October 23, 2026
This story is fictional. If it sounds like your hospital, that’s between you and your privacy officer.
ELLERY REGIONAL HEALTH. Digital Engagement Report, Third Quarter. Prepared by Web and Digital Marketing for the Vice President, Marketing and Communications.
Summary
The third quarter was our strongest since the patient portal relaunch. Sessions rose 31 percent and cost per acquired patient fell 18 percent. For the first time, our advertising partners can see the whole patient journey, from a first search to the visit summary.
Highlights
The new tag manager now fires on every page of the portal, including Messages, Test Results and Visit Summary. IT approved the change in July as a routine analytics update.
The audience Oncology – New Diagnosis is built from portal users who opened Test Results and then visited the Cancer Center’s scheduling page within 48 hours. It grew to 4,200 people and is now our best-converting retargeting audience.
The audience Fertility Journey includes everyone who logged in to message the Reproductive Medicine clinic. A follow-on audience, Fertility – Lapsed, captures users who stopped logging in. They receive our “It’s Not Too Late” creative.
Our partners’ cross-device matching now links each portal user to the other devices in the household. Reach increased 2.4 times.
Patient feedback
We received one comment through the website feedback form. It is reproduced below with identifying details removed, as our privacy policy requires.
My husband used your portal to read his scan results in August. I didn’t know what they said until the ads started on my phone. Thank you for the brochure about the hospice house. It is very nice. He saw it too.
Recommended action
Extend cross-device matching to all service lines in the fourth quarter.
Before you read on: What did the tag manager send, and to whom? Does the 2024 court ruling on OCR’s tracking guidance help this hospital? Who else received PHI because of cross-device matching?
A tracking pixel on an authenticated portal page sends the advertising vendor the user’s IP address and device identifiers, the address of the page being viewed, and often the page’s contents. On a page titled Test Results, that is PHI. Unless the vendor is a business associate under a BAA, which the large ad platforms generally decline to sign, the disclosure is impermissible (45 C.F.R. § 164.502(a)). Targeting ads with it is marketing, which requires the patient’s authorization (§ 164.508(a)(3)). Cross-device matching adds another disclosure, this one to the people in the household who see the ads, including a wife who learned her husband’s diagnosis from her own phone.
OCR laid this out in its December 2022 bulletin on tracking technologies, revised in March 2024. On June 20, 2024, in American Hospital Association v. Becerra, the Northern District of Texas vacated one part of the bulletin, the “proscribed combination” of an IP address and a visit to an unauthenticated public page about a health condition or provider. The ruling did not reach authenticated pages such as a patient portal, so it gives Ellery no cover, and HHS later withdrew its appeal. State wiretap and consumer-protection suits over hospital pixels add exposure beyond HIPAA, including for public pages the vacatur covered.
IT approved the tag-manager change as a routine analytics update, and nobody in the privacy office saw it, although the change decided what data left the hospital and where it went.
To prevent a repeat, inventory every tag on every page at least quarterly, using a scanning tool rather than the marketing team’s memory. Allow no third-party tracking on authenticated pages unless the vendor has signed a BAA. Put tag-manager changes under change control, with the privacy office as a required reviewer. Ask whether any audience is named after a diagnosis, and if one is, stop the campaign that uses it.
Takeaway: Keep third-party tags off the patient portal unless the vendor has signed a BAA.