Key Takeaways
- Amazon HSA spend grew 123% year over year in 2025, as consumers increasingly expect to buy healthcare products the same way they buy everything else.
- GLP-1 platform spend inside HSAs and FSAs is exploding, with Eli Lilly up 5,610% and Hims & Hers up 134% year over year.
- Advocate Aurora Health paid $12.225 million to settle a lawsuit after Meta and Google tracking pixels on its website, patient portal, and scheduling app exposed data for roughly 2.5 million people.
- HIPAA's steepest penalty tier now runs up to $73,011 per violation and $2,190,294 annually, effective January 28, 2026.
Healthcare and wellness marketers are chasing a wallet that is moving faster than almost any other category in consumer spending. Health savings accounts and flexible spending accounts, once reserved for co-pays and reading glasses, are now funding GLP-1 prescriptions, therapy subscriptions, and same-day Amazon orders. The same tracking infrastructure that lets a demand generation team follow that spend from ad click to purchase, however, is now the single most expensive liability a healthcare marketing budget can carry. One health system found that out the hard way, to the tune of $12.225 million.
The Wallet Moving Into HSAs and FSAs
According to the 2026 HSA Spend Report from HSA provider Lively, Amazon HSA spend grew 123% year over year in 2025, a sign that consumers now expect buying healthcare products to feel as frictionless as any other online purchase. The report's category data show similarly steep curves elsewhere: spend on Eli Lilly's GLP-1 platforms rose 5,610%, spend through Hims & Hers climbed 134%, and spend on the therapy platform Headway grew 130% as mental health treatment shifted from an occasional expense to a recurring one. The average Lively HSA balance reached $5,457 in 2025, up 11% from the year before and 37% above the industry average.
That growth is not confined to one provider's book of business. A separate analysis from Numerator puts combined annual household contributions to HSAs and FSAs at more than $100 billion, held by roughly 37% of Americans. For a category that marketing teams historically treated as a niche insurance-adjacent line item, that is now a mainstream consumer spending pool on the scale of a major retail category.
Year-over-year growth in Amazon HSA spend in 2025, as healthcare purchases start to look like ordinary retail transactions.
The Compliance Trap Hiding Inside That Growth
The obvious playbook for capturing that spend looks exactly like retail marketing: track visitors across a website and patient portal, retarget them with relevant offers, and measure the funnel down to the purchase. In healthcare, that playbook is now radioactive. Advocate Aurora Health learned this when it agreed to pay $12.225 million to settle a class action after Meta Pixel and Google Analytics tags on its website, patient portal, and scheduling app transmitted appointment and physician data for roughly 2.5 million people between 2017 and 2022.
Regulators have not eased up since. Under the civil penalty schedule that took effect on January 28, 2026, the top tier, reserved for willful neglect that goes uncorrected, now starts at $73,011 per violation and can reach $2,190,294 in a single year. A healthcare or wellness brand running the exact ad-tech stack that works for a retail account, third-party pixels feeding an ad platform's optimization engine on identifiable visitors, is running that stack at tier-four risk.
What Advocate Aurora Health paid to settle a lawsuit over Meta and Google tracking pixels on its patient portal and scheduling app.
What Compliant Growth Actually Looks Like
The healthcare marketers avoiding that exposure are not abandoning tracking, they are moving it off the open web. Contextual targeting, showing an orthopedics ad against orthopedics content rather than following an individual visitor's browsing history, delivers comparable specialty-level relevance without ever touching protected health information. Where behavioral tracking is unavoidable, compliant teams pair it with signed Business Associate Agreements covering every vendor and route conversion events server-side, so a hashed identifier reaches the ad platform instead of a patient's appointment details.
The channel mix is shifting too. Owned channels built on first-party consent are absorbing more of the personalization work that used to run through retargeting. And the content itself is changing: brands producing patient-facing video for HSA-eligible products are increasingly leaning on licensed stock and B-roll footage rather than real patient testimonials, which removes the PHI exposure a testimonial shoot carries while still supporting the volume of video a fast-growing category needs.
- Audit every pixel touching a patient-facing page. If a vendor cannot sign a Business Associate Agreement, it should not be receiving traffic from an authenticated page or a scheduling flow.
- Move conversion tracking server-side. Send a hashed identifier to the ad platform instead of raw form or appointment data, and keep browsing behavior separate from clinical records.
- Build contextual targeting into the media plan now. Specialty-level content placement delivers relevance without inferring an individual diagnosis from browsing history.
- Shift personalization budget toward owned channels. Email and SMS built on explicit consent survive a compliance review that third-party retargeting cannot.
- Budget for the spend curve, not the historical baseline. Categories like GLP-1 and mental health are growing inside HSAs and FSAs faster than most marketing plans account for.
- Treat every tracking decision as a legal decision first. At $73,011 per violation, the cost of getting this wrong outpaces almost any media budget it was meant to protect.
The category is not going to slow down to let compliance catch up. Every quarter that HSA and FSA balances keep climbing is another quarter healthcare and wellness marketers have to prove they can grow into that spend without repeating Advocate Aurora's mistake.
