Before deciding whether a tracking setup is appropriate, you need to know what it collects and where that information goes. A product name or a “privacy-friendly” label cannot answer that question on its own.
Understand the context
HHS guidance explains that HIPAA obligations apply when regulated entities collect or disclose protected health information through tracking technology. It also notes that a court vacated part of the guidance concerning an IP address linked to a visit to certain public, unauthenticated pages. The public-page analysis should not be reduced to a blanket statement that every visit is protected health information.
Read the current HHS tracking guidance with your privacy and legal advisers. The review needs to reflect your actual systems and data flows.
Inventory the tools
List analytics tags, advertising pixels, session replay tools, chat widgets, forms, scheduling systems, and portal links. Include tools added through tag managers and plugins, not just scripts visible in the page template.
Record who owns each tool, why it is there, and which vendor receives the information.
Inspect what is transmitted
Review page addresses, query strings, event properties, form fields, and user identifiers. Pay particular attention to appointment, registration, and authenticated flows. Do not assume that removing a name means a record cannot identify someone.
Use a controlled review with test data. Avoid entering real patient information into a debugging tool or sending it to a marketing platform while investigating.
Review the vendor relationship
Have the responsible team assess permitted uses, agreements, access, and retention. A business associate agreement may be relevant, but a contract alone does not repair an inappropriate technical implementation.
Document decisions and the limits of the assessment. Fillungo can help inspect and configure tracking; legal conclusions belong with your qualified advisers.
Check again after changes
A new form, plugin, campaign parameter, or booking integration can change the information collected. Build tracking review into website releases and vendor changes rather than treating it as a one-time exercise.