Pixel ruling leaves AI chat widgets open

You are the clinician, the receptionist and the web administrator, and a vendor's chat widget promises to answer new-patient questions at 9pm while you sleep. On 8 October 2026 the Washington Supreme Court upheld the dismissal of a privacy class action over a hospital's Meta Pixel (Baker v. Seattle Children's Hospital, Recording Law, October 2026), and the headlines read like a green light for website tracking. They are not one. The court ruled only on one person's exchange with a fully automated system, left open anything involving staff or a system that does more than return stored content, and did not touch the HIPAA duty that attaches once a visitor types a symptom into a booking form. Here are six questions solo clinicians ask about AI chat widgets and tracking tags, answered with sources.

1. Does a chat widget on my site need a business associate agreement?

If visitors can type health details or contact details into it, assume yes. HHS's online tracking bulletin gives the example of an appointment booked through a clinic website: the tracking vendor "is a business associate, and a BAA is required," and a vendor that only promises to remove protected health information after receiving it is "insufficient" (HHS Office for Civil Rights bulletin, as quoted by Curve Compliance, September 2026). The same analysis says pages that let people book appointments or use a symptom checker without logging in "may have access to PHI in certain circumstances," such as an email address or the reason for care the visitor typed or selected. A chat widget with AI-generated replies is a more open version of that same text box. We could not load HHS's own page in this session, so check the wording at hhs.gov before you rely on it.

So what for you: if the widget vendor will not sign a BAA for your plan, keep the widget off any page where a visitor can describe a symptom or leave contact details.

2. Did the 2024 court ruling make tracking tags and chat widgets safe?

No. On 20 June 2024 a federal court in the Northern District of Texas vacated one part of the bulletin: the "proscribed combination," meaning an IP address linked to a visit to an unauthenticated public page about a specific condition or provider (American Hospital Association v. Becerra, Holland & Knight, June 2024). The rest of the bulletin stands, including the position that tracking on user-authenticated pages generally has access to protected health information (Curve Compliance, September 2026). HHS did not pursue the appeal. That leaves the case you actually face: a visitor who types a reason for care into a booking or chat box is not an anonymous IP address visiting an information page.

So what for you: read the 2024 ruling as removing one narrow theory, not as permission to keep an ad pixel on your booking page.

3. What exactly did the Washington Supreme Court decide on 8 October?

It decided a narrow point of state wiretap law. Washington's Privacy Act covers communications "between two or more individuals," and the court held that a visitor's searches and clicks on a hospital website, answered by an automated system the hospital owns and operates, were not that (Recording Law, October 2026). The pleaded facts were a search for "depression" allegedly relayed to Meta and linked to the visitor's Facebook or Instagram account, with a cookie banner that did not mention the pixel (Miller Nash, October 2026). The court expressly did not decide whether the communications were "private," and a footnote leaves open cases where an organization communicates through individuals, so a live-chat agent or a message routed to staff sits outside the holding (Recording Law, October 2026). A concurring justice noted the case did not involve "a system that does more than return stored content," which describes a chatbot that generates its own replies (Miller Nash, October 2026). The decision was not final at the time of the sources cited: the 20-day reconsideration window had not closed as of 11 October 2026 (Recording Law).

So what for you: a chat widget that writes new answers, or hands a conversation to you or your staff, is the unresolved zone, so do not borrow comfort from a case about static page tracking.

4. Is there a Washington law that does not depend on the wiretap statute?

Yes. The My Health My Data Act took effect in 2024, regulates consumer health data, is not limited to healthcare providers and does not depend on a two-party communication. Private plaintiffs can enforce it through the state Consumer Protection Act, which allows treble damages up to a limit plus attorneys' fees (Miller Nash, October 2026). The first class action under it, Maxwell v. Amazon, was filed in February 2025 over an advertising software kit in third-party apps and is ongoing (Miller Nash, October 2026). The Act has exemptions for some HIPAA-regulated data, and whether a chat transcript falls inside them is a question for counsel, not something we can settle here.

So what for you: if you see patients in Washington, whether by video or in person, treat the wiretap ruling and this Act as two separate questions and ask your lawyer about both.

5. What about California, where the lawsuits actually cluster?

California is where plaintiffs' firms have filed thousands of class actions and mass-arbitration demands targeting pixels, session replay software and chat widgets under the California Invasion of Privacy Act, which allows the greater of $5,000 per violation or three times actual damages without proof of harm (Miller Nash, October 2026). On 30 September 2026 the governor signed SB 690. From 1 January 2027 it removes the private right of action for one type of claim, under Penal Code section 638.51, arising from conduct on a website or app, leaving enforcement of that provision to the Attorney General. It does not repeal the section, does not declare any tracking tool lawful, and does not touch the Act's wiretapping provisions or federal claims. The retroactivity clause is likely to be challenged (Miller Nash, October 2026).

So what for you: a telehealth patient in California can still bring a wiretap claim over a chat transcript, so a solo clinic with out-of-state patients should not assume SB 690 closes the door.

6. What should a solo clinic do before switching on a chat widget?

Work through five checks, in this order. First, list every script on your site: ad pixels, analytics tags, booking plug-ins and chat widgets. Your web designer or hosting dashboard can export this in an afternoon. Second, remove advertising pixels from booking, contact and intake pages, because those pages are where HHS's analysis says protected health information is most likely to appear. Third, ask each remaining vendor in writing whether it will sign a BAA for your plan, and decline any that will not. Fourth, decide what the widget may do: answering opening hours, parking and insurance accepted is a very different job from taking a described injury. Fifth, put a plain line above the chat box such as "Do not enter health details here. To book, call or use our secure form," and make sure the cookie banner names the tools actually running. We covered the contract side of this in our guide to solo clinician patient data privacy, and the free-tier trap in the free AI scribe BAA check applies equally to chat tools.

So what for you: this takes about an hour per vendor and costs nothing, and it is the only step that holds up under every theory above.

The call we would make

Frankly, for a one-person clinic with no admin staff, the evidence points toward a static FAQ page, a clear phone number and a booking form hosted by your BAA-covered practice-management system, rather than an AI chat widget on the public site. The widget's upside is a few answered questions after hours. The downside runs from a HIPAA finding to a state wiretap or consumer health data claim, in a legal area where this month's rulings left the AI-specific questions open. If you still want one, start with a widget limited to opening hours and insurance questions, with no free-text field for symptoms, a signed BAA and a named person who reviews the transcripts weekly. If a vendor will not meet those terms, you have your answer.

This is general information, not legal advice. Decisions in the sources above were reported within days of this article, and several points (the Baker reconsideration window, SB 690 retroactivity, the HHS bulletin wording) may change, so confirm with counsel licensed in your state before acting.

Related: AI phone answering and the $500 rule  ·  Solo clinician patient data privacy  ·  Free AI scribe BAA check