PeptideDoc will maintain additional safeguards for portions of the website or platform that may process Protected Health Information.
Advertising pixels, retargeting scripts, session-replay technologies, and other unnecessary third-party tracking technologies should not operate on authenticated patient pages, health intake forms, patient portals, telehealth interfaces, appointment-management areas, or other pages where PHI may be transmitted, unless the specific implementation has been reviewed for HIPAA compliance.
Where a tracking vendor receives PHI on behalf of a HIPAA-regulated entity, appropriate legal permissions and, where applicable, a Business Associate Agreement must be in place.
HHS cautions that a general cookie consent banner is not equivalent to a HIPAA-compliant authorization for disclosure of PHI.