The user's IP address (which I imagine gets collected by doubleclick) is one of the 18 identifiable attributes which makes data PHI. But, I don't think that healthcare.gov needs to comply by HIPAA.