Third-party trackers where patients type their details

What the source requires

A covered entity may not disclose protected health information except as the Privacy Rule permits. A tracker that loads on an appointment or intake form can receive what a patient types there — name, contact details, reason for the visit — and HHS treats that as a disclosure of PHI to the tracker vendor.

Why this is hard to satisfy

Booking pages are built by whoever built the site, and the agency that added the ad tag never asked whether a patient would type a reason for their visit on that page. Most tracker vendors will not sign a business associate agreement.

What we do about it

Booking and intake run in a frame or page with no third-party tags, and the tags that remain are listed with the agreement, if any, that covers each.

In build · phase two