Your practice website may already be violating HIPAA.

Almost certainly. In scanning thousands of dental practice websites, we find violations on over 82% of them. The most common are Meta Pixel, Google Analytics without a BAA, and missing Notice of Privacy Practices. These are not edge cases — they are standard tools used by virtually every dental marketing agency, and almost none configure them to be HIPAA-compliant. The first scan is free, so you can find out in minutes.

No. Under HIPAA, the covered entity — your practice — is ultimately responsible for its own compliance. Your marketing agency may have installed the tracking pixels, but you are the one who faces OCR investigation and class action lawsuits. You can and should require your agency to remediate violations, but legal liability rests with you. This is one of the most dangerous misconceptions in dental compliance.

Yes. OCR enforcement does not have a size threshold. Any patient, competitor, or disgruntled employee can file an OCR complaint against any practice at any time — and OCR is legally required to investigate every complaint it receives. Class action plaintiff attorneys have already identified hundreds of individual provider websites and are actively monitoring for violations. Aspen Dental was a large organization, but the legal exposure mechanism is identical for a single-location practice.

A Business Associate Agreement (BAA) is a contract required by HIPAA whenever a covered entity shares protected health information with a third-party vendor. If you use Google Analytics, a booking platform, or a chat widget on your healthcare website, each vendor that could receive patient data must have a signed BAA with your practice. Meta and most advertising platforms explicitly refuse to sign BAAs with healthcare organizations — meaning those tools are non-compliant by design, regardless of configuration.

One-time audits go stale immediately. Your website changes constantly — your marketing agency adds a new tracking pixel, a plugin update introduces a new script, or your booking platform changes its integration. Any of these can introduce new violations the day after your audit. HIPAA compliance on a website is not a one-time checkbox — it requires continuous monitoring. A monthly scan costs far less than discovering a new violation a year after it was introduced.

Under HIPAA's statute of limitations, violations are retroactively litigable for up to 6 years from the date a complainant became aware of the issue. The December 2022 OCR bulletin formally put all healthcare providers on notice about pixel tracking violations — meaning that clock has been running since then. The Internet Archive's Wayback Machine preserves timestamped snapshots of your website, and plaintiffs' attorneys use this tool to prove continuous violation across multi-year periods.

Each report includes: every tracking technology detected and why it violates HIPAA, missing legal documents with legal citation, your financial exposure estimate based on published HIPAA penalty tiers, Wayback Machine documentation of how long violations have been present, real enforcement case references, and step-by-step remediation instructions written for your web developer. Reports are formatted to be forwarded directly to your marketing agency or developer.

Removing Meta Pixel is a critical step, but likely not sufficient on its own. Google Analytics without a signed BAA, Google Tag Manager loading non-compliant scripts, a missing Notice of Privacy Practices, and non-compliant booking forms are each independent HIPAA violations. Most practices that discover and remove one violation find several others they were unaware of. A full scan will tell you exactly where you stand across all violation categories.

A HIPAA compliance consultant typically performs a one-time assessment across your entire practice — policies, staff training, physical security, and more. PracticeScanner focuses specifically on continuous website compliance monitoring, which is the fastest-growing area of HIPAA enforcement and the category most likely to generate class action exposure. We are not a replacement for a consultant covering your internal operations — we are a specialized tool for the specific risk vector that has generated over $100 million in settlements since 2023.

Email us at support@practicescanner.com with your practice website URL. We will run your first scan at no charge and send you a full compliance report within 24 hours. No contract, no credit card required. If you decide to subscribe after reviewing your report, we will set up automated monthly scanning from there.