What does OCR's tracking-technology guidance actually say about insurance agency websites?

OCR's guidance says three things that survived its trip through federal court: tracking-technology vendors that "create, receive, maintain, or transmit PHI on behalf of a regulated entity" are business associates and require a signed Business Associate Agreement; pages where a visitor submits health information — scheduling, symptoms, a quote tied to a health condition — trigger the HIPAA Rules when the site is HIPAA-regulated; and everything behind a login is covered, period. The one rule a federal court vacated on June 20, 2024 — that an IP address plus a visit to a public, unauthenticated health page is automatically PHI — is no longer enforceable as written.

The qualifier: the bulletin binds HIPAA covered entities and business associates, and whether an insurance agency is one is fact-specific — a carrier is; an independent agency usually is only when handling PHI on a carrier's behalf. Read the guidance as the clearest available map of what regulators consider a health-data disclosure via tracking tag, not as a rule that automatically reaches every agency website.

The bulletin's actual timeline

For an insurance agency website, the practical translation is a page-by-page split. A public blog post about Medicare enrollment windows, visited anonymously, is on the vacated side of the line. A quote form that collects health details, a plan-comparison tool a visitor feeds information into, or any client portal is on the enforceable side — and on those pages, a Meta Pixel or GA4 tag is a vendor without a BAA, because Google will not sign one for Analytics and Meta offers none for the Pixel. The FTC and HHS's July 20, 2023 joint letter to about 130 hospital systems and telehealth providers named both products and told recipients to inventory their tags, map where the data goes, and confirm BAAs — advice that reads the same for a two-person agency.

One honest caveat: vendor marketing on this topic swings between "the bulletin was struck down, relax" and "every pixel is a HIPAA breach." Both are wrong. The vacated portion was the broadest, most contested theory; the pieces that drove real enforcement — form data flowing to ad platforms without consent or a BAA — were never based on it.

This page is sourced information, not legal advice. For a compliance decision about your agency, talk to counsel who knows your state and your book of business.