While the data itself would fit the description of PHI, I don't know if healthcare.gov itself qualifies since it isn't a "health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse". That doesn't mean that it's against best practices. I built an analytics platform for a project with the VA on https://catalyze.io/baas (I also work there), so their are some alternatives to analytics when HIPAA is a concern.