So let's give TikTok and LinkedIn the same scrutiny Meta gets.

The short answer

No. Neither the TikTok Pixel nor the LinkedIn Insight Tag is HIPAA compliant on a medical practice website. Neither TikTok nor LinkedIn (Microsoft) will sign a Business Associate Agreement covering their ad pixels, and both tags are built to capture exactly the data combination HIPAA cares about: an identifier plus a health context.

That does not mean your practice can't advertise on TikTok or LinkedIn. It means you can't measure those ads with the platforms' own pixels. There's a compliant architecture for that — we'll get to it.

What these tags actually collect

A pixel isn't a passive counter. Both tags execute JavaScript in the visitor's browser and phone data home on every page load.

The TikTok Pixel

The TikTok Pixel collects, at minimum: the full page URL, referrer, IP address, user-agent, and TikTok's own identifiers (ttclid from ad clicks, plus first-party cookies like _ttp). Turn on Advanced Matching — which TikTok pushes hard, because it improves their attribution — and the pixel also hashes and transmits emails and phone numbers typed into your forms.

Hashing is not de-identification under HIPAA. TikTok un-hashes on match — that's the entire point of Advanced Matching. A hashed email that resolves to a real person is still an identifier.

The LinkedIn Insight Tag

The Insight Tag collects the URL, referrer, IP address, device properties, and the LinkedIn member's identity via their logged-in cookie — and nearly every professional who visits your site is logged into LinkedIn. That's what makes the Insight Tag useful for B2B retargeting, and what makes it radioactive on a healthcare site: it ties a named, identified person to the pages they viewed.

LinkedIn's own legal terms prohibit using the Insight Tag to collect sensitive data, including health information. A medical practice website is health information by context. You're not just violating HIPAA; you're violating LinkedIn's platform terms the day you install it.

Why "identifier + health page" is the whole problem

HIPAA's definition of protected health information is broader than people think. An IP address or device ID combined with the fact that this person visited /tms-therapy-for-depression/ or /std-testing/ or booked a consultation is, in OCR's view, individually identifiable health information — because it reveals that an identifiable person sought care for a specific condition from your practice.

Yes, the OCR tracking guidance was partially vacated. In June 2024, a federal court in the Northern District of Texas struck the portion of OCR's guidance that treated a visitor's subjective intent on an unauthenticated page as automatically creating PHI. Some vendors spun that ruling as "pixels are fine now." It isn't that.

What still applies, fully, in 2026:

• HIPAA itself. The vacatur trimmed one agency interpretation; it changed no statute or regulation.
• Booking flows, patient portals, intake forms, and any authenticated page — the vacatur never touched these. A pixel on a booking confirmation page is transmitting PHI, full stop.
• The FTC. Cerebral, GoodRx, and BetterHelp were FTC actions under the FTC Act and the Health Breach Notification Rule — none of them needed the OCR guidance.
• State privacy laws (Washington's My Health My Data, and its growing list of imitators) with private rights of action.
• Class-action plaintiffs, who cite the pixel's network traffic, not OCR memos.

The URMC and Froedtert settlements are the enforcement floor, not the ceiling.

"But we only run TikTok ads for aesthetics" — the med spa trap

Med spas, hair restoration clinics, and aesthetics practices tell us TikTok is their best-performing channel — and they're right, it often is. The mistake is assuming aesthetic services are outside HIPAA. If your practice is a covered entity (and if you bill insurance for anything, or your medical director's entity does, you likely are), the Botox consult request rides under the same rules as the medical visit. And even for a pure cash-pay spa, the FTC and state health-privacy laws don't care about your HIPAA status at all.

LinkedIn has its own trap: practices recruiting physicians or selling to employers install the Insight Tag "just for the careers page," then let their tag manager fire it sitewide — including on every condition and treatment page.

The 10-minute self-check (ungated)

Run this on your own site today:

1. Open your website in Chrome, open DevTools → Network tab.
2. Filter for tiktok — look for requests to analytics.tiktok.com. That's the TikTok Pixel firing.
3. Filter for linkedin or licdn — requests to px.ads.linkedin.com mean the Insight Tag is live.
4. Repeat on a condition or treatment page, not just the homepage.
5. Repeat on your booking or contact confirmation page — this is where the highest-risk fires happen.
6. Check your tag manager for TikTok Events API or LinkedIn CAPI server-side forwarding — server-side sending of raw visitor data is the same violation with better latency.
7. Ask whoever installed the tags for the BAA. There won't be one — neither platform signs them.
8. If you find either tag: remove it, document the removal date, and talk to counsel about whether notification duties were triggered.

Or skip the DevTools session — our free PHI leak scanner checks your site for TikTok, LinkedIn, Meta, Google, and 100+ other trackers in about a minute, no email required.

So how do you actually advertise on TikTok and LinkedIn?

Here's the answer the "just remove the pixel" articles never give you. Removing the pixel without a replacement kills your conversion measurement, your bid optimization degrades, and your cost per booked patient climbs until someone quietly reinstalls the tag. The fix is an architecture where the ad platforms get conversion events, never patient data.

That's how PilotPractice runs it:

• One first-party tracking script — ours, on your domain — replaces the platform pixels entirely. It captures campaign attribution through a strict allowlist of UTM parameters and click IDs (ttclid included), stitched to an anonymous visitor ID. No form contents, no health-page browsing history leaves your site to any ad platform.
• Offline conversion uploads close the loop. When a tracked visitor becomes a booked patient, we send the platform a conversion event tied to its own click ID — "this click converted" — and nothing else. TikTok and LinkedIn get the optimization signal their algorithms need; they never learn who the patient is or what they booked.
• Retraction jobs clean up after edge cases: if a conversion should not have been reported, it's programmatically withdrawn.

The result: full-funnel measurement from TikTok ad → website → booked appointment → showed up, with zero PHI crossing to ByteDance or Microsoft. Your media buyer still gets conversion data to optimize against. Your compliance officer gets an architecture they can actually defend.

This is the same first-party pattern behind our answers on the Meta Pixel and Google Analytics — one tracker, every channel. The full architecture is covered in our HIPAA-compliant marketing guide, and if you retarget, read the healthcare retargeting playbook before you rebuild your audiences.

The verdict, and the do-marketing answer

The TikTok Pixel and LinkedIn Insight Tag are not HIPAA compliant and can't be made compliant — no BAA, no configuration setting, no consent banner changes that. In 2026, with URMC and Froedtert settlements on the books and plaintiffs' firms scanning healthcare sites for exactly these tags, running them is an unforced error.

But abandoning the channels is the wrong lesson. TikTok fills med spa calendars; LinkedIn recruits your providers. Run both — measured through a first-party tracker and click-ID-only conversion uploads, so the platforms optimize on outcomes and never see a patient.

Find out what's on your site right now: run the free PHI scanner — results in a minute, ungated.

Or have us run the whole channel: PilotPractice builds and operates HIPAA-compliant tracking, ads, and EHR-integrated booking for medical practices — compliant by default, not by afterthought. Book a demo.