One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. Just my going to the websi

One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. Just my going to the website of a healthcare organization doesn't immediately identify me as a patient of that system, just that I've looked at their website. I've done some digging and I've found many health systems using google analytics, which is not HIPAA compliant. But I've found they only use this on their public pages. From what I can tell, they don't use it in their internal systems that will likely contain PHI. All that said, given the state of IT in healthcare systems, it wouldn't surprise me if some system out there is using a non-HIPAA compliant system for handling PHI. Who? No idea. The other part of HIPAA is that its penalties are WAY stronger than normal privacy laws. If someone knowingly obtains or discloses PHI in violation of the Privacy rule, they may face fines up to $50,000 and one year in jail. The fines and jail goes higher for more malicious violations. These penalties are enforced on the person who broke the law, not the company.