Your Chiropractic Website Is Probably Breaking California Privacy Law (And It’s Not HIPAA’s Fault)

HIPAA’s Blind Spot: The Website You Didn’t Think About

You’ve got HIPAA locked down. Patient files are encrypted, staff sign confidentiality agreements, and you’ve never once emailed a lab result to the wrong person. Good for you. But here’s the kicker: the moment a potential patient lands on your website, HIPAA steps aside and a whole new privacy sheriff rides into town—the California Consumer Privacy Act (CCPA) and its beefed-up sequel, the CPRA.

That contact form? Those Facebook pixels? The analytics cookie that tracks how long someone stared at your “About Us” page? All fair game for CCPA. And if you’re a chiropractor or medical clinic in California, ignoring this is like leaving your front door unlocked in a neighborhood full of privacy lawyers.

What CCPA Actually Covers (Spoiler: It’s Not Your Medical Records)

Under HIPAA, your patients’ Protected Health Information (PHI) is exempt from CCPA. So your EHR system can breathe easy. But CCPA applies to any other personal information you collect—especially through your website. Think names, email addresses, IP addresses, browsing behavior, and even inferences drawn from that data (like “this visitor might need a sports injury specialist”).

And here’s the part that trips up most clinics: employee data. Your staff’s payroll info, performance reviews, and even their work email addresses? Yep, CCPA covers that too. So if you’re collecting employee data for HR purposes, you’ve got obligations under both state and federal law.

The Cookie Conundrum: Tracking Without Consent Is a No-Go

Remember when you installed that Google Analytics code because “everyone does it”? Under CCPA, that’s a potential violation if you haven’t disclosed it and given users the right to opt out. The California Attorney General has made it clear: website tracking cookies that collect personal information (like browsing history) are subject to CCPA, even if the data never touches a medical record.

Think of it this way: HIPAA protects what’s inside the patient file. CCPA protects everything else—including the digital breadcrumbs that lead to your website. It’s like having a security guard for your office safe but leaving the front door wide open.

Employee Data: The Hidden Compliance Trap

Most clinics don’t realize that CCPA applies to employee data. If you have even one employee in California, you’re likely covered. That means you need to provide a privacy notice to your staff, explain what data you collect (payroll, benefits, performance metrics), and honor their rights to access, delete, or opt out of the sale of their data.

And yes, “sale” is defined broadly—it includes sharing data for cross-context behavioral advertising. So if you use a third-party HR platform that monetizes employee data, you could be in hot water.

Practical Steps to Avoid a CCPA Headache

First, audit your website. List every cookie, pixel, and tracking script. Then, update your privacy policy to clearly disclose what you collect and how users can opt out. You’ll need a “Do Not Sell My Personal Information” link (or “Limit the Use of My Sensitive Personal Information” under CPRA).

Second, review your employee data practices. Provide a separate privacy notice for staff and ensure you have processes to handle data access and deletion requests. Finally, train your front desk staff—because the person who accidentally shares a patient’s email with a marketing vendor could trigger a CCPA violation.

For more details, check the California Attorney General’s CCPA guidance and the HHS HIPAA page to understand the overlap.

Don’t Let Compliance Be an Afterthought

HIPAA is the floor, not the ceiling. CCPA adds a whole new layer of obligations that many clinics overlook. The good news? Getting compliant isn’t rocket science—it’s just paperwork and a few website tweaks. The bad news? Ignoring it could cost you thousands in fines and a reputation hit that no adjustment can fix.

So go ahead, check your website analytics. But first, make sure you’re not accidentally selling your patients’ browsing history. Your privacy lawyer will thank you.