Quick answer
Evaluate what each tracking or form service actually receives during a synthetic admissions journey. Identify any PHI, the recipient’s role and the permitted disclosure basis. HHS’s tracking guidance includes a partial court vacatur concerning certain unauthenticated-page visits, so neither a blanket “all visits are PHI” claim nor a blanket public-page exemption is appropriate.
Follow one prospective resident through the form
An admissions site asks for the prospective resident's name, current hospital, diagnosis and anticipated discharge date. A tag manager, form host, error reporter and session-replay service all run on the page. The privacy question is what those services actually receive, not whether the form has a reassuring privacy paragraph.
HHS's online tracking guidance addresses disclosures containing PHI and prominently notes the court's partial vacatur concerning an IP address combined with a visit to certain unauthenticated public pages. Do not repeat the vacated proposition as a universal rule. Conversely, a public page that collects identifiable health information requires analysis of those actual facts.
Build an inventory of page scripts and server-side forwarding services. Include optional plugins and services loaded after submission. Marketing, IT and privacy staff may each know a different part of the path.
Inspect payloads at every stage
Use clearly synthetic values and capture traffic through approved diagnostic tools. This original test matrix can be adapted by the website team.
| Stage | Possible information path | Evidence to inspect |
|---|---|---|
| Form loaded | URL, query string, device identifiers | Requests before any consent choice |
| Fields entered | Keystrokes, selected diagnosis, validation errors | Session replay and error payloads |
| Submit clicked | Form contents and analytics event properties | Browser and server-side recipients |
| Confirmation shown | Names or health context in page title or URL | Subsequent page-view events and referrers |
| Draft abandoned | Autosaved fields or replay buffer | Requests without final submission |
| File uploaded | Referral attachment and metadata | Storage, scanning and processing destinations |
A masking rule configured in a dashboard is an intended control. The network capture shows whether it operated for that test. A form may mask ordinary text fields but reveal a selected option, an error message containing a value or a filename. Inspect both successful and failed submissions.
Make the disclosure decision field by field
For each recipient, record its legal entity, purpose, actual fields, retention, downstream processors and contractual role. Have the qualified privacy reviewer determine whether PHI is involved and whether the use or disclosure is permitted. A business associate agreement is relevant when that role applies; it does not authorize every unrelated use a tracking supplier might want to make.
A fictional finding might be: the admissions form host receives the approved referral fields; an analytics event unnecessarily includes the resident's name and diagnosis; the confirmation URL also repeats the name. The immediate redesign can remove those analytics properties and place a nonidentifying completion token in the URL. Retest the full journey, including error states, to establish what changed. Whether an earlier transmission requires incident review is a separate determination.
Design measurement around the actual business question
Admissions may only need to know how many visitors begin and complete a form and where technical errors occur. That question often does not require forwarding individual referral contents to a measurement service. Define a small approved event schema and prohibit arbitrary form-field copying. Use server-side collection only after reviewing its flows; moving the same PHI to a server-side tag does not make the disclosure disappear.
Avoid treating “anonymous analytics” as a self-proving label. Document identifiers, linkage capability and the recipient's use. Other privacy and consumer-protection requirements may also apply even where a particular transmission is outside HIPAA.
Control later website changes
A new chat widget, scheduling link or marketing campaign can alter the data path without changing the EHR. Keep a release check for new scripts, form fields, upload services and event schemas. The baseline should list approved recipients and approved payloads so an unexpected destination or field is visible.
The buyer's acceptance packet should include the synthetic journey, observed requests, reviewed recipient map, resolved findings and remaining limitations. That makes the privacy decision auditable and repeatable when the site changes, instead of relying on a one-time scan score.
Questions & answers
Does a cookie banner authorize disclosure of PHI?
A general cookie choice does not by itself establish a HIPAA-compliant authorization or another permitted disclosure basis. Review the actual collection and arrangement.
Can we test using a real referral?
Use synthetic information in an approved test environment or controlled test path. The investigation should not create a new disclosure of a real prospective resident’s information.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.