solutions.listing.eyebrow

solutions.listing.title

solutions.listing.description

sections.behind_the_page.eyebrow

sections.behind_the_page.headline

sections.behind_the_page.body

Exposure summary

Page /appointments

Same URL as the patient portal: findings map to reason codes, evidence, and remediation your teams can execute.

Risk score

612 / 1000

Critical

High

common.severity_criticalPIXEL_PRE_CONSENT

illustrations.behind_scenes.findings.pixel_pre_consent.title

Outbound requests to a major ad pixel included purchase-style parameters while the CMP still showed “preferences not saved.”

Remediation

Gate the pixel behind your CMP’s “analytics/advertising” bucket and verify with a fresh session.
Remove duplicate container loads so one tag cannot bypass the other.

common.severity_highMETA_PIXEL_HEALTH_CONTEXT

illustrations.behind_scenes.findings.meta_pixel_health.title

A Meta Pixel and a third-party session replay tool are both present where visitors can enter appointment or contact details. On a healthcare site, that pairing creates outsized HIPAA-related privacy risk, even before you argue whether a given field is “PHI” on its own.

Remediation

Remove or strictly gate the pixel until consent and purpose align with your health-data policies.
Mask or disable session replay on flows that collect health-adjacent or identifiable information.

common.severity_mediumTAG_SPRAWL_PRE_CLICK

illustrations.behind_scenes.findings.tag_sprawl.title

Several hosts were not reflected in your public cookie disclosure at the time of scan.

Remediation

Tighten container triggers to “consent granted” + meaningful interaction.
Publish an updated disclosure that matches measured third-party reality.

common.severity_policyGPC_SIGNAL_IGNORED

illustrations.behind_scenes.findings.gpc_signal_ignored.title

The browser sent GPC=1 on the consent verification POST; the response still treated the session as marketable.

Remediation

Thread opt-out signals through backend consent verification, not only the banner script.
Add an automated check that GPC alters the same endpoints your CMP claims to control.

Request trace 14 hosts · 6 pre-interaction

GET /appointments · 200 · document

GET connect.facebook.net/…/fbevents.js · 200

POST pixel.vendor/collect · body: event=Lead…

https://portal.wellhartclinic.org/appointments

Wellhart Clinic

Primary & specialty care

Privacy choices. We use cookies and similar technologies. Manage preferences or accept to continue.

Clinical team collaborating: illustrative photo for a fictional patient portal

Board-certified providers · Virtual & in-person

Photo by National Cancer Institute on Unsplash

Same-day & scheduled visits

Care that fits your schedule

Book appointments, message your care team, and see test results: the experience patients expect from a modern health system.

Book an appointment Find a location

Illustrative example, not a real clinic.

Popular on this site

Primary care

Video visit

Test results

Secure sign-in · Messages in transit encrypted

Drag the grip to move the split (clicking the page does not jump it). Scroll the panel on the right independently. Left: patient-facing page · Right: findings and request trace.

solutions.listing.title

sections.behind_the_page.headline

Page /appointments

illustrations.behind_scenes.findings.pixel_pre_consent.title

illustrations.behind_scenes.findings.meta_pixel_health.title

illustrations.behind_scenes.findings.tag_sprawl.title

illustrations.behind_scenes.findings.gpc_signal_ignored.title

Care that fits your schedule

solutions.pages.litigation-discovery.title

solutions.pages.ma-due-diligence.title

solutions.pages.board-risk-reporting.title

solutions.pages.portfolio-monitoring.title

solutions.pages.healthcare.title

solutions.pages.consent-audit.title

solutions.pages.third-party-script-governance.title