie auditors show you what’s stored in the browser. They don’t show you what data has already left the browser and arrived at Google’s or Meta’s servers.
The HIPAA exposure isn’t the cookie. It’s the outbound data transmission.
IP addresses, page URLs (which on a healthcare website can reveal the condition a visitor is researching), referrer data, and behavioral signals are transmitted the moment a tracker fires, regardless of whether a cookie is set.
Patients Cannot Waive Their HIPAA Rights by Clicking “Accept”
This is the point that most surprises healthcare marketers, and it’s the most important one to understand.
In December 2022, the HHS Office for Civil Rights published a bulletin titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.” It was revised in March 2024 in response to litigation, but its core position remains: cookie consent banners are not a valid mechanism for HIPAA authorization.
The bulletin states explicitly that HIPAA-covered entities and business associates may not use tracking technologies in a manner that would result in impermissible disclosures of Protected Health Information (PHI) to tracking technology vendors, regardless of whether visitors have clicked “Accept” on a consent banner.
This is a fundamental difference between HIPAA and the privacy frameworks consent banners were designed for. GDPR, CCPA, and similar laws are largely consent-based: get meaningful permission, and the data use is lawful. HIPAA operates on an entirely different model.
Under 45 CFR §164.502, a covered entity may only use or disclose PHI as the Privacy Rule permits or requires, or as the individual authorizes in writing via a valid HIPAA authorization. A cookie-consent click does not constitute a HIPAA authorization. The HHS OCR bulletin is explicit: “A covered entity’s or business associate’s use of tracking technologies is not rendered permissible under HIPAA simply because an individual has provided consent through a cookie consent banner.”
For a healthcare website, a visitor’s IP address combined with a URL indicating they’re seeking information about a mental health condition, a foster care service, or a psychiatric hospital constitutes PHI under HHS’s interpretation. That data cannot be transmitted to Google (which will not sign a BAA) with or without the visitor’s consent to cookies.
The obligation runs to the covered entity, not the visitor. Patients cannot opt in to a HIPAA violation.
An Important Legal Caveat: The Landscape Is Still Evolving
The guidance in this area is not fully settled. In June 2024, a federal district court in the Northern District of Texas partially vacated the 2022 HHS OCR bulletin in American Hospital Association v. HHS, finding that HHS had overstepped, particularly in its blanket treatment of IP addresses as PHI on unauthenticated public webpages. HHS had already begun narrowing that guidance with a revised bulletin in March 2024, and the current picture is that tracking on authenticated pages (patient portals, intake forms, anything behind a login) carries the clearest and least-disputed HIPAA risk, while unauthenticated public pages occupy grayer territory. What hasn’t changed: the BAA requirement is real, the FTC has separately expanded its Health Breach Notification Rule to cover health apps and connected devices beyond traditional HIPAA covered entities, and the trend in enforcement is toward greater scrutiny, not less. Healthcare organizations should work with qualified legal counsel to assess their specific exposure — what this post can say with confidence is that a cookie consent banner is not a compliance solution, and trackers delivered via GTM are not visible through standard cookie checks.
What Should Healthcare Organizations Do?
1. Audit with the right tools. Run a scan that uses DOM inspection and network monitoring, not just cookie enumeration. The gap between what a cookie auditor shows and what’s actually running can be significant.
2. Inventory everything in GTM. Pull a full list of every tag published in your GTM container. Many organizations have tags added by marketing vendors over the years that have never been reviewed for HIPAA implications.
3. Evaluate each vendor against the BAA requirement. Google and Meta do not offer BAAs for their standard advertising and analytics products. Any tag that transmits data to these vendors from a healthcare website requires a compliance decision, either removal, replacement with a HIPAA-compliant alternative, or a documented legal determination that the data involved does not constitute PHI.
4. Don’t confuse GDPR compliance with HIPAA compliance. Your cookie consent banner may be doing exactly what it was designed to do. It was designed for GDPR, not HIPAA. They are different laws with different requirements.
5. Consult legal counsel. Given the evolving state of OCR guidance and recent litigation, organizations should work with healthcare privacy attorneys to assess their specific situation, particularly for unauthenticated public pages where the legal picture is less clear.
The Bottom Line
A clean cookie audit is not a HIPAA audit. The most significant tracking risks on healthcare websites in 2026 are invisible to Cookie-Editor, hidden inside GTM containers, and unaddressed by consent banners built for a different regulatory framework.
The good news is that a proper scan takes minutes, not weeks, and gives you a clear picture of what’s actually running on your site.
See what’s actually running on your website.
This post is for informational purposes only and does not constitute legal advice. Healthcare organizations should consult qualified legal counsel regarding their specific HIPAA compliance obligations.
