Healthcare organizations are facing lawsuits over tracking pixels that disclosed patient data to Meta and Google without consent. Banner Health agreed to pay up to $3,750,000 in attorneys' fees, while LifeStance Health Group established a settlement fund exceeding $3 million and committed to discontinuing non-HIPAA-compliant tracking tools for five years. Both denied wrongdoing but chose settlement over litigation costs.
These cases highlight a fundamental problem: your consent mechanisms may not address the specific risks of tracking technologies in healthcare. Below is a consent script template you can implement immediately on patient-facing web properties where tracking technologies operate.
Purpose of the Consent Script
This consent script addresses the gap between general cookie notices and healthcare-specific disclosure requirements. It's designed for:
- Patient portals requiring authentication
- Appointment scheduling interfaces
- Telehealth platforms
- Provider search and booking tools
- Any web property that collects protected health information and uses third-party analytics
The script creates a documented consent trail before tracking technologies can access patient session data. It satisfies HIPAA Privacy Rule authorization requirements (45 CFR § 164.508) and addresses Electronic Communications Privacy Act interception claims raised in the Banner Health and LifeStance lawsuits.
Prerequisites
Before implementing this script, ensure the following:
Technical Requirements:
- Tag management system with conditional firing rules (Google Tag Manager, Adobe Launch, or equivalent)
- Session storage capability to persist consent choices
- Ability to block third-party script execution until consent is captured
Legal Requirements:
- Completed Business Associate Agreements with all tracking technology vendors
- Legal review confirming your tracking tools qualify as HIPAA-compliant (most don't)
- Privacy Notice updated to describe tracking technology data flows
Operational Requirements:
- Documented inventory of all pixels, tags, and tracking scripts currently deployed
- Classification of which tools process protected health information
- Alternative analytics approach if patient declines (first-party analytics only)
If you can't confirm HIPAA compliance for your tracking vendors, disable those tools now. The LifeStance settlement required exactly this action.
The Consent Script
Place this modal before any authenticated session begins and before any tracking script loads:
Your Privacy Choices for Website Analytics
We use analytics tools to improve your experience on this portal. Some of these tools are provided by third parties and may collect information about your visit, including:
- Pages you view within your patient account
- Time spent on scheduling or health information pages
- Device and browser information
- General location (city/state level)
What we do NOT share with analytics providers:
- Your name or medical record number
- Specific diagnoses or treatment details
- Test results or clinical notes
- Payment or insurance information
Your choices:
☐ Essential tools only, We'll use only our internal analytics that never leave our systems. Your experience may be less personalized.
☐ Enhanced analytics, You consent to third-party analytics tools that help us improve scheduling, navigation, and content. These tools operate under contracts requiring HIPAA compliance.
You can change this choice anytime in Account Settings > Privacy Preferences.
[Continue with Essential Tools Only] [Enable Enhanced Analytics]
Technical implementation note: Set a session storage variable (tracking_consent: essential or tracking_consent: enhanced) and configure your tag manager to fire third-party scripts only when enhanced is set.
Customizing the Script
For behavioral health providers (like LifeStance), add this paragraph after the "what we do NOT share" section:
"Because you're accessing mental health services, we take extra precautions. Enhanced analytics will NOT track which providers you view, appointment types you select, or any content related to your specific condition or treatment."
For multi-state health systems (like Banner Health), add state-specific language:
"California residents: This choice constitutes your authorization under the California Confidentiality of Medical Information Act. Arizona residents: This satisfies notice requirements under A.R.S. § 44-1373."
For telehealth platforms, add:
"During video visits, no analytics tools operate. This consent applies only to your activity on scheduling, messaging, and health information pages before and after appointments."
Adjust the "what we do NOT share" section based on your actual data flows. If your pixels capture appointment types or provider specialties (many do), you must disclose that. The lawsuits alleged that tracking tools disclosed "information about individuals' physical and mental health." If your configuration does this, either fix it or disclose it clearly.
Validation Steps
1. Consent Capture Testing
- Create a test patient account
- Verify the modal appears before any authenticated page loads
- Confirm no third-party requests fire until you select "Enhanced Analytics"
- Check that session storage correctly records your choice
- Log out and back in, consent should persist for the session but re-prompt on new sessions
2. Legal Review Checkpoints
- Confirm script language matches your actual Business Associate Agreement terms
- Verify you can produce consent records if a patient later claims they didn't authorize disclosure
- Test that declining enhanced analytics doesn't break core portal functionality
3. Compliance Validation
- Run a network trace with browser developer tools
- Document every third-party domain that receives data after "Enhanced" consent
- Confirm each vendor has a signed Business Associate Agreement
- Verify no protected health information appears in URL parameters, page titles, or referrer headers sent to third parties
4. Ongoing Monitoring
- Audit tag deployments monthly, marketing teams often add pixels without privacy review
- Review your Consent Management Platform logs to track acceptance rates
- If fewer than 40% of patients choose enhanced analytics, your essential-only experience needs improvement
The LifeStance settlement required discontinuing non-compliant tracking for five years. Your script should make the compliant path the easy path, but never the only path. Patients who decline must still access all portal features without degradation.
If you can't implement this script because your tracking vendors won't sign Business Associate Agreements or can't demonstrate HIPAA compliance, you've identified the problem these lawsuits were designed to address. Fix your vendor relationships before you face a consolidated class action.
