> Does the guidance only apply to user-authenticated web pages?

It depends on if there's health related information on the page. The HHS includes examples of unauthenticated pages where the guidance applies such as pages about a specific health condition or find a doctor pages[0].

[0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...