USE CASE · HEALTHCARE

The tracking exposure a consent banner missed.

A top-10 US health system’s patient portals and scheduling tools were leaking data to ad and analytics trackers, creating VPPA, HIPAA, and wiretapping exposure its internal stack couldn’t see.

See Your ExposureAll case studies →
HEALTH SYSTEMpatient-facing web
Web properties✓ 60+ assessed
Trackers found✓ 40+
PHI-adjacent pages✓ Flagged
RemediationDays

The challenge.

A pixel-litigation wave
Plaintiffs’ firms target hospital websites for trackers firing on health-information pages; VPPA and wiretapping claims are climbing.
An inside-out blind spot
Consent tools manage what the organization declares. They can’t see what third-party tags actually transmit from a patient’s browser.
Multi-state exposure
Facilities across many states mean overlapping privacy statutes and different enforcement postures to track at once.

A consent banner was in place, but trackers were firing before consent on pages handling health information.

The solution: an outside-in review of every patient-facing property.

Tracking Technology Review
Audited all patient-facing domains and subdomains; identified trackers firing before or without consent on health-information pages.
Jurisdiction Mapping
Mapped exposure across every state the system operates in: VPPA, HIPAA, CIPA-style wiretapping, and state privacy law.
Policy-Practice Gap Analysis
Compared the published privacy notice to observed data flows and flagged the exact gaps a regulator or litigator would.

Findings delivered with prioritized remediation: no access to internal systems, no cooperation required.

By the numbers.

Representative results from an outside-in assessment of a large, multi-state US health system.

40+
Third-party trackers identified
12
Firing on PHI-adjacent pages
Days
To remediate the highest-risk findings
60+
Web properties monitored continuously
“

We had a consent banner and assumed we were covered. Privaini showed us exactly what was firing, on which pages, and under which statute, before a plaintiff’s firm did.

VP, Privacy & Compliance · Top-10 US Health System (anonymized)

Your exposure is already visible.
See it before they do.

From your domain name to findings in 30 minutes.

See Your ExposureMore case studies

No generic alerts · No installation · Domain name only · Results in 30 min

Opt-Out Signal Honored