When someone opens a page on your website, a lot happens in the background. One of those things is that small pieces of code, called tags or pixels, wake up and send a message to companies like Google or Meta. This article explains what is in that message.
What the message usually contains
At a minimum, a pixel sends the address of the page the visitor is on, the time, and an ID that helps the tool recognize the same browser later. It often also sends the address of the page they came from, the size of their screen, and the type of device. If the pixel is set up to track events, it can also send what the person clicked or typed.
Why this matters for healthcare sites
Look closely at that list. The page address alone can give a lot away. A page called “/schedule/oncology” tells anyone reading the data that this person was looking into cancer care. Add a form field, like a name or an email, and you have tied a health detail to a real person. That is what the law calls protected health information, or PHI.
What you can do about it
You do not have to stop measuring. You have to control the message. That means knowing every tag on your site, removing the ones you do not need, and sending the rest through a server you own so you can strip out anything sensitive before it leaves. We walk through this on our HIPAA-compliant tracking page.