edit: I found the answer. it's pretty reasonable. basically, no, HIPAA doesn't apply there.
It depends on if there's health related information on the page. The HHS includes examples of unauthenticated pages where the guidance applies such as pages about a specific health condition or find a doctor pages[0].
[0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
Someone (anonymous) goes to the website and does a bunch of searches on e.g. cancer or AIDS or anything else they don't want marketing to know about. Afterwards they log in (turns out the person was an existing patient who had a login). But it's all in the same session so now you tied all that search info to a specific account and sent it to adspyware third parties. Solid HIPAA violation.
Not my field, but talking to friends in healthcare infosec, this is something that has caused them to be hit with fines in the past. Even in the absence of fines, clearly a privacy violation.
The recent guidance from the HHS[0] indicates in many cases installing Google Analytics or the Facebook SDK would be considered sending health data to Google or Facebook and therefore be considered a HIPAA violation. From the HHS[0]:
> Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI. Such PHI may include, for example, an individual’s IP address, medical record number, home or email addresses, dates of appointments, or other identifying information that the individual may provide when interacting with the webpage.
[0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...