Short answer: yes, a medical, dental or wellness practice can still run Facebook, Instagram and Google ads in 2026, but the tracking behind those ads needs to be set up carefully. If you’re a HIPAA covered entity, you can’t let a pixel or tag send protected health information (PHI) to Meta or Google, which in practice means keeping trackers off patient portals, booking forms and intake forms unless a vendor has signed a business associate agreement (BAA). On top of HIPAA, Meta and Google have their own health rules that limit how you track and target, whether or not HIPAA applies to you.

This guide explains, in plain language, what the federal guidance actually says, what changed after the 2024 court ruling, how Meta’s and Google’s health policies affect your ads, and the practical setup we recommend so your marketing can keep bringing in patients without putting the practice at risk.

Important: this is general information for practice owners, not legal advice. HIPAA questions depend on your specific setup, so confirm your situation with a healthcare attorney or compliance professional.

Why this matters for women-led practices right now

If you own a med spa, dental office, functional medicine clinic, therapy practice or wellness studio, you’ve probably heard some version of “you can’t use the Meta Pixel anymore.” That’s not quite right, and the confusion costs practices in two ways. Some keep a pixel firing on every page, including forms where patients type in symptoms or appointment reasons, which is exactly the kind of disclosure regulators care about. Others rip out all tracking in a panic and then can’t tell which ads are bringing in new patients, so they waste budget.

The good news is that there’s a sensible middle path. It starts with understanding the three separate sets of rules that apply.

Rule set 1: HIPAA and online tracking technologies

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights published guidance titled Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. Here’s what it says, in plain terms.

What counts as a tracking technology

HHS defines it broadly: cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts on a website, plus tracking code inside mobile apps. The Meta Pixel, Google tags and similar tools all fall in this bucket.

Logged-in pages (patient portals, telehealth)

According to HHS, trackers on user-authenticated pages “generally have access to PHI.” If a tracking vendor receives PHI on your behalf, it’s a business associate, and you’d need a BAA plus a Privacy Rule permission before that data is shared. The HHS guidance also notes that a privacy policy or a cookie banner alone does not authorize sharing PHI with a tracking vendor.

Booking, intake and symptom forms

This is the part most practices miss. HHS gives the example of a public page (no login needed) where someone books an appointment or enters symptoms. If a tracker collects the person’s email address or the reason they’re seeking care, HHS says the HIPAA Rules apply, because that information is individually identifiable health information. Portal login and registration pages are treated the same way once someone types their details in.

What changed in 2024

On June 20, 2024, a federal court in Texas (American Hospital Association v. Becerra) vacated one specific part of that guidance: the idea that HIPAA is triggered just because a tracker connects someone’s IP address with a visit to a public page about health conditions or providers. HHS now notes this at the top of its guidance page. On August 29, 2024, HHS withdrew its appeal, so that ruling stands.

What the ruling did not change: the rest of the guidance remains on the HHS site, including the sections on logged-in pages, appointment and symptom forms, and BAAs. So a pixel on your blog post about teeth whitening is a very different situation from a pixel on your new-patient intake form.

Rule set 2: Meta’s health and wellness data restrictions

Separately from HIPAA, Meta has its own terms about what data businesses can send it. Meta’s Business Help Center says advertisers must not share information about a person’s physical or mental health, such as medical conditions, with Meta (quoted in this Search Engine Land overview of Meta’s health and wellness restrictions). This applies to med spas and wellness businesses too, even ones that aren’t HIPAA covered entities.

In practice, Meta may classify a health or wellness advertiser’s data source and restrict it. Depending on the level, that can mean:

• URL parameters and custom data aren’t passed to Meta, so some custom audiences shrink or stop working.
• Optimizing for lower-funnel standard events (like a purchase or a completed booking event) is blocked, while upper-funnel events and custom events may still be available.
• In the strictest case, events can be fully restricted, which means Meta’s tools can’t be used for campaign optimization.

Meta also tightened things further. According to a GoHighLevel support article relaying Meta’s notice, starting September 2, 2025, Meta began proactively flagging custom audiences and custom conversions that suggest specific health conditions (Meta’s examples include “arthritis” and “diabetes”). Flagged audiences can’t be used in new campaigns, and flagged custom conversions stop receiving new conversion data.

The takeaway: if you name a custom audience “Botox patients” or a conversion “diabetes consult booked,” you’re inviting a flag. Neutral, coded names matter.

Rule set 3: Google’s health personalized-ads policy

Google treats health as a sensitive interest category. Its Health in personalized advertising policy covers physical and mental health conditions, treatments for chronic conditions, and invasive procedures including cosmetic surgery and injections. When you promote in that category, Google says you can’t use advertiser-curated audiences such as Customer Match, your data segments (remarketing lists) and lookalike segments. You can still use Google’s predefined audiences, like in-market, affinity, life events and location targeting.

For most practices, that’s fine. Google Search ads work by matching people who are already searching for a service, like “dentist near me” or “Invisalign consultation,” and that doesn’t depend on remarketing lists. We cover how Search and Meta work together in our guide to Google Ads vs Meta ads for dental practices.

What practices can still track (and how)

Here’s the setup we recommend talking through with your compliance advisor. It keeps you measuring what matters without sending health details to ad platforms.

1. Map where your pixels and tags fire

List every page with the Meta Pixel, Google tag, TikTok pixel, heatmaps or session recording. Flag anything that’s logged in (portal, telehealth), any booking or intake form, any symptom checker, and any thank-you page whose URL reveals a service or condition (for example, /thank-you-ivf-consult).

2. Keep trackers off sensitive pages

Remove ad pixels and session replay from portals, intake forms and booking flows unless you have a compliant arrangement in place. HHS’s guidance also mentions an option some practices use: a customer data platform vendor that signs a BAA and passes only de-identified data on to ad platforms.

3. Use neutral event and audience names

Name conversions things like “Lead_A” or “Booked_Call” instead of the treatment or condition. Avoid audience names that describe a health condition.

4. Measure bookings in your CRM, not the pixel

Your CRM can tell you which campaign each new patient came from, using source tracking on lead forms and booking links, without the ad platform ever seeing what the appointment was for. This is also where fast follow-up lives, which we break down in Patient Lead Follow-Up for Medical Practices. One caution: if your CRM stores PHI, it needs to be set up for HIPAA. GoHighLevel, for example, says on its HIPAA page that HIPAA compliance requires its HIPAA setup and a signed BAA.

5. Consider Meta instant forms carefully

Lead forms that open inside Facebook or Instagram mean the person never lands on your website, which can simplify tracking. Keep the questions to contact details and a general service interest, and save clinical questions for your secure intake.

6. Write ads that don’t single people out

Ad copy and landing pages that name a condition or assume something about the viewer (“Struggling with anxiety?”) can draw policy trouble. Speak to the outcome and the experience instead (“A calmer, more personal kind of care”).

A quick checklist before your next campaign

• Do you know every page where an ad pixel or tag fires?
• Are pixels and session recorders off your portal, intake and booking forms?
• Do any thank-you page URLs reveal a service or condition?
• Are your Meta custom conversions and audiences named neutrally?
• Are you avoiding remarketing lists and Customer Match for health services on Google?
• Is your CRM set up (and covered by a BAA) if it stores PHI?
• Has your compliance advisor or attorney reviewed the setup?

How She Reigns Creative helps practices advertise with confidence

We build paid media for women-led practices around one goal: booked appointments, measured properly. That means campaigns on Meta and Google, landing pages and lead forms designed with privacy in mind, CRM follow-up that turns inquiries into consults, and reporting tied to real bookings rather than vanity clicks. We’ll work alongside your compliance advisor, not replace them. You can see what’s included in our advertising and paid media services, and if you’re running med spa campaigns, our breakdown of what a booked med spa consultation really costs is a good next read.

Want a second pair of eyes on your ads and tracking? Book a call with our team and we’ll walk through where your pixels fire, how you’re measuring bookings, and what we’d change.

FAQ

Can a medical practice use the Meta Pixel at all?

Often yes, on general public pages, but not in a way that sends PHI to Meta. HHS guidance says trackers on logged-in pages and on booking or symptom forms can disclose PHI, which requires a BAA and a Privacy Rule permission, and Meta does not want health data sent to it in any case. Many practices keep the pixel on general marketing pages only and measure bookings in their CRM. Check your setup with a compliance professional.

Did the 2024 court ruling make pixels HIPAA-safe?

No. The June 2024 AHA v. Becerra ruling vacated only the part of the HHS guidance about an IP address combined with a visit to a public health-information page. The rest of the guidance, including logged-in pages, appointment and symptom forms, and BAAs, is still on the HHS site.

Does HIPAA apply to med spas?

It depends on whether the business is a HIPAA covered entity, which turns on things like whether it provides health care and conducts certain electronic transactions such as insurance billing. Ask your attorney. Either way, Meta’s health and wellness restrictions and Google’s health ad policy can still apply to med spa advertising.

Can I use remarketing for my dental or medical practice on Google?

For health services in Google’s sensitive category, Google’s policy says advertiser-curated audiences, including Customer Match and your data segments, can’t be used. Predefined Google audiences and Search keyword targeting are still available.

Why were my Meta custom audiences flagged?

Since September 2, 2025, Meta has proactively flagged custom audiences and custom conversions that suggest specific health conditions. Review their names and source data, remove anything health-specific, and request a review in Ads Manager if you think the flag is wrong.