Know which ads fill your consult calendar, without telling Google or Meta who is on it.

Frequently asked questions

• LASIK is cash-pay. Does HIPAA apply to us?

  If your practice bills Medicare, a medical plan or a vision plan electronically for anything, it is a covered entity(opens in a new tab) for all its patients, including the ones paying cash for LASIK. A refractive center that bills no plan at all may sit outside HIPAA, but the claims that moved in this industry did not need it: a LASIK provider's federal and California wiretap claims survived a motion to dismiss(opens in a new tab) in January 2026, and those laws reach any website.

• Our candidacy self-test asks medical questions. Can we keep it?

  Yes. A typical self-test asks age, eyewear, the kind of vision problem and any cataract diagnosis, then a name and a phone number, and the ad tags usually sit on the same page. Hippo counts a completed test as a plain event with no answers, no condition in its name and no URL path, and removes names, emails, phone numbers and IP addresses before anything reaches Google or Meta. The answers stay with your team.

• Our consults are booked by phone or on our EHR's scheduler. Can you count them?

  That is the usual case in eye care, and your own tags never see it. Hippo counts the booked consult through a connector to your scheduling tool, ties calls to the campaign that produced them, and records both in an account you own. The surgery scheduled weeks later is counted back the same way, so Google and Meta learn which clicks became surgeries without learning which procedure.

• We already track conversions in our EHR's CRM. Why add this?

  Your coordinator's list tells you which consults became surgeries. It does not tell Google Ads or Meta, and their bidding only learns from what they are sent. Google does not allow health conversions(opens in a new tab) to be uploaded with customer data through enhanced conversions or offline uploads, so the feed has to arrive de-identified. Hippo sends it server-side, with no procedure, name or IP address in it.

• Meta cut our Lead and Schedule events. Can Hippo get them back?

  Not by itself. Meta restricts specific mid- and lower-funnel events(opens in a new tab) for health sites, and you cannot change the category it assigns(opens in a new tab). A compliant feed changes what Meta receives: a booking with no URL path, no procedure in the event name and nothing that identifies the patient. A custom conversion named "LASIK consult" names a medical procedure, which Meta's rules prohibit(opens in a new tab); a plain consult event does not. Which events Meta allows is Meta's decision.

• Google won't let us remarket for LASIK. Does tracking still matter?

  More than before. Surgical procedures are in Google's health category(opens in a new tab), so a LASIK, lens implant or cataract campaign cannot use your own audience lists(opens in a new tab) or lookalikes. That leaves the conversion signal as the main thing steering your bids, and it only helps if it says which clicks became consults and surgeries. Hippo sends that signal without the procedure or the patient attached.

• Our agency set up our tracking. Why would we change it?

  Eye care agencies build the self-test, the landing pages and the call tracking, and few say what the tags on those pages send. Hippo sets up the tracking under the agency you already have. They keep running the campaigns, and the consult and surgery numbers sit in an account you own, so they stay with you if you change agencies.

• The lawsuits are against chains. Why would anyone sue a single practice?

  The rulings so far involve a LASIK provider, an eye care chain and an optical retailer, but the pages at issue are the ones a small practice runs: a consultation scheduler, an eye-exam booking form, a doctor search. In 2025 an independent family optometry practice in Illinois faced a proposed class action over pixel tracking, and its insurer went to court(opens in a new tab) arguing the policy did not cover it. The statutes carry damages per violation and do not ask how many locations you have.

• We have a cookie banner on the self-test. Isn't that consent?

  Not on its own. A banner records consent to cookies; HHS says a cookie banner is not a HIPAA authorization(opens in a new tab), and in the LASIK provider's case the court treated consent as a disputed fact at the pleading stage. Hippo waits for consent where it is required and removes identifiers and the procedure before anything reaches Google or Meta, which a banner cannot do.

• What about our patient portal?

  It stays out. HHS says tracking on logged-in portal pages(opens in a new tab) generally has access to PHI, and Google tells customers not to put Analytics tags on authenticated pages. Hippo keeps ad tags off logged-in pages and sends nothing from them. Your marketing pages, self-test and booking flow are where the campaign data comes from, and that is where Hippo works.

• What about financing applications?

  The application happens on the lender's page, so neither your tags nor Hippo's script runs there, and the lender's credit data never passes through Hippo. What matters for your campaigns is the step before it, the consult, and the step after it, the surgery, and both are counted from your own records with no financial or medical detail attached.

• Should we talk to a lawyer about the tracking on our website?

  Yes, if you want to know how these laws apply to your practice. This page describes laws, policies and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations.