It's not just start ups here. Lots of hospitals and hospital groups have trackers like Google Analytics installed on their website. From the HHS[0] in many cases this is considered sharing health information with Google:

> For example, tracking technologies could collect an individual’s email address and/or IP address when the individual visits a regulated entity’s webpage to search for available appointments with a health care provider. In this example, the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply.