You can run them yourself, on your own site, in about ten minutes, with nothing but Chrome. No email gate, no sales call required. (If you'd rather not do it by hand, our free PHI scanner runs the automated version against any URL — also ungated.)

Before you start: what counts as a leak

A leak, for this audit, is any transmission that connects an identifiable visitor (IP address, cookie ID, email, phone, click ID tied to an ad account) with health context (a condition or service page, an appointment request, form contents, portal activity) to a third party that hasn't signed a BAA — which includes Meta, Google's ad and analytics products, TikTok, Microsoft Clarity, and Hotjar, none of whom will sign one for these tools.

The 2024 court ruling that partially vacated OCR's tracking bulletin narrowed the "every public pageview is PHI" theory — but forms, booking flows, authenticated pages, FTC enforcement, and state privacy laws are all fully intact. Details: what still applies after the vacatur.

Grade each finding as you go:

• Critical — identifiable data + health context leaving together (form data, booking events, portal pages).
• High — third-party trackers running on health-context pages.
• Moderate — trackers on generic pages (home, about) with no health context in the payload.

The 10-Minute PHI Leak Audit Checklist (Ungated)

Open Chrome, use an Incognito window so extensions don't pollute results, and open DevTools (F12 or right-click → Inspect) → Network tab. Keep it open for every step.

Minute 1–2: Inventory the trackers on your homepage

Load your homepage. In the Network tab's filter box, type each of these, one at a time:

facebook · doubleclick · google-analytics · googletagmanager · tiktok · clarity · hotjar · linkedin · snapchat

What you're looking for: any request at all. Each hit is a third-party tool receiving your visitor's IP and browsing activity.

What a leak looks like: requests to facebook.com/tr, google-analytics.com/g/collect, analytics.tiktok.com. On the homepage alone this is moderate — but it tells you the tags exist, and tags installed sitewide follow the visitor everywhere.

Minute 3–4: Repeat on your highest-risk pages

Now load, with the Network tab still filtering:

• Your most sensitive service or condition pages (the ones a patient wouldn't want on a billboard)
• Your booking or contact page
• Your patient portal login page

What a leak looks like: the same tracker requests firing on these pages. Click a facebook.com/tr request and look at its payload — you'll typically see dl= (the full page URL, condition name included) and fbp/fbc cookie identifiers. That pairing — identity cookie + condition URL — is the core of every pixel lawsuit. High severity; on the portal login, critical.

Minute 5–7: Submit a test form and watch what fires

Clear the Network log (the 🚫 icon). Fill out your own contact or appointment form with fake data — "Test Patient, 555-0100, interested in [your most sensitive service]" — and submit.

What you're looking for: every request that fires between clicking submit and the thank-you page settling.

What a leak looks like:

• A request to an ad platform containing form values. Check payloads for the fake name or phone. Some pixel configurations ("automatic advanced matching") scrape form fields by design. Critical.
• A Lead or SubmitApplication event to facebook.com/tr, or a conversion ping to Google, fired from the browser at the moment of submission — even without the field values, the platform just learned that this identified browser requested an appointment. Critical.
• A tracker request on the thank-you page. Thank-you URLs are confessions: anyone who loads /thank-you-consultation/ asked for a consultation. High to critical.

Minute 8: Check URLs and page titles

Look at your site's URL structure and <title> tags on sensitive pages, and at what your forms put in the query string.

What a leak looks like: condition names, service selections, or — worst case — form data reflected into URL parameters (?service=addiction-treatment&name=...). Every analytics and ad tag on the page transmits the full URL and title by default. Also confirm nothing patient-identifying ever appears in a URL you'd share or that redirects through tracking. Critical if identifiers appear; high for condition context.

Minute 9: Chat widgets and call tracking

If you run a chat widget or a call-tracking number swapper, filter Network for the vendor's domain while you open the chat and load a few pages.

What you're looking for: whether the chat vendor receives page context (it almost always does — a chat opened on a condition page tells the vendor the condition) and whether your call-tracking script ships page-level data to a vendor without a BAA and healthcare configuration.

What a leak looks like: transcript or page-context payloads to a consumer chat tool; session data to a call tracker on its standard (non-healthcare) plan. High.

Minute 10: View source for the stragglers

Right-click → View Page Source and search for fbq(, gtag(, ttq., clarity(, hj(, and GTM-.

What you're looking for: tags that didn't fire in your session (consent banners and ad blockers can suppress them intermittently) but are installed and firing for other visitors. A tag in the source is a tag in production. If you find a GTM container, remember: anyone with GTM access can add new trackers to every page without touching the site — the container is the exposure. More on that: Is Google Tag Manager HIPAA compliant?

Scoring your results

• Any critical finding: stop the leak this week. Remove the pixel from booking flows, thank-you pages, and the portal today; the marketing replacement can come after. Talk to your compliance officer or counsel about whether the leak is reportable — that's a legal judgment, not a marketing one.
• High findings only: you're running the standard fact pattern from the pixel class actions. Plan the migration off client-side tracking this quarter.
• Moderate only: you're ahead of most practices — but "pixel on the homepage, nowhere else" rarely survives contact with the next agency or plugin update. Lock it down structurally.

And note what this audit can't see: it's a snapshot of one browser session. Tags change, staff and agencies add scripts, plugins update. A clean pass today is not a clean site in March.

Two common false alarms, so you don't over-report: a request to googletagmanager.com/gtm.js alone is the container loading, not data leaving — the findings are what the container fires. And your own domain's requests (your forms posting to your own server, your booking widget talking to its HIPAA-covered backend under a BAA) are the system working as designed. The audit is about third parties without BAAs, not about traffic itself.

Fixing it without going dark

The wrong fix is deleting all analytics and flying blind — you'll lose the conversion data your ad campaigns need to work, and within a quarter someone will quietly reinstall the pixel "just to get reporting back."

The right fix is structural, and it's how PilotPractice builds every client site:

• One first-party tracking script instead of a pile of vendor pixels — it captures an allowlisted set of parameters (UTMs, ad click IDs) and a visitor ID, and nothing else can leave the browser. Allowlist, not blocklist: the question is what's permitted out, not what's blocked.
• Ad platforms get conversion events, never form contents — conversions are uploaded server-side against the click ID, so Google and Meta can optimize campaigns without ever seeing who booked or why.
• Analytics survives via a HIPAA-safe server-side GA4 forwarder — synthetic client IDs, PII scrubbing, whitelisted parameters — the forwarder design we're building into the platform. Full verdict and architecture: Is Google Analytics HIPAA compliant?
• Retraction jobs exist for the edge cases — data sent in error can be pulled back, not just apologized for.

That architecture is also what makes compliant retargeting and Meta advertising possible at all — the campaigns keep their optimization signal while patients keep their privacy.

Run the automated version — free, no email

The manual audit above catches the big leaks. Our free PHI scanner runs the full automated sweep against any URL — every tracker, every page type, payload inspection included — and gives you the report with no gate, no email, no call. (Yes, our biggest competitor gates theirs. Ours is the audit; the report is yours.)

If the scan comes back ugly, that's fixable. PilotPractice replaces the leaking stack — tracking, forms, booking, analytics, and the ad campaigns on top of it — as one done-for-you service, HIPAA-compliant by default. Book a demo and we'll walk your scan results with you.

Part of the HIPAA-Compliant Marketing 2026 Guide. Compliance posture, SOC 2 + HIPAA reports, and subprocessors: trust.pilotpractice.com.