Healthcare marketing spent four years settling on one answer to the tracking problem. Get consent, log it and honor it. It rests on an assumption nobody checked, which is that a person is on the other side of the banner reading the question.
Software answers that question now. AI browsers do the browsing for people, and when one meets a consent modal it clears the modal as an obstacle. The decision gets logged. Nobody made it. The record a health system would produce to show it honored patient choice is turning into a record of machine behavior. But patients were not reading the banner either. They clicked to make it go away. What changed is who is clicking, which raises a real question about what the consent ever documented.
It gets worse at the portal. A patient can hand their own record to an AI tool, and the moment they do, the law protecting it stops applying. HIPAA gives them that right and does not let a provider refuse because the destination is unwise. A health system must complete a handoff it would be sued for making on its own. Marketing owns the door the agent arrives at, and inherits a problem it did not create and cannot fix with a banner.
Underneath both sits a question about authority. No regulator drew this line. The federal guidance that set off the panic was vacated in court and never replaced, and the rule meant to succeed it keeps moving further out. The working standards came from settlements instead, which produce a price rather than a principle, and the patient whose information was disclosed collects about twenty dollars. Chris Boyer and Reed Smith work through whether calibrating to litigation risk is honest risk management or an industry declining to decide what right looks like.
Jessica Holton, co-founder of Ours Privacy, brings the view from inside that constraint. She was buying media for a telehealth platform when the pixel guidance landed, pulled her tracking, and watched acquisition costs climb. Her argument is that privacy becomes an asset once the whole organization owns it. Her survey names the blind spot. Nearly everyone believes their stack is compliant, and a majority describe that same stack as pieced together.
If software declined tracking on a patient’s behalf this morning, your consent log recorded a decision nobody made.
MENTIONS FROM THE SHOW
- Healthcare’s Long Walk Toward the Patient, the free eBook marking 500 episodes: https://www.touchpointpodcastbook.com
- Ours Privacy, the HIPAA-compliant customer data platform Jessica Holton co-founded, including the free web scanner she describes in the interview: https://oursprivacy.com/
- Ours Privacy, $15M Series A announcement, August 2026. Founders Jessica Holton, Adam Putterman and Tyler Zey launched the platform in 2024 after running the telehealth company Ours: https://oursprivacy.com/blog/oursprivacy-series-a-announcement-growth-marketing-data-infrastructure-healthcare
- HHS Office for Civil Rights, guidance on the individual right of access, health apps and APIs. The source for the point that information sent to a third-party app at the patient’s direction falls outside HIPAA: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access-right-health-apps-apis/index.html
- HIPAA Security Rule Notice of Proposed Rulemaking, published in the Federal Register January 6 2025 at 90 FR 898. Final action now listed in the OMB Unified Agenda under RIN 0945-AA22
- HIPAA Journal on the delay of the Security Rule final rule, now pencilled for 2027, and the Privacy Rule final rule status: https://www.hipaajournal.com/final-rule-implementing-hipaa-security-rule-updates-edges-closer/
- New York Attorney General settlement with NewYork-Presbyterian, December 2024, $300,000 plus corrective actions covering third-party online tools, pre-deployment testing and deletion of collected patient information: https://www.healthcareitnews.com/news/newyork-presbyterian-pays-300k-settle-ny-pixel-tracking-case
- Banner Health and LifeStance Health Group tracking technology settlements, including the Banner class of roughly 1,028,000 MyBanner portal users: https://www.hipaajournal.com/banner-health-lifestance-health-group-pixel-settlements/
- Five healthcare providers settle pixel class actions, including Bayhealth Medical Center with a class period running through December 31 2025: https://www.hipaajournal.com/five-healthcare-providers-pixel-class-action-settlements/
- Atrium Health $1.8 million pixel settlement, preliminary approval May 2026, covering MyAtriumHealth and MyCarolinas portal accounts: https://www.classaction.org/news/1.8m-atrium-health-pixel-settlement-ends-class-action-lawsuit-over-alleged-patient-data-tracking
- The effect of AI browsers on tracking and attribution, including Atlas auto-rejecting consent banners and stripping referrers: https://taggrs.io/ai-browsers-tracking-attribution/
- Prompt injection in AI browsers, and the position from OpenAI and the UK National Cyber Security Centre that it likely cannot be fully solved: https://techjournal.org/are-ai-browsers-safe
- The GA4 consent change of June 15 2026, retiring Google Signals as a control and leaving ad_storage as the single gate to Google Ads: https://www.digitalapplied.com/blog/ga4-consent-split-june-15-2026-ad-storage-tracking-audit
- Jessica Holton on LinkedIn: https://www.linkedin.com/in/jessicalynneholton/
- OursPrivacy: https://oursprivacy.com/
- Reed Smith on LinkedIn: https://www.linkedin.com/in/reedtsmith/
- Chris Boyer on LinkedIn: https://www.linkedin.com/in/chrisboyer/
- Chris Boyer website: http://www.christopherboyer.com/
- Chris Boyer on BlueSky: https://bsky.app/profile/chrisboyer.bsky.social
- Reed Smith on BlueSky: https://bsky.app/profile/reedsmith.bsky.social
From the cold open:
- “Paraborgs,” cyborg cockroaches fitted with cameras and remote-triggered drug injectors for search and rescue. University of Queensland and University of New South Wales, published in Advanced Science, August 2026. Giant burrowing cockroaches were chosen for their carrying capacity. Navigation succeeded in all 25 trials, the full navigate-position-inject sequence in 72 percent, and injection within 15 centimetres of a target in about 95 percent. Researchers estimate rescue swarms are five to ten years out: https://interestingengineering.com/ai-robotics/cyborg-cockroaches-rescue-robots-dangerous-spaces
- The Register’s coverage of the same study, for the version Reed would enjoy: https://www.theregister.com/offbeat/2026/08/27/cyborg-cockroaches-may-soon-deliver-life-saving-drugs-to-disaster-victims/5293081
Recommendations from this episode:
- Chris: The Charismatic Voice, the YouTube channel run by Elizabeth Zharoff, an opera singer, vocal coach and voice researcher with degrees from the Curtis Institute of Music, Oberlin Conservatory and Berklee College of Music. She listens to modern rock and pop and breaks down the vocal technique song by song. Chris mentions her analysis of Prince’s “Purple Rain.” Episodes run roughly 15 to 20 minutes: https://www.youtube.com/c/TheCharismaticVoice/videos and https://elizabethzharoff.com/
- Reed: the Theodore Boone series by John Grisham, seven books published between 2010 and 2019 about a 13-year-old whose parents are both lawyers. In order: Kid Lawyer, The Abduction, The Accused, The Activist, The Fugitive, The Scandal, The Accomplice. Reed has been listening to them in the car with his ten-year-old. Available on Audible
