Consent and Cookies on Healthcare Sites and Patient Portals
A cookie banner on a healthcare site is not just a privacy formality. The pages a person views, a clinic finder search, a condition guide, an appointment booking, can disclose exactly the kind of health information privacy law protects most strongly. Regulators and plaintiffs have both focused on trackers on hospital and clinic sites in recent years, and the findings were rarely exotic: standard marketing pixels on pages they never should have touched.
This guide covers how to think about consent and tracking across the public site and the patient portal, which are two different risk environments sharing one domain.
Public pages can still reveal health information
The common mistake is treating the marketing site as harmless because no one logs in there. But a page about a specific treatment, viewed from an identifiable connection, is health related data about that visitor, and an advertising pixel on that page reports it to a third party. Audit trackers page type by page type. Service overview and careers pages are low sensitivity. Condition guides, symptom pages, provider search results, and anything in the appointment flow should carry the minimum possible third party code, and none of it before consent.
The portal is a different world
Inside an authenticated patient portal there is no marketing justification for advertising or social trackers at all, and session tools need scrutiny too: replay and analytics products must be configured to exclude form fields, messages, and record content, or removed. Keep the portal on its own subdomain or path rules in your consent and scanning tools so its stricter standard is enforced separately. When a vendor cannot guarantee field level exclusion, that is the answer: the tool does not belong in the portal.
Consent wording patients can actually use
Healthcare visitors skew older and more anxious than average web traffic, and many are booking for someone else. Banner language should be short, concrete, and free of legal vocabulary: what is collected on this site, the choice, and where the full notice lives. Test the flow on a phone with the text size turned up, because that is how a large share of your patients will meet it. A consent interface a worried patient cannot operate does not produce informed choices, whatever it produces legally.
Governance: an inventory with owners
Maintain a tracker inventory for the healthcare properties that names each tool, its pages, its data, its business owner, and its review date, and route every new tag request through it. Most healthcare tracker problems are governance problems: a campaign added a pixel, an agency added a tag, nobody removed either when the campaign ended. A quarterly review that compares the live scan against the inventory and deletes the unexplained is the single highest value habit in this entire area. Keep the review minutes; they demonstrate the diligence regulators ask about.
Related reading
These earlier guides cover connected questions in more depth: Consent and Student Data in Education Apps, Consent by Voice: What Smart Speakers Record and Who Agrees to It, and Consent on the Big Screen: Tracking Choices in Connected TV Apps.
Frequently asked questions
Are analytics allowed on a hospital website?
Analytics with consent, configured to minimize data, and kept off the most sensitive flows can be defensible. Advertising and social pixels on condition and appointment pages are the pattern that has drawn enforcement and lawsuits, and they are hard to justify on a healthcare property.
Does health privacy law replace cookie consent?
No, they stack. Cookie and tracking consent law governs the storing and reading of information on the device, while health privacy law governs the health information itself. A healthcare site has to satisfy both, and the stricter rule wins where they overlap.
Should the portal have a cookie banner?
The portal still uses cookies, mostly essential ones for session and security, which generally need disclosure in a notice rather than an opt in banner. What the portal should not have is optional marketing technology waiting behind that banner. Keep the categories honest and short.
What should we do about trackers added years ago?
Scan, inventory, and remove everything nobody can justify in writing. Legacy pixels with no owner are pure risk: they collect data nobody uses under a notice nobody updated. Deleting them is usually the fastest risk reduction available to a healthcare web team.