Loading
HIPAA Compliant Conversion Data for Meta Ads
The Meta (Facebook) Pixel comes off your pages, and Hippo sends your bookings, calls and forms to Meta with names, emails, phone numbers and IP addresses removed. Keep advertising on Meta and see which campaigns bring patients, whatever Meta blocks.
No annual contracts.
Transparent pricing.
We set it up for you.
Meta Ads Are Not HIPAA Compliant by Default
Under HIPAA, sending PHI to a tracking vendor without patients' authorization requires a signed BAA with that vendor. Meta Ads offers none (as of 10/09/26), and Meta's terms bar data that includes or is based on health information, whatever your HIPAA status.
What it sends
The Pixel tells Meta the service
By default each event carries the full page address and any custom parameters, so a booking on /book/anxiety-therapy names the service before anyone types a word. Event names count too(opens in a new tab): "Anxiety intake booked" breaks Meta's rule on its own.
Restriction
Your Lead event can disappear
Meta can put your site in its health and wellness category and restrict specific mid and lower funnel events(opens in a new tab), which is how a health site can lose Lead or Schedule.
Workaround
Server-side follows the same rules
The Conversions API (CAPI) falls under the same terms as the Pixel, and its website events follow the same restrictions(opens in a new tab). Sending events from a server changes the route and leaves what each event carries as it was.
How Hippo sends Meta your conversions
Your website
Book your appointment
Book now
Call us
Booking
Call
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Meta
Booking
Call
The Pixel comes off.
We take the Meta Pixel and its event code off your pages and install Hippo on a subdomain of your domain. Tools you keep, like a call tracker or a scheduler, keep their own code.
Hippo cleans the event.
When someone books, sends a form or calls, Hippo removes names, emails, phone numbers, dates of birth and IP addresses, and gives the event a name that implies no condition, treatment or service.
Meta gets the conversion.
Hippo sends it through the Conversions API and keeps its own record of it by the campaign that produced it. Whoever runs your ads sees it arrive in Events Manager.
What Meta receives
Sent
Sent: the events you choose
Meta receives only the events you allow, under their neutral names. Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses, plus URL paths and anything typed into a form.
Held
Held until you allow it
An event Hippo doesn't recognize stays in Hippo, so a new form can't start sending to Meta on its own.
Kept
Kept in Hippo, under your BAA
Everything Hippo records stays in its own storage under the BAA Hippo signs with every customer, with a log of what went to Meta and what was removed first.
What health advertisers on Meta say
They can't tell what's working
A restricted Lead event, and results that stop reaching Ads Manager.
Our Lead event is fully restricted and cannot be used and of course because of that results are not flowing in in Ads manager.
Agency marketer I have noticed that after January, our bookings from a daily of 10-15 have gone down to just 1-2 per day.
Dental PPC agency The workarounds get flagged
Custom events that get flagged a few weeks later.
tried custom events for a bit and they just get flagged after couple weeks anyway
Media buyer
Meta Pixel lawsuits and settlements on health sites
Advocate Aurora Health(opens in a new tab)
$12.225 million
Patients alleged the Meta Pixel on the health system's website, patient portal and scheduling app sent their information to Meta. The court granted final approval(opens in a new tab) in July 2024.
GoodRx(opens in a new tab)
$1.5 million
The FTC's complaint(opens in a new tab) says GoodRx's Facebook pixel sent events naming users' medications and health conditions. It was the FTC's first enforcement action under the Health Breach Notification Rule.
Duly Health and Care(opens in a new tab)
$1.88 million
Patients sued over a Meta pixel on the part of Duly's website they logged into. Settled, with payments issued.
Ideal Image(opens in a new tab)
Up to $3.5 million
Settled claims that the Meta Pixel and other trackers on its consultation-scheduling pages shared visitors' information.
Workit Health(opens in a new tab)
$578,680
The virtual addiction treatment provider settled claims over the Meta Pixel on its website and web app.
Hims & Hers(opens in a new tab)
Pending
The FTC, California and Utah allege the company shared customers' health information with Meta, and the complaint(opens in a new tab) names the Meta Pixel and the Conversions API.
All six involve a Meta pixel on the organization's own website or app.
See what your site sends to Meta(opens in a new tab)What you get
Meta conversions, by campaign
Bookings, calls and forms from your Meta campaigns, recorded in your account by the campaign that produced them, whatever Meta does with the event.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of every event that went to Meta and what was removed from it first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is the Meta Pixel HIPAA compliant?
Not by default. Meta Ads offers no BAA, and its Business Tools Terms(opens in a new tab) bar health information from what you send through the Pixel or the Conversions API, event names included. Meta's systems try to remove prohibited data after it arrives, and that filtering is no substitute for your own compliance(opens in a new tab). HIPAA works the same way: a tracking vendor's promise to remove PHI after receiving it(opens in a new tab) is not enough. What the Pixel sends from your pages is your responsibility.
Will Meta sign a BAA for our ads?
No. Under HIPAA, sending PHI to a tracking vendor without patients' authorization requires a signed BAA(opens in a new tab) with that vendor. The BAA you sign is with Hippo, and it covers Hippo. Meta is outside it, and Hippo controls only what it sends Meta: the events you allow, under neutral names, with names, emails, phone numbers, dates of birth and IP addresses removed.
We already use the Conversions API. Isn't server-side the compliant version?
Not by itself. The Conversions API falls under the same terms(opens in a new tab) as the Pixel, and its website events follow the same restrictions(opens in a new tab). The FTC's complaint against Hims & Hers(opens in a new tab) names the Pixel and the Conversions API together. Hippo uses the Conversions API too, and prevents PHI from being sent to Meta: names, emails, phone numbers, dates of birth and IP addresses come off first, and each event carries a name that implies no condition, treatment or service.
Do we keep the Meta Pixel?
No. Conversions reach Meta from Hippo's server through the Conversions API, which connects a server directly to Meta(opens in a new tab), so no Pixel code runs on your pages, and events sent only that way need no deduplication(opens in a new tab). Tools you keep, such as a call tracker or a scheduler, keep their own code.
Meta restricted our events. Can Hippo get our Lead event back?
No. Hippo cannot lift a category Meta has assigned or restore an event Meta blocks, and it never renames an event to get past a restriction. Data Meta has removed must not be sent again(opens in a new tab). You can ask Meta to review(opens in a new tab) a category it assigned. Hippo still records your bookings, calls and forms by campaign, whatever Meta blocks, and on a walkthrough we look at what your account can still send, such as upper-funnel events(opens in a new tab).
Our agency runs our Meta ads and has no access to our DNS. Who sets this up?
We do. Whoever controls your domain adds a DNS record for your Hippo subdomain. We install Hippo, take the Pixel off and connect Hippo to your Meta account. Your agency keeps running the campaigns and sees conversions arrive in Events Manager.
Can Hippo count conversions that happen after patients log in?
Yes. Hippo runs under your BAA, so it can record a booking or purchase completed in a logged-in area. Meta receives only the neutral conversion, with names, emails, phone numbers, dates of birth and IP addresses removed, and no Meta Pixel runs on those pages.
Should we talk to a lawyer about our Meta tracking?
Yes, if you want to know how these laws apply to your business. This page describes Meta's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by Meta.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.