Piwik PRO

73% of major US hospital websites are tracking visitors who legally opted out. That's the headline finding from a new study we commissioned at Piwik PRO. Verified Data audited 59 major US hospital and clinic websites, crawling them from California with an active Global Privacy Control signal. That signal is a legal opt out recognized in 12 states. It was ignored on 43 of the 59 sites. A few more numbers that stood out to me: 69% were using marketing or advertising cookies, which usually means data flowing to third party ad platforms. And the gap between the two figures matters: some trackers were running without cookies at all, so cookie blocking alone would not have fixed the exposure. The scans found 75 unique tracking tools in active use. Google Analytics was the most common analytics platform, despite Google explicitly refusing to sign BAAs and prohibiting covered entities from sending it PHI. Here's the part I keep coming back to. Most of these organizations did not choose their tracking setup. They inherited it. Google Analytics and Meta pixels became the default because they were free and familiar, and nobody revisited that decision when HHS made it clear in 2022 that the marketing website falls under HIPAA too. Since then: 19 enforcement cases, over $100M in penalties, the FTC warning 130 hospital systems, and state laws like Washington's My Health My Data Act giving patients the right to sue directly. The fix is not abandoning analytics or marketing. It's rebuilding the layer underneath: enforcing opt outs at the tag level, replacing ad pixels on health related pages with first party strategies, and using an analytics platform that signs a BAA as standard. That's exactly what we built Piwik PRO for. Compliant data your legal team can defend and your marketing team can actually use, without tearing down years of work to get there. Full report in the comments. If you want to know where your own site stands, we also offer a free compliance scan. https://lnkd.in/dP8_sbf7 #HIPAA #HealthcareMarketing #Analytics

What if your biggest privacy risk isn't a data breach, but the marketing stack you've trusted for years? ⚠️ That question came to mind while reviewing the findings of our latest research with Verified Data. We audited 59 major US healthcare websites and found that 73% were still running advertising or marketing trackers despite an active opt-out. I don't think this is because healthcare organizations don't care about privacy. Most are using technologies that became the industry standard long before today's regulatory landscape took shape. Sometimes the right configuration is enough. But in many cases, the platform's architecture simply isn't designed to support the level of privacy and control you need. When that happens, it's worth asking whether it's time for a change - because stopping website measurement isn't the answer. 📑 If you'd like to see the full findings and what they mean for healthcare organizations, read the report here: https://lnkd.in/egJhhm9y

Did you know that 73% of major hospital websites keep tracking visitors even after they opt out? If you don't want to be a part of this group, our report with Verified Data is worth a read. It walks through the most common compliance gaps on healthcare websites, the risks they carry under HIPAA, and how to close them with marketing tools built for healthcare from the start.

Did you know that 73% of major hospital websites keep tracking visitors even after they opt out? If you don't want to be a part of this group, our report with Verified Data is worth a read. It walks through the most common compliance gaps on healthcare websites, the risks they carry under HIPAA, and how to close them with marketing tools built for healthcare from the start.

Most healthcare marketing teams assume that when a visitor opts out, tracking stops. Our audit with Verified Data found that's often not true. Across 59 US hospital websites we examined, 73% kept firing advertising trackers even after visitors actively opted out of tracking. Read the report if you want to learn: - Which trackers are most common on healthcare websites - Why they create HIPAA and compliance risks - What recent enforcement actions reveal - How to set up HIPAA-compliant analytics and marketing without losing visibility into performance

I think the healthcare industry is asking the wrong question. The conversation is usually: "How do we make Google Analytics, advertising pixels and marketing trackers HIPAA compliant?" But what if that's the wrong question? What if the real question is: "Why are we using tools designed for digital advertising to measure patient journeys in the first place?" That's the conclusion I reached after researching tracking technologies across major US healthcare websites. Many organisations are investing significant time configuring consent banners, refining tag management and reviewing privacy policies. Those things matter. But they cannot fundamentally change what a platform was designed to do. General-purpose marketing tools were built to maximise audience targeting and advertising performance. Healthcare requires something different: data minimisation, governance, accountability and patient trust. To me, this is becoming less of a configuration problem and more of an infrastructure problem. We're trying to make the wrong tools fit the job. That is why I believe healthcare organisations need to rethink their entire measurement stack — not simply optimise the one they inherited. I have explored this in a joint article with Piwik PRO: 👉 https://lnkd.in/dsD7qBXq I'd genuinely like to hear other perspectives. Can general-purpose marketing platforms ever be made appropriate for healthcare, or is it time to accept that regulated industries need purpose-built analytics?