Start with the exact page
Write down whether you were browsing a public page, signed in to a portal, completing an appointment form, or using an app. Note the operator and the information you entered. Do not post screenshots with diagnoses, patient identifiers, or account details in a public forum.
HIPAA is not a label for every health related website
HHS explains that HIPAA tracking obligations concern regulated entities and protected health information. Whether a transfer involved protected information depends on the actual facts. An outside tool appearing on a health related page does not settle the legal question.
Read the guidance with its court notice
HHS’s tracking bulletin includes a notice that a court vacated part of the guidance concerning an IP address combined with a visit to an unauthenticated public page about a health condition or provider. It would be misleading to claim that every such visit automatically triggers HIPAA.
Prepare for a confidential follow up
- Keep the original page address and date.
- Note whether you were signed in.
- Preserve the notice or authorization you saw.
- Describe your concern without attaching medical records to an initial inquiry.
- Ask the firm how to share sensitive evidence if it decides to review the matter.
Avoid conclusions before review
An attorney may need to consider the operator, information, permissions, applicable law, and technical evidence. This page identifies useful questions; it does not diagnose a violation or promise that the firm will accept a particular claim.
Go to the source
Official resources for the facts discussed here. Checked October 5, 2026.