How to Track Admissions Without Violating 42 CFR Part 2

Measuring what's working in an admissions funnel is table stakes for any marketing program, but for a Part 2 treatment program, the standard analytics playbook creates real exposure. Here's how to track admissions performance without the tracking itself becoming a disclosure problem.

Why this is harder than standard HIPAA tracking

42 CFR Part 2 treats the fact that someone contacted or is receiving treatment at a covered program as protected information in its own right, and restricts re-disclosure more tightly than HIPAA does generally. A tracking setup that would be a manageable HIPAA question for a general medical practice, tying a conversion event to an identifiable visitor, can be a bigger problem for a Part 2 program specifically because of the re-disclosure restriction.

What a Part 2-aware tracking setup looks like

• Conversion events fire on a generic signal, such as "form submitted" or "call connected," without passing information that would identify the visitor as having contacted a substance use treatment program specifically.
• Any vendor or ad platform that could plausibly receive identifiable admissions-inquiry data has a qualified service organization agreement in place, Part 2's equivalent of a HIPAA BAA, before that data flows.
• Call tracking numbers and transcription tools are evaluated specifically for whether the recorded content could constitute a Part 2 disclosure, not just a general HIPAA question.
• Retargeting and remarketing based on site visits are scoped carefully, since building an audience of "people who visited our admissions page" and serving them ads elsewhere can itself function as an unintended disclosure.

A common mistake: treating this as a one-time setup

Ad platforms change their tracking features fairly often, adding new conversion signals, enhanced matching, or AI-driven optimization features that pull in more visitor-level data by default. A tracking configuration that was compliant when it was built can drift out of compliance as a platform rolls out a new feature that's opted in by default. Periodic review, not just an initial setup, is part of keeping this right.

What we recommend as a starting checklist

1. Map every tracking pixel, tag, and call-tracking number touching your admissions funnel and document what data each one actually captures.
2. Confirm consent language for any tracking is specific enough to meet Part 2's consent bar, not just a general HIPAA-style notice.
3. Get qualified service organization agreements in place with any vendor whose tools could plausibly receive identifiable admissions data.
4. Review new ad platform features before enabling them, since default settings sometimes capture more than a Part 2 program should send.
5. Revisit the setup periodically rather than treating it as done after the first build.

Tridigiam is a marketing agency, not a law firm. We build tracking with Part 2's stricter standard in mind from the start and flag anything that looks exposed, but the compliance interpretation specific to your program should come from your own counsel.

For the fuller picture on addiction treatment marketing, see our Addiction Treatment Marketing: The Complete Guide, or for how Part 2 differs from HIPAA generally, see our 42 CFR Part 2 vs. HIPAA guide.

Frequently asked questions

Can we still measure cost per admission at all under Part 2?

Yes, generally by measuring at an aggregate level, such as total conversions from a campaign, rather than tying individual identifiable visitors to individual admissions events in a way that could constitute a disclosure.

Does anonymized or aggregated data avoid the Part 2 question entirely?

Properly de-identified, aggregate data carries much less exposure, but what counts as sufficiently de-identified is a real compliance question that should be reviewed with your counsel rather than assumed.

Do we need a QSOA with every ad platform we use?

It depends on whether the platform could plausibly receive identifiable, Part 2-covered information through your specific setup. That's worth evaluating platform by platform rather than assuming a blanket answer.