Notes

Is Google Analytics HIPAA Compliant?

No. Google does not sign a business associate agreement for Google Analytics and tells regulated customers not to send it anything that could be protected health information. That does not mean a clinic cannot use GA4 at all. It means GA4 can only run on pages, and collect data, where no PHI is involved.

Someone on your team, or a vendor with a product to sell, has told you Google Analytics is illegal for healthcare. Someone else has told you to switch off one setting and carry on. Both are wrong, and the accurate answer is more useful than either. I am a marketing consultant and not a lawyer, so treat this as a sourced map to bring to your privacy officer.

What Google itself says

Google publishes a page called HIPAA and Google Analytics. Its position is short. Regulated customers must not expose to Google any data that may count as PHI. Google makes no claim that Analytics satisfies HIPAA. It does not offer business associate agreements for the product.

Under HIPAA, a vendor that receives PHI on your behalf must sign a BAA. No BAA means no PHI can go to that vendor. So the rule for GA4 is simple to state: it may only receive data that is not PHI. Everything else in this article is about where that line sits on a real website.

What the 2024 court ruling changed and what it did not

In December 2022, HHS published a bulletin on the use of online tracking technologies by HIPAA covered entities and business associates, and revised it in March 2024. One passage went further than the rest. It said HIPAA obligations could be triggered when a tracking tool connected a visitor's IP address with a visit to a public, unauthenticated page about a specific condition or provider.

The American Hospital Association sued. On June 20, 2024, a federal court in Texas vacated that passage, and HHS later withdrew its appeal, as the AHA reported. HHS added a note to the top of the bulletin acknowledging the order.

What this changed: ordinary analytics on public marketing pages, the home page, the blog, a service overview, is on much firmer ground than it was in 2023.

What it did not change: the rest of the bulletin. Tracking on authenticated pages such as patient portals, and any disclosure of identifiable health information to a vendor without a BAA, are treated exactly as before. A scheduling flow that sends a reason for visit to Google is not a public page visit. Neither is a form whose contents end up in an event parameter.

Where GA4 can run on a clinic website

The thank-you page is the one that catches careful teams. Everything upstream is clean, and then the confirmation URL carries the procedure name into every analytics and ad tag on the page.

Are you even a covered entity?

Many owners assume HIPAA applies to anyone in healthcare. HHS defines covered entities more narrowly: health plans, clearinghouses, and providers who transmit health information electronically in connection with standard transactions such as insurance claims. A med spa or cosmetic practice that is entirely cash-pay and never bills insurance electronically may fall outside that definition. Your counsel decides this, not your marketing consultant.

Falling outside HIPAA does not mean anything goes. The FTC has brought cases against health companies that were not covered entities for sharing health data with advertising platforms, starting with its 2023 action against GoodRx, and it enforces the Health Breach Notification Rule. Several states have their own consumer health-data laws. In Canada, provincial health-information statutes apply in place of HIPAA. The practical standard ends up the same either way: do not send health details about identifiable people to an ad or analytics vendor.

What I change on a clinic site

This is the sequence I follow. None of it requires replacing GA4.

1. Inventory every tag on every page type, including the ones a previous agency left behind. Old pixels on the scheduling flow are the most common finding.
2. Remove GA4 and all advertising tags from logged-in areas and from scheduling and intake steps.
3. Clean the URLs. Procedure, condition, provider and reason for visit come out of query strings and paths on any page that keeps a tag.
4. Stop form values reaching the data layer. Events say "form submitted". They do not say what was in the form. The form itself has its own checklist in HIPAA-compliant forms.
5. Turn off user ID features and anything that joins analytics data to contact records.
6. Move conversion measurement for ads out of the browser. The outcome that matters, a booked or attended consultation, is sent server to server with a click ID, a neutral stage name and a time. I explain that design in click-ID-only conversion feeds.
7. Write down what was decided and have the privacy officer sign it.

Step six is the one owners do not expect. Removing tags from the booking flow sounds like going blind. It is the opposite. The browser tag was only ever counting forms. The server feed reports patients, which is what bidding should have been learning from all along, as I describe in the Google Ads offline conversion tracking guide. Email and automation tools raise the same BAA question, covered in HIPAA-compliant marketing automation. For the ad-policy side, see compliant Google Ads in regulated healthcare.

If you would like the inventory and the fixes done by one person who also understands what the ad account needs, that is what my HIPAA-compliant conversion tracking work covers, and the audit is the way in. The audit is $500 per ad account, comes with a 90-day plan, and is credited toward the first month if you continue with me. You work with me directly. Book a call or write first.

Check your own pages this week

Google has told you in writing that it will not take responsibility for PHI in Analytics. The court ruling made public pages safer and left everything else where it was. Open your scheduling flow, your intake forms and your thank-you page, and look at what the URLs and tags are doing. If health details are travelling with them, take the tags off those pages first and tidy up second. If you want it traced properly, start with the audit.

Written by Lev Brovtsev, independent performance marketing consultant. I do the work myself. Last updated: September 2026.