- Third-party pixels in patient contexts became an enforcement risk, so compliant brands removed them — and broke their attribution in the process.
- A blended CAC number hides more than it shows once attribution breaks: it blends channels that are working with channels that are not.
- The durable replacement is a first-party stack: consented events you own, server-side conversions, call tracking, and modeled attribution.
- Geo and holdout experiments are the ground truth. When tracking is uncertain, controlled tests tell you what actually moved patients.
For years, the healthcare marketer's dashboard ran on a borrowed engine: a third-party pixel that watched patients move and reported back what worked. Then regulators made clear that letting ad platforms observe patient behavior on a health site was a liability, not a convenience. The FTC fined GoodRx and BetterHelp in 2023 for quietly sharing health data with platforms like Facebook and Google, and HHS regulators warned that ordinary website trackers can expose protected health information. The compliant brands pulled the pixels out. The honest ones admitted what came next: their cost-per-acquisition number still populated, but it had quietly stopped meaning anything.
What actually broke
The pixel did two jobs. It optimized ad delivery, and it told you which dollar produced which patient. When health brands removed it to stay on the right side of privacy enforcement, both jobs disappeared at once. The ad platforms lost the signal they used to find more patients like your best ones, and your analytics lost the thread connecting spend to outcome.
What remained was a CAC number that still calculated — total spend over total new patients — but no longer told you where the patients came from. The dashboard looked intact. The intelligence underneath it was gone.
What a blended number hides
A single blended CAC is an average, and averages conceal. They blend the channel that is quietly carrying your growth with the one that is quietly wasting your budget, and report a tidy figure that recommends no action. They hide lag — the patient who saw an ad in February and booked in April. They hide value — the source that delivers cheaper acquisitions but lower lifetime value, and the one that costs more up front but compounds.
Run a practice on blended CAC alone and you will over-fund what is visible and under-fund what is durable, with full confidence and no idea you are doing it.
The first-party stack
The replacement is not a single tool; it is a system you own. Consented, first-party events captured on infrastructure you control. Server-side conversion APIs that send modeled signals to ad platforms without exposing patient data. Call tracking, because in healthcare the conversion is often a phone call, not a form. And modeled attribution that fills the gaps tracking can no longer see — estimated, labeled as estimated, and trusted accordingly.
It is more work than dropping a pixel, and that is precisely the point. The system is harder to build, which is why a competitor cannot copy it by pasting a snippet into a tag manager.
Measure what you can defend
The discipline that holds the stack together is simple: measure what you can defend, and prove the rest with experiments. When attribution is uncertain, controlled tests become the ground truth. Turn a channel off in three matched markets and watch what happens to new patients. Hold out a region from a campaign and measure the lift against it. Geo and holdout experiments do not care whether a pixel fired; they measure whether patients actually changed their behavior.
That is the standard a regulated business should have wanted all along: not a number that looks precise, but a number you could defend to a skeptic in the room.
The 1ness Take
Losing the pixel felt like losing your sight. For the brands that treated it as a forcing function, it was the opposite — the moment they stopped renting their measurement from an ad platform and started owning it. First-party data, server-side signal, and honest experiments are slower to stand up and impossible for a rival to shortcut.
The pixel was never your asset. The system you build to replace it is.
Sources
- HHS Office for Civil Rights, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates” (Dec 2022; updated 2024).
- American Hospital Association v. Becerra — N.D. Texas vacated the “proscribed combination” portion of the OCR guidance (June 20, 2024).
- FTC, “FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising” (Feb 1, 2023) — first Health Breach Notification Rule action.
- FTC, “FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data” ($7.8M) (July 2023).
