Is Your Practice Website Eavesdropping on Patients? Pixels, Session Recording, and the Wiretapping Problem
Here is something we see more and more when a podiatry practice sends us their website.
Somebody built it. Maybe a web designer, maybe a friend, maybe the practice manager on a weekend. Somewhere along the way, a handful of scripts got added: a heat-mapping tool to see where people click, a Meta pixel from an ad campaign that ended a year ago, a TikTok pixel someone tried once. Nobody removed any of them. Nobody put a consent banner in front of them.
That website is now recording every visitor, and for a medical practice, that is a legal problem, not a technical one.
What is actually happening on the page
Two categories of script cause the trouble.
Session recording and heat mapping. Microsoft Clarity and Hotjar are the popular ones. They record mouse movement, scrolling, clicks, and sometimes the text a visitor types, then play it back for you as a video. Useful for design. But if a visitor never agreed to be recorded, you are capturing their behavior on a page about bunion surgery or diabetic wound care without their knowledge.
Marketing pixels. The Meta pixel, the TikTok pixel, Google Ads tags, and similar scripts send data back to the ad platform about which pages a person viewed and what they clicked. On a retail site that is ordinary. On a podiatry site it means Meta now knows that a specific person spent four minutes on your plantar fasciitis page and then opened the appointment form. That is a reasonable inference about a health condition, sent to a third party, with no consent.
Why this is being called wiretapping
State privacy laws, most visibly California's Invasion of Privacy Act, prohibit intercepting a communication without the consent of everyone involved. Plaintiffs' attorneys have been applying that language to websites: a session-recording tool or a pixel that captures what a visitor does is being framed as a third party listening in on the conversation between the visitor and the site.
Healthcare sites are the most attractive targets because the data is sensitive and the consent is almost never there. A practice does not have to be in California to be sued by a visitor who was. And this is separate from HIPAA. HIPAA governs how you handle protected health information as a covered entity. Wiretapping claims are about recording someone without permission, and they apply even when no patient record was touched.
Federal regulators have also weighed in. HHS has warned that tracking technologies on pages where patients enter or view health information can create HIPAA exposure on top of everything above. Your compliance counsel can tell you exactly where your practice stands, but the direction of travel is not ambiguous.
What to stay away from
Any recording tool running before consent. Clarity and Hotjar should never load on a medical site until a visitor has clicked "accept" on a banner that plainly says their session may be recorded. Most practices are better off removing these tools entirely. The design insight rarely justifies the exposure.
Pixels with no active campaign. If you are not running Meta or TikTok ads today, the pixel should not be on the site. It is collecting data and creating liability for nothing.
Pixels on appointment, contact, and patient-portal pages. Even when you are running ads, the intake pages are where the health inference happens. Keep tracking scripts off them completely. We covered the form side of this in HIPAA-compliant forms for podiatry practices.
"Consent" banners that do not actually block anything. A banner that says "we use cookies" while every script already fired on page load is worse than no banner. It documents that you knew.
Tags nobody can account for. Ask whoever manages your site to list every script in your tag manager and what each one is for. If the answer is "I'm not sure," that is the answer.
What a compliant setup looks like
The practices we work with run a simple posture:
- A consent banner that defaults to declined, with Google Consent Mode v2 so analytics and ad tags stay off until the visitor opts in.
- No session recording at all, or recording gated behind explicit consent with plain language.
- Ad pixels only while a campaign is live, only on marketing pages, never on intake or portal pages.
- A quarterly review of the tag container, removing anything without a current purpose.
- One written page listing every third-party script, what it collects, and whether consent gates it.
This does not cost you your marketing. Our partner practices run Google Ads and Meta ads inside exactly this setup. The calls still get attributed. The ads still optimize. The difference is that nothing fires until the visitor says it can.
Check your site for free
We built a tool that scans a practice website and reports every pixel, tag, and recording script that fires, whether it loads before consent, and which pages it runs on. It takes us about a day, and it is free.
If you run a podiatry practice and you are not certain what your website is doing to visitors right now, that is the first thing to find out. HIPAA-compliant forms come next. The pixels come first.
Podiatry Performance builds marketing systems for podiatry practices, and we check a site's tracking posture before we add a single pixel to it. Want the free audit on yours? Book a call.