If it's gathering health information and outputting guidance then they are legally no longer "just an ordinary websites with ads and other tracking cookies". Something like a survey that may offer guidance to, say, a suicide hotline if the survey results point that way crosses a border between passive information dissemination and active health advice. I think it's unlikely US courts would rule that such systematic gathering of health information doesn't make it a "covered entity". But that's just the US. The article focused on the EU, and there the GDPR automatically elevates the level of opt-in permission required.