5 Best Consent Management Platforms for Healthcare in 2026: Pricing, HIPAA Fit and Verdicts

Last updated: October 2026 · 16 min read

SoftSnoop may earn a commission when you buy through links on this page. It never changes which tools we recommend or where they rank.

This article is general information, not legal advice. Healthcare privacy law is unsettled. Confirm your setup with your privacy counsel.

Key Takeaways

• A cookie banner is not a HIPAA authorization. HHS has said this directly. A consent management platform (CMP) handles state and EU consent laws. It does not, by itself, make a Meta Pixel on a patient page HIPAA compliant.
• Best for HIPAA-covered providers running paid ads: Freshpaint, the only pick here built around a signed BAA and PHI stripping.
• Best value for clinics and multi-site groups: Enzuzo Pro at $59/month billed annually for 10 domains, capped at 30,000 monthly visitors.
• Watch the 30,000 visitor cliff. Enzuzo Pro, Ketch Starter and Osano Plus all top out at 30,000 monthly visitors. Above that, only Ketch still publishes a price ($499/month, billed annually).
• Enterprise health systems: OneTrust, with a reported floor of roughly $10,000 a year before implementation.

Quick Verdict

• Best for HIPAA ad tracking: Freshpaint. Consent manager built into a BAA-covered data pipeline that keeps PHI away from Google and Meta.
• Best for multi-law orchestration: Ketch. Codifies HIPAA, GDPR and US state rules into one policy engine, with published pricing up to 100,000 visitors.
• Best value: Enzuzo. 10 domains, all geofenced regions and DSAR handling for $59/month billed annually.
• Best for enterprise health systems: OneTrust. Consent plus vendor risk, data mapping and incident response on one enterprise contract.

Full Comparison Table

Prices verified on each vendor’s own pricing page on 30 October 2026. “Not published” means we could not find a BAA offer on the vendor’s public pages. It does not mean the vendor refuses to sign one.

Which Platform Fits Your Situation

Why Cookie Consent Has Become a Serious Compliance Issue for Healthcare

For years, healthcare privacy programs focused inward. EHR security, BAAs with vendors, staff HIPAA training.

The website was a marketing problem. That stopped being true in late 2022.

The HHS tracking bulletin. In December 2022, the HHS Office for Civil Rights warned that pixels and analytics tools on hospital websites, patient portals and telehealth apps could disclose protected health information (PHI) to third parties. It updated that guidance in March 2024.

The court ruling. In June 2024, a federal court in Texas (American Hospital Association v. Becerra) vacated one part of that guidance: the idea that an IP address plus a visit to a public health information page is automatically PHI. HHS dropped its appeal later in 2024.

The rest of the guidance still stands. Tracking on authenticated pages, such as patient portals and logged-in telehealth flows, is still squarely a HIPAA issue.

The lawsuits did not stop. Plaintiff firms now use California’s wiretapping statute (CIPA), which carries statutory damages of $5,000 per violation, against healthcare sites that fire Meta Pixel or session replay tools before a visitor makes a choice.

State privacy laws keep multiplying. Several US states now treat health data as sensitive data that needs opt-in consent. EU and UK patients bring GDPR into scope.

The DOJ data security rule. Since April 2025, the US Department of Justice restricts certain bulk transfers of sensitive personal data, including health data, to countries of concern. That one is a vendor and data broker question more than a banner question, but it belongs on your compliance map.

A consent management platform does not solve all of this. What it does is handle the public-facing consent layer: it detects where a visitor is, shows the right banner, blocks tags until consent, and keeps a timestamped record you can produce later.

If you need internal HIPAA tooling, data mapping, BAA management or vendor risk, you need more than a CMP. Two of the five tools below cover some of that.

What a Healthcare Website Actually Needs From a CMP

Healthcare buyers need six things. The first five are what any good CMP should do. The sixth is what separates healthcare from retail.

1. Geofenced consent by jurisdiction. A visitor from Germany needs GDPR opt-in before any non-essential cookie fires. A California visitor needs CCPA disclosures and an opt-out. Your CMP should detect location and apply the right model automatically.

2. Tag blocking before consent, with no race conditions. The tag must not fire while the banner is still loading. Ask each vendor how it loads in Google Tag Manager. Osano, for example, documents loading first in GTM specifically to prevent this.

3. Audit-ready consent records. Regulators and plaintiff attorneys ask the same question: can you prove this visitor consented before the pixel fired? You need timestamp, visitor ID, consent state, banner version and jurisdiction.

4. Google Consent Mode v2. If you run Google Ads for patient acquisition or GA4 for EU traffic, Consent Mode v2 has been required since March 2024. All five tools below support it.

5. Multi-domain economics. Health systems run a main site, a portal, careers, condition microsites and regional hospital sites. Per-domain pricing gets expensive fast. Check both the domain limit and the visitor cap.

6. A plan for PHI that a banner cannot cover. This is the healthcare-only requirement. On pages where tracking can reveal a patient relationship, especially logged-in pages, you need one of three things:

• remove third-party pixels from those pages,
• route data through a vendor that signs a BAA and strips PHI, or
• obtain a real HIPAA authorization, which a cookie banner is not.

How We Tested and Ranked

What we did. We started from the 5 most-cited CMPs in healthcare buying guides and checked every pricing, plan limit and free-tier claim against each vendor’s live pricing page on 30 October 2026.

How we ranked. In this order of weight:

1. How much of a healthcare website’s real risk the tool covers out of the box (PHI handling, BAA, authenticated pages)
2. Pre-consent blocking and geofencing quality
3. Price transparency and cost at realistic healthcare traffic levels
4. Multi-domain economics
5. Audit records and DSAR handling

Also considered. TrustArc (no published pricing and a reported floor similar to OneTrust’s), Cookiebot, CookieYes and Termly (strong generic CMPs, but no BAA in their published plans), and two healthcare specialists, ConsentStack and Ours Privacy. ConsentStack publishes a BAA on a $79/month plan and Ours Privacy pairs a CMP with a HIPAA-focused data platform. We left both out of this edition because we could not find enough independent user reviews. [EDITOR: revisit at next refresh.]

A note on our reference material. One of the most-read guides on this topic is published by Enzuzo, which also ranks Enzuzo. We used it as a starting point, verified its claims, and corrected two of them below.

1. Freshpaint: Best for HIPAA-Covered Providers Running Paid Ads

Quick Facts

Review

Freshpaint is not a cookie banner company. It is a healthcare data platform that sits between your website and your marketing tools, signs a BAA, and includes a consent manager.

That combination is why it ranks first. It is the only tool on this list that addresses both the consent law problem and the PHI problem.

Detailed Review

HHS has stated that a banner asking visitors to accept or reject cookies is not a valid HIPAA authorization. So if a hospital fires the Meta Pixel on an appointment page, a perfect banner still leaves the PHI exposure in place.

Freshpaint’s answer is to replace the direct pixel. Your site sends events to Freshpaint under a BAA. Freshpaint blocks data to tools that are not HIPAA compliant by default, and you choose exactly which fields can flow to Google, Meta or GA4.

The Consent Manager is built into that same pipeline. It applies consent by state, and a visitor’s choice takes effect across every connected ad and analytics integration at once.

What we found on pricing. The current pricing page lists three tiers, Comply, Perform and Scale, all behind “Talk to Sales.” Consent management and tracker monitoring start in Comply.

Many software directories still advertise a free plan for 1,000 monthly tracked users. That plan does not appear on Freshpaint’s own pricing page as of October 2026. Confirm before you plan around it.

The billing detail most buyers miss. Freshpaint bills on monthly tracked users. Its own documentation says an unidentified visitor on a phone and a laptop counts as two MTUs until they are tied to one identity.

On a public healthcare site, most visitors never log in. Expect your MTU count to run higher than your unique visitor count in Google Analytics.

What it costs in practice. We could not get a published number. One healthcare marketing agency describes it as costing tens of thousands a year. Treat that as a third-party estimate.

Freshpaint publishes case studies claiming OrthoCarolina cut cost per lead by 80% and Allergy Partners dropped it from $300 to $12. Those are vendor-reported.

Pros

• Signs a BAA as a standard part of the product
• Blocks PHI to non-HIPAA tools by default
• Consent choices apply across all connected integrations at once
• Built only for healthcare, with vertical-specific onboarding

Cons

• No published pricing on any tier
• Not sold as a standalone CMP
• MTU billing can count one visitor more than once

What the Community Says

Independent reviews are thin. The one verified Capterra reviewer, from a hospital and health care organization, praises it as an affordable way to stay HIPAA compliant but finds it limited in configurability and clearly aimed at marketers rather than engineers.

Privacy scanning vendor Lokker notes a common setup error in healthcare: putting Freshpaint in a CMP’s “strictly necessary” category, which loads it before consent.

Best For

• Covered entities that want to keep running Google and Meta ads
• Marketing teams without in-house privacy engineers
• Groups that need ad attribution tied to booked appointments

Not Best For

• Small practices that only need a compliant banner
• Teams that want self-serve, published pricing
• Organizations whose main exposure is EU GDPR traffic (confirm EU support with sales)

CTA: Request Freshpaint pricing → (softsnoop.com/go/freshpaint/) · Read our full Freshpaint review →

2. Ketch: Best for Health and Wellness Brands Juggling HIPAA and State Laws

Quick Facts

Review

Ketch treats consent as a permission signal that follows a person across systems, not just a banner choice. Its healthcare solution puts HIPAA authorizations, consumer consent and marketing opt-ins into one record.

It is also the most transparent on price of any enterprise-capable tool here, with published numbers up to 100,000 visitors.

Detailed Review

Most CMPs stop at the browser. Ketch’s pitch to healthcare is that the same permission record should govern your website, your CRM, your email platform and your data warehouse.

For a health and wellness company that runs both HIPAA-regulated services and a consumer product, that matters. The two kinds of data need different rules, and Ketch encodes HIPAA, HITECH, GDPR, CPRA and US state laws into policies that run across connected systems.

Every plan, including Free, gets the consent designer, preference center, privacy law templates, consent record storage, tracker scanning and tag orchestration.

What the pricing page actually says.

• Free: $0, up to 5,000 unique users a month, 2 integrations
• Starter: $150/month, billed monthly, up to 30,000 unique users
• Plus: from $499/month, billed annually, up to 100,000 unique users
• Pro: custom, 100,000+ users and the full platform

The detail that changes your budget. Plus is billed annually, so the real step up from Starter is a $5,988 commitment, not $499.

DSR automation is not available on Free or Starter. It is an add-on on Plus and only included on Pro. Data mapping is Pro only. If you expect patient access and deletion requests, price the add-on before you sign.

On the plus side, Ketch counts a person once per period no matter how often they return, and it moves you up a tier rather than charging undefined overages.

Switching from OneTrust. Ketch Switch runs alongside OneTrust in a quiet mode, collects existing consent signals, then cuts over. Ketch says this avoids re-consenting EU visitors.

Pros

• Published pricing up to 100,000 monthly users
• Tracker scanning and tag orchestration on every plan
• One record for HIPAA authorizations and consumer consent
• Documented OneTrust migration without re-consent

Cons

• DSR automation costs extra below the Pro tier
• Only 2 data integrations below Pro
• No BAA offer on its public pages

What the Community Says

G2 reviewers consistently praise Ketch’s implementation team and its DSAR automation. Complexity is the most cited downside, which fits a tool that does more than a banner.

Ketch says it was named a Leader in the 2026 Gartner Magic Quadrant for Privacy UX. That is a vendor-reported claim.

Best For

• Organizations with both HIPAA and consumer health data
• Teams leaving OneTrust that want a guided switch
• Sites between 30,000 and 100,000 monthly visitors that want a published price

Not Best For

• Single clinics that only need a banner
• Buyers who need DSR automation on a small budget
• Teams that need a BAA without a sales conversation

CTA: See current Ketch pricing → (softsnoop.com/go/ketch/) · Read our full Ketch review →

3. Enzuzo: Best Value for Clinics and Multi-Domain Practices

Quick Facts

Review

Enzuzo is the cheapest way on this list to put compliant, geofenced consent on several healthcare domains. The Pro plan covers 10 domains for $59/month billed annually.

The catch is the visitor cap, which the headline price does not mention.

Detailed Review

Enzuzo deploys mainly through a Google Tag Manager template that blocks non-essential tags until consent. It supports Google Consent Mode v2, Microsoft UET consent mode and IAB TCF 2.3, and it is SOC 2 certified.

Every plan, including Free, includes a privacy policy and other legal policies, a customizable banner, 24+ languages and DSAR intake. For a practice with EU or California patients, built-in DSAR handling covers a real legal obligation.

What the pricing page actually says.

• Free: $0, 1 domain, 5,000 visitors
• Growth: $22/month billed annually ($264/year), 4 domains, 10,000 visitors, 1 geofenced region
• Pro: $59/month billed annually ($708/year), 10 domains, 30,000 visitors, 5 users, all regions
• Enterprise: custom, unlimited domains, 30,000+ visitors

Two things we found that the marketing skips.

First, the “10 domains for $59” headline comes with a 30,000 unique monthly visitor cap across the plan. A regional hospital’s main site can pass that on its own.

Second, Growth includes only one default and one custom geofenced region, and Global Privacy Control support starts at Pro. A clinic with California and EU visitors, or one that needs to honor GPC under state laws, should budget for Pro, not Growth.

One inconsistency to confirm. Enzuzo’s feature table lists unlimited DSAR requests on every plan. The FAQ on the same page says the Free tier includes up to three DSARs a month. Ask before you rely on the free plan for patient requests.

Where its own guide overstates things. Enzuzo’s healthcare article says HHS requires explicit opt-in consent for tracking. HHS actually says a cookie banner does not count as HIPAA authorization, which is a different point. Enzuzo itself notes it does not replace a HIPAA program or BAAs, and that is the right way to read it.

Pros

• 10 domains for $708 a year on Pro
• DSAR intake and legal policies on every plan
• Monthly billing with no long contract
• Google Consent Mode v2 and Microsoft UET consent mode included

Cons

• 30,000 visitor cap on Pro, then custom pricing
• GPC and unlimited regions only from Pro up
• No published BAA or PHI handling

What the Community Says

Most public praise sits on Enzuzo’s own site. A marketing lead at Yale describes a smooth experience from trial to purchase, and a product manager at practice-management software company Jane App credits it with taking consent work off their clients. Both are vendor-curated testimonials.

Best For

• Practices running several small sites under 30,000 visitors
• Teams that want DSAR intake without a separate tool
• Self-serve buyers who need to go live this week

Not Best For

• Hospital main sites with more than 30,000 monthly visitors
• Covered entities keeping ad pixels on patient pages
• Buyers who need a signed BAA from their CMP

CTA: See current Enzuzo pricing → (softsnoop.com/go/enzuzo/) · Read our full Enzuzo review →

4. OneTrust: Best for Enterprise Health Systems

Quick Facts

Review

OneTrust is the category leader for a reason. For a health system that needs consent records, vendor assessments, data maps and incident documentation in one place during an OCR inquiry, nothing else here matches its breadth.

For anyone smaller, the price floor makes it hard to justify.

Detailed Review

OneTrust’s consent module covers banners, preference centers and enforcement across websites, mobile apps and connected TV platforms such as Apple TV and Roku. It supports Google Consent Mode v2, GPC, GPP and IAB frameworks.

The value for healthcare is everything around consent. A 500-bed system with dozens of vendors and a privacy office can run consent, third-party risk, data mapping and incident response under one contract.

Pricing. OneTrust does not publish prices. Multiple pricing analyses report that it raised its minimum annual contract to about $10,000 in 2026, with implementation services commonly adding $10,000 to $50,000 in year one.

Be aware that most of those analyses are published by OneTrust competitors. The figure is consistent across them, but confirm it in your own quote.

Our read on the floor. At a $10,000 minimum, a single specialty clinic pays the same entry price as a regional system. In our worked example below, that is about 14 times the cost of Enzuzo Pro for the same three domains.

BAA. A survey of which consent tools sign a BAA lists OneTrust as signing one under an enterprise agreement negotiated through sales. If you need one, put it in the contract before you sign.

Pros

• Broadest privacy suite on this list
• Consent across web, mobile and connected TV
• Strong documentation for regulator inquiries
• BAA reportedly available on enterprise contracts

Cons

• Reported minimum of about $10,000 a year
• Implementation measured in weeks to months
• Smaller customers report weak support

What the Community Says

Capterra reviewers praise OneTrust’s flexibility and balance of legal, operational and technical coverage. The recurring complaints are an overwhelming feature set and support that smaller clients describe as unresponsive.

Best For

• Health systems with a privacy office and procurement process
• Organizations already using other OneTrust modules
• Consent needs across apps and connected TV

Not Best For

• Clinics and practices under $10,000 a year in budget
• Teams that need to go live in days
• Buyers without technical staff to run implementation

5. Osano: Best for Compliance Teams That Want Vendor Monitoring

Quick Facts

Review

Osano pairs a solid CMP with privacy law alerts, vendor risk scoring and a contractual fines guarantee. For a healthcare compliance team that actively watches its vendor stack, the bundle is useful.

For consent alone, it is the most expensive self-serve option here per domain.

Detailed Review

Osano installs with one line of JavaScript, uses AI to classify discovered cookies, and blocks tags and cookies until consent. It documents loading first in Google Tag Manager to avoid the race condition where a tag fires during banner load.

It supports GPC, Google Consent Mode, IAB TCF and GPP, state-level US opt-out logic, and pre-built rule sets for 95+ regulations in 50+ countries.

The healthcare angle is vendor risk. Chat widgets, scheduling tools, video players and ad tags all reach patient pages. Osano scores vendors on privacy risk, detects privacy policy changes, and alerts you to lawsuits filed against vendors you use.

Osano lists the American Society of Anesthesiologists as a customer story and shows Boston Medical among its customer logos.

What we found on pricing. Some guides, including Enzuzo’s, say Osano removed all pricing. It did not. The main plans page is demo-only, but a separate self-serve page still lists:

• Free: $0, 1 user, 1 domain, 5,000 visitors
• Plus: $199/month, 2 users, 3 domains, 30,000 visitors, privacy templates, UK and GDPR representative
• Basic Privacy: custom, unlimited users and domains, Compliance Check, basic subject rights, No Fines guarantee

That page is set to noindex, which is probably why most reviewers miss it.

The guarantee has a line drawn under it. The $500,000 No Fines, No Penalties guarantee starts at Basic Privacy. It does not apply to Free or Plus.

Cost per domain. Plus works out to about $66 per domain per month. Enzuzo Pro is about $5.90 per domain at annual billing.

Pros

• Vendor risk scoring with litigation and policy-change alerts
• Loads first in GTM to prevent pre-consent firing
• Native iOS, Android and React Native SDKs
• $500,000 fines guarantee on Basic Privacy and up

Cons

• $199/month for only 3 domains on Plus
• Guarantee excluded from Free and Plus
• Consent analytics described as limited by some reviewers

What the Community Says

On G2, reviewers repeatedly mention fast deployment. One retail reviewer reports going live and compliant within four days. A privacy analyst singles out the guarantee as something other vendors do not offer.

Some reviewers describe Osano’s consent analytics as limited. Note that both sets of comments are surfaced by interested parties: Osano on its own site, and a competitor on the analytics point.

Best For

• Compliance teams that review vendors on a schedule
• Organizations with native mobile patient apps
• Buyers who want a contractual fines guarantee

Not Best For

• Practices with more than 3 domains on a self-serve budget
• Teams that only need a banner
• Anyone who needs a BAA without a sales cycle

CTA: See current Osano pricing → (softsnoop.com/go/osano/) · Read our full Osano review →

What It Costs: A Worked Example

Headline prices hide the limits that matter. Here is one realistic healthcare setup, priced against each vendor’s published plans.

The practice. A four-location orthopedic group. Three domains: main site, a patient education microsite and a careers site. About 24,000 unique visitors a month. Google and Meta ads on public pages. The patient portal is hosted by the EHR vendor.

Based on published list prices on 30 October 2026, before taxes or negotiated discounts.

What the numbers show.

1. 30,000 monthly visitors is the shared cliff. Enzuzo Pro, Ketch Starter and Osano Plus all stop there. Past it, Ketch is the only one that still publishes a price.
2. The cheapest banner does not fix the ad problem. None of the three self-serve tools publishes a BAA. If this group keeps the Meta Pixel on appointment pages, it needs either Freshpaint-style PHI routing or a decision to pull the pixel from those pages.
3. OneTrust’s floor is about 14 times Enzuzo Pro for this exact setup.

Run your own numbers with your real visitor count before you trust anyone’s ranking, including ours.

How to Choose Between Them

Choose Freshpaint if you are a HIPAA-covered entity that wants to keep running Google and Meta ads and needs a vendor that will sign a BAA and strip PHI before data leaves your site.

Choose Ketch if you handle both HIPAA data and consumer health data, serve several jurisdictions, or are leaving OneTrust and want a published price up to 100,000 visitors.

Choose Enzuzo if you run a clinic, practice group or digital health startup under 30,000 visitors and need compliant consent on several domains this week, on a small budget.

Choose OneTrust if you are a large health system with a privacy office, need consent plus vendor risk and data mapping, and can absorb a five-figure annual contract.

Choose Osano if your compliance team actively monitors third-party vendors, you have native mobile apps, and you value a contractual fines guarantee.

Common pairing. Many healthcare organizations run a CMP for consent law plus Freshpaint, or a similar BAA-backed tool, for the PHI layer. That is not overlap. They solve different problems.

The HHS Tracking Guidance: What It Means for Your Website

The one thing to get right: HHS has said that a banner asking visitors to accept or reject cookies is not a valid HIPAA authorization. A CMP satisfies state and EU consent laws. It does not, on its own, authorize sharing PHI with Meta or Google.

Here is where the guidance stands as of October 2026.

What still applies. The HHS bulletin on tracking technologies remains in force for authenticated pages. Patient portals, logged-in telehealth flows and anywhere a patient signs in are covered. Tracking there that sends identifiable data to a vendor without a BAA is a HIPAA problem.

What a court removed. In June 2024, the Northern District of Texas vacated the part of the guidance that treated an IP address plus a visit to a public health information page as PHI. HHS withdrew its appeal later that year.

What that does not mean. It does not make public pages a free-for-all. Pages where a visitor enters information, such as appointment requests, symptom checkers and intake forms, can still create PHI. CIPA and state laws apply regardless of HIPAA.

Who the guidance covers. Covered entities (hospitals, physician practices, health plans) and their business associates. General wellness sites that are not covered entities fall outside HIPAA, but often inside state health data laws.

What a CMP does here. It stops the pixel from firing until a visitor consents, keeps the record, and applies the right rules by location. That handles the consent-law layer.

What a CMP does not do. It does not replace a BAA, decide whether a pixel belongs on a patient page, or fix internal data handling. Those are decisions for your privacy and legal teams.

Buyer’s Guide

By goal

“I need to stop a CIPA demand letter from happening again.” Prior blocking in California is the priority. Enzuzo Pro or Ketch Starter can be live quickly. Then audit which tags fire on reject and on no interaction.

“I want to keep running Meta ads.” Start with Freshpaint, or remove the pixel from patient pages. A banner alone is not enough.

“I need to answer patient data requests.” Enzuzo includes DSAR intake on every plan. Ketch charges for DSR automation below Pro. Osano adds subject rights at Basic Privacy.

“I am preparing for an OCR inquiry or a regulator audit.” OneTrust or Ketch Pro, for consent records tied to data maps and vendor assessments.

“I have native patient apps.” OneTrust, Osano and Ketch all support mobile. Confirm SDK coverage for your stack.

By skill level

No technical staff. Enzuzo or Osano Plus. Both are self-serve. Freshpaint is also marketer-friendly, but implementation is sales-led.

One marketing ops or web person. Enzuzo Pro or Ketch Starter, deployed through Google Tag Manager.

A privacy team and engineers. Ketch Pro or OneTrust, where the extra configurability pays off.

How to Choose: A 5-Question Checklist

1. Will any tracking touch logged-in pages or intake forms? If yes, you need a BAA-backed tool or no third-party pixels on those pages.
2. What is your real monthly unique visitor count? Under or over 30,000 decides your price on three of these five tools.
3. How many domains do you run, including microsites and careers? Osano Plus stops at 3. Enzuzo Pro covers 10.
4. Do you need to honor Global Privacy Control and multiple regions? On Enzuzo, that means Pro, not Growth.
5. Will the vendor sign a BAA, and on which plan? Get it in writing before you sign.

FAQ

Does a healthcare website need a cookie consent banner if it is HIPAA compliant?

Yes, in most cases. HIPAA and cookie consent laws are separate. GDPR, CCPA, CIPA and other state laws govern tracking consent regardless of HIPAA status. A healthcare site with EU or California visitors needs a compliant consent mechanism under those laws, on top of its HIPAA obligations.

Is clicking “Accept” on a cookie banner a HIPAA authorization?

No. HHS has stated that a banner asking visitors to accept or reject cookies does not constitute a valid HIPAA authorization. A HIPAA authorization has specific required elements that a cookie click does not meet. Use the banner for consent laws and handle PHI separately.

What is the HHS tracking technology guidance and how does it affect our website?

It is an HHS bulletin warning that pixels and analytics on healthcare websites can disclose PHI. A 2024 court ruling removed its application to IP addresses on public information pages, but the guidance still applies to authenticated pages such as patient portals.

Can a CMP replace a BAA with our analytics vendor?

No. A BAA is a contract between a covered entity and a vendor that handles PHI for it. A CMP controls whether tags fire. If your analytics vendor receives PHI, you need a BAA with that vendor whether or not you run a CMP.

Which privacy laws apply to healthcare websites in the US?

HIPAA covers covered entities and business associates. CCPA and CIPA apply to sites California residents can reach. A growing set of state laws, including several health-data-specific ones, apply by visitor location. GDPR applies to EU residents’ data. A geofenced CMP applies the right rules automatically.

How much does a CMP cost for a healthcare organization?

Published prices range from free to $199 a month for self-serve plans. Enzuzo Pro is $708 a year for 10 domains, Ketch Starter is $1,800, and Osano Plus is $2,388. OneTrust reportedly starts around $10,000 a year. Freshpaint is quote-only.

Does Google Consent Mode v2 apply to healthcare websites?

Yes, if you run Google Ads or GA4 and serve visitors in the EEA. It has been required for EU ad campaigns since March 2024. Without it, you lose measured conversion data. All five platforms in this guide support Consent Mode v2.

What is the difference between a CMP and a full HIPAA compliance platform?

A CMP manages website consent: banners, tag blocking, consent records and geofenced rules. A HIPAA compliance platform covers internal governance: risk assessments, BAAs, staff training and policies. Most healthcare organizations need both, and neither replaces the other.

Which consent management platforms sign a BAA?

Among these five, Freshpaint signs a BAA as part of its product, and OneTrust reportedly does under enterprise contracts. Ketch, Enzuzo and Osano do not publish a BAA offer, so ask sales directly. Some smaller healthcare specialists also offer one on self-serve plans.

Conclusion

Top pick for HIPAA-covered providers: Freshpaint. It is the only tool here that handles both consent and the PHI problem a banner cannot fix. Expect a sales process and a real budget.

Best value: Enzuzo Pro. At $708 a year for 10 domains, nothing else comes close for practices under 30,000 visitors.

Best free option: Enzuzo Free. One domain, a compliant banner, privacy policies and DSAR intake at $0.

Best for complex, multi-law organizations: Ketch. The most transparent pricing of the enterprise-capable tools, with a policy engine built for mixed HIPAA and consumer data.

Start with your visitor count and whether any tracking touches patient pages. Those two answers pick your tool faster than any feature list.

Still deciding? Under 30,000 visitors and no ads on patient pages? Start with Enzuzo. Running ads off patient pages? Talk to Freshpaint first.