HIPAA Compliance for Telehealth Landing Pages: What's Different

A telehealth landing page isn't a brochure. It's the front door to an actual clinical encounter, and HIPAA treats it that way even if your website builder doesn't.

Most practices apply the same website standards to their telehealth scheduling page that they apply to their "About Us" page. That's the mistake. A page where a patient picks a time, enters symptoms, and gets routed into a live video visit handles protected health information at every step, well before the visit begins.

The Platform Itself Needs a BAA, Not Just a Good Reputation

Not every video conferencing tool is built for healthcare, and a polished interface doesn't mean HIPAA compliance. Before a telehealth vendor touches a single patient, confirm they'll sign a Business Associate Agreement, and confirm the plan you're actually paying for includes it. Several major platforms offer a HIPAA-eligible tier as a paid add-on, not a default, and practices routinely discover this only after the fact.

Session Recording Needs Explicit Consent, Every Time

If a visit is recorded, for training, for documentation, for any reason, that requires clear, affirmative patient consent before recording starts, not a line buried in your intake paperwork from six months ago. Default recording settings are a common and entirely avoidable HIPAA gap.

The Waiting Room Chat Log Nobody Thinks About

Most telehealth platforms include a waiting room or pre-visit chat feature, where a patient might type a quick note while waiting: a symptom update, a medication question. That chat log is PHI, and it needs the same retention and access controls as anything in the patient's chart, not the informal handling a chat window implies.

Tracking Pixels: Legally Unsettled, Not Actually Optional in Practice

This one deserves a direct explanation rather than a simplified rule, because the rule genuinely changed mid-stream.

In December 2022, HHS issued guidance stating that tracking tools, like Meta Pixel and Google Analytics, could constitute an impermissible PHI disclosure if used on healthcare pages, including public, unauthenticated ones like a scheduling or symptom-intake page. In June 2024, a federal court in Texas ruled that HHS had exceeded its authority by applying that guidance to unauthenticated public pages and vacated that portion of it. The part of the guidance covering authenticated pages, like a patient portal, remained in effect.

In plain terms: the legal requirement to avoid pixel tracking on a public telehealth landing page is currently unsettled, not confirmed law. That is not the same as safe.

A telehealth intake page, where a patient may describe symptoms before ever logging into anything authenticated, is precisely the kind of page this dispute is about. Our recommendation, regardless of how the legal question eventually resolves, is to treat it as protected. Don't run standard marketing pixels on any page where a patient could plausibly enter health information, whether or not that page currently sits inside a gray zone. The legal question may still be moving. The patient trust question isn't.

Appointment Reminders Carry More Than a Date and Time

A reminder that says "your telehealth visit for [condition] is confirmed for 2 pm," sent by unencrypted text or email, discloses PHI to whoever else has access to that phone or inbox. Confirm your reminder system supports HIPAA-compliant messaging, and keep the message itself generic if it doesn't.

What to Actually Check This Week

Confirm your telehealth vendor's BAA is signed and covers the specific plan tier you're using, not just the vendor's brand name. Check whether session recording defaults to on or off, and turn it off if it does. Review what happens to waiting room chat messages after a visit ends. Audit your landing and intake pages for tracking pixels, and remove them from anything a patient could reach before authenticating. Check your appointment reminder content for anything more specific than a time and a generic confirmation.

The Bottom Line

A telehealth landing page carries more PHI exposure than practices usually account for, precisely because it doesn't look like a clinical tool. The legal guardrails around parts of it are still being litigated. The patient's expectation of privacy isn't waiting on the outcome.

Have you actually reviewed your telehealth scheduling page for tracking pixels, or has it never come up because it doesn't look like the kind of page that would have them?

Download the HIPAA website checklist