HIPAA and your clinic website: forms, tracking and what to avoid
What a clinic form can ask, who needs a BAA, and where tracking pixels must stay off.
Clinics that advertise on Facebook and Instagram run into two sets of limits: what the ads may say, and what your website may send back to Meta. This guide covers both for dental clinics, physios, aesthetic clinics and med spas, and how to tell which ads bring patients when Meta sees less.
Updated 29 October 2026, about 8 minutes to read
The short answer
Meta can place a clinic's website in its health and wellness category. Your pixel may then stop sending page addresses and custom details, some events further down the funnel can be blocked, and campaigns can lose conversion goals. Separately, ads must not imply the reader has a condition, and cosmetic procedures need an audience aged 18 or over. Measure with utm tags saved with each enquiry and the outcome of every first visit.
If your ads stopped counting enquiries, or Ads Manager stopped offering the goal you used to choose, check the category Meta gave your website before you change anything else:
The data limits and the ad rules are separate. A clinic can be fully within the ad rules and still have its pixel restricted, and the other way round.
Meta assigns data sources, such as your website or app, to categories based on their topics and the products or services they offer. Its health and wellness category covers anything associated with medical conditions or health statuses, relationships between providers and patients, access to personal health information, or health-related products and services. Meta's examples include patient portals, telemedicine, pharmacies and condition support groups. A dental practice, a physio clinic or a medical aesthetics clinic fits that description.
You can also put your own datasets in a category, and Meta suggests reviewing what has been assigned. Two rules apply:
Restrictions can apply in some countries or regions only, or everywhere. A clinic in Europe and one in the US may see different limits, so read the notice for your own dataset.
Meta describes three kinds of restriction for categories like this one:
Core setup has knock-on effects. Custom audiences built from page addresses or custom details may shrink or stop updating, automatic advanced matching may be unavailable, and custom events have to be reviewed and confirmed before they can be used. For a full restriction, Meta's own suggestion is to use objectives that do not rely on your website's data, such as awareness, engagement or traffic.
If your clinic's events are restricted, a campaign set to Maximize number of conversions on your website's enquiry event has nothing to learn from. Look at what still works:
Instant forms bring their own problem: easy forms bring casual taps. Use the higher intent form type and one or two questions about the service and the time that suits, never about symptoms. Fake and junk leads from lead ads covers the settings.
Meta's ad rules on personal attributes ban ads that assert or imply someone's physical or mental health, including medical conditions. Meta's own examples allow "New diabetes treatment available" and reject "Do you have diabetes?". The ad should talk about your service, not about the reader.
Meta's health and wellness policy adds more:
Some health-related businesses are outside the age rules: general fitness services and gyms, and dental products such as teeth whitening kits.
Meta's Business Tools Terms do not allow advertisers to send it health information, and Meta lists examples: conditions, injuries, procedures, treatments and testing, medications, and places that identify a health condition or a place of treatment. The rule covers more than the pixel:
Meta's systems try to detect and block this, and its help pages are clear that you stay responsible for what you send. Health information also has legal rules of its own: HIPAA in the US for covered clinics, and the GDPR in Europe. Your adviser should look at your own setup, and HIPAA and your clinic website covers forms and tracking pages in detail.
Core setup limits what Meta receives. It does not stop your own website from reading the address a visitor arrives on. So the measuring moves to your side:
Sending outcomes back to Meta, through the Conversions API for CRM or a connected spreadsheet, may be restricted for a health dataset as well, and any outcome you send must not reveal a treatment or condition. Check the restriction notice before you set it up. The general setup is in how to track leads from Meta ads, and for a clinic it needs checking against both Meta's limits and your own legal rules.
A two-room physiotherapy clinic runs Meta ads for new patients, optimised for enquiries on its website. One month, Events Manager shows its dataset in the health and wellness category with core setup applied, and Ads Manager stops reporting enquiries. The owner:
Ads Manager now shows less. The clinic's own records show more than they did before, because every enquiry carries its campaign.
Aesthetic clinics meet more of these rules than most trades. Set every campaign for cosmetic treatments to people 18 or over. Show real before and after results of your own patients, with their consent, and never words that tell the viewer what is wrong with their face or body.
Watch the treatments that involve a prescription medicine. An ad that promotes the medicine itself falls under Meta's prescription drugs policy, which needs certification and Meta's authorisation and runs in only three countries. Keep the ad about the consultation and the practitioner, and check that policy before naming any medicine.
If your clinic takes bookings through a deposit and a consultation, a page that explains who treats, what happens at the consultation and what decides the price does more for a nervous first-timer than any discount: see aesthetic and medical clinics for what a chatbot answers there, and where it hands over to your team.
If most of your new patients arrive in pain and search for help, such as an emergency dentist or a physio after an injury, a search ad answers them at the moment they look: compare the two in Google Ads or Facebook ads. Meta works better for things people choose rather than need: a whitening offer, a new class, a new clinic opening nearby.
Wherever the ad runs, the page it opens has to follow the same platform rules as the ad. GGSites builds landing pages for ads with forms that ask only what a first contact needs, and a booking chatbot for dental clinics takes appointment requests and asks only for what a request needs. We do not run the ads themselves.
Meta lists a few reasons: your website was assigned to a data source category with restrictions, such as health and wellness, Meta detected information its terms do not allow, or someone on your account turned the restrictions on. Open Datasets in Events Manager, then Settings, and look at Manage data source categories and any notices. They say which restriction applies and how to request a review.
Yes. Clinics can advertise, within Meta's ad rules on health and personal attributes. What changes is the data: if Meta restricts your website's events, campaigns may lose conversion goals. Instant forms, message and call ads, and landing page view goals still let you reach patients, and your own records show which ads bring them.
Meta's health and wellness policy allows before and after pictures for cosmetic procedures when the ad targets people 18 or over. The ad must not attack anyone's appearance or promise a result within a set time without qualifiers. Use your own patients' results, with their written consent, and check your local advertising rules for clinics too.
In Events Manager, open Datasets, select the dataset, open Settings and go to Manage data source categories. Click Manage, then View details on the data source, then Request review. You need full control of the business portfolio or an admin role on the ad account that owns the dataset. Meta replies by email.
They can. Meta says the data sharing restrictions attached to a category can be specific to certain countries or regions, or applied everywhere. The ad rules on personal attributes and on cosmetic procedures apply to all ads. Check the notice for your own dataset rather than relying on what another clinic was told.
Only what the first call needs: name, phone number, the service they are interested in and a good time to call. Leave out symptoms, conditions and medical history, which you can discuss once you have spoken to them. A form that asks less also keeps health details away from every system the lead passes through.