Can a medical practice use Google Ads conversion tracking without violating HIPAA?

I’m a marketer, not a lawyer, and nothing here is legal advice. What your practice is permitted to disclose is a decision for your own counsel or compliance officer. This page is written to give that conversation something specific to start from, because “is Google Ads HIPAA compliant” isn’t a question anyone can answer as asked.

The question is wrong, and the wrong version is what gets practices in trouble

There’s no such thing as a HIPAA-compliant advertising platform. HIPAA regulates covered entities and their business associates. It doesn’t certify software.

Google isn’t a covered entity, and it doesn’t sign business associate agreements for Google Ads. Its own documentation says so for the adjacent measurement product: Google “does not offer Business Associate Agreements in connection with this service” (Google Analytics help). Google does sign BAAs for Workspace and Cloud, which is why the scoping matters and why “Google signs no BAA” is too broad a thing to say. Ads isn’t on the covered list. There are contractual data-processing terms, so it isn’t a lawless void, but there’s no business-associate obligation.

So the real question is narrower: what can leave the practice, who can receive it, and under what agreement. Asked that way, conversion tracking stops being a yes-or-no and becomes a list of specific decisions.

What makes the data protected, and where that line moved

The statutory definition at 45 CFR 160.103 is individually identifiable health information: information, including demographic information, that relates to health, health care, or payment for health care, and identifies the individual or gives a reasonable basis to identify them.

So an identifier alone isn’t protected. An identifier plus a relation to the seeking of care is where it gets interesting.

Here’s the part most write-ups on this are two years out of date on. OCR’s tracking-technologies bulletin of December 2022 (revised March 2024) treated an IP address combined with a visit to an unauthenticated public page about a specific condition as protected. In June 2024 a federal court vacated that specific combination in American Hospital Association v. Becerra, and HHS dropped its appeal that August. HHS has since put a notice at the top of the bulletin naming the vacated part. The rest of the bulletin, including authenticated patient portals, still stands.

That matters for how strongly anyone can argue the page-view case. It doesn’t touch the case this page is actually about. Somebody who calls the practice, or submits a form, has handed you an identifier in the act of seeking care, and no court vacated that. Build for the strong version and the weak version takes care of itself.

The three changes to a default install

Every vendor touching an identifier is one I’d expect your compliance officer to want covered. Call tracking, the form handler, the scheduling widget, analytics, and the mailbox the lead notification lands in. Each receives a name or a number attached to somebody contacting a healthcare provider. The test isn’t whether the tool is reputable. It’s whether the vendor signs a business associate agreement and whether the plan you’re actually paying for is the one that agreement covers, which is frequently a higher tier than the one a practice signed up on.

Nothing leaving your systems says why. The platform receives a click id or a hashed identifier, a timestamp, and a value. Not a condition, a procedure, a department, or a page. This extends further than people expect: a conversion action named after a procedure carries the same information as a field containing it, and so does an account where the only campaign importing bookings is the one named for a single condition.

Health-based audience features stay off. Remarketing, Customer Match and lookalikes all work by assembling a group around a behavior, and when the behavior is reading about a condition, the audience is the disclosure. That’s a platform-policy question with its own answer in whether a practice can run remarketing.

What you can still measure

Almost everything that matters, which surprises people who assumed compliance meant flying blind.

You can count conversions. A call over a qualifying duration, a form submission, a booking click, all countable with no identifier reaching the platform at all. Standard conversion counting requires only the event.

You can attribute those to keywords, ads and campaigns, because the click identifier does that work and a click identifier isn’t a patient identifier. It’s a random string Google generated when it served the ad.

Check that the click id survives the trip. A redirect between the ad and your landing page can drop the gclid parameter while the page still loads fine, and then no booking can be tied back to its click. Open your final URL with ?gclid=test added (or &gclid=test if the URL already has a ?) and confirm it’s still in the address bar once the page settles.

You can import the outcome. If the practice knows which callers became patients, that can go back as an offline conversion. The version that sends the click id and no personal identifier at all is the one a practice should reach for first, and the mechanics are in how to track booked patients without sending PHI.

What you give up is the audience layer and the granular ecommerce-style reporting where the platform knows what somebody looked at. In a practice, that layer was never worth what it costs.

The order to do it in

Vendors first. Until the agreements are in place, every improvement to the measurement increases the volume moving through a tool that shouldn’t have it. I’ve watched a practice spend a month perfecting a tracking setup while every patient enquiry routed through an unsigned vendor the whole time, and the month of work made the exposure larger rather than smaller.

Then the event layer: count what happens, attribute it to the click, send nothing personal.

Then the outcome import, once the practice can actually tell you which enquiries became patients. That last part is usually a front-office workflow problem rather than a technical one, and it’s worth solving before it gets automated.

Where practices get caught

The tracking pixel on the confirmation page is the classic. A scheduling confirmation firing an analytics or advertising tag while the URL still carries the appointment type is sending the condition in the page path, and nobody looks at the page path.

Session recording and heatmap tools are second. They’re almost never covered by an agreement, they capture form contents by default, and they’re usually installed by whoever built the website rather than by anyone thinking about patients. A Microsoft Ads tag can also load Clarity session recording by itself, so check the ads tag too.

Third is the notification email. A form handler that emails the enquiry to the front desk has transmitted the whole thing, including whatever the patient typed in the message box, through whatever mail path that vendor uses. Delivery working isn’t the same as the disclosure being permitted, and the two get conflated constantly because one is visible and the other isn’t.

What to do this week

Write down every tool that receives a name, an email or a phone number from somebody contacting the practice. Include the ones nobody thinks of as medical software, because those are the uncovered ones.

For each, find the agreement or find out there isn’t one. That list is the actual position, and it’s nearly always different from what the practice believes it is.

The measurement architecture underneath all of this, for any business that books by phone rather than by checkout, is The Lead Quality Stack.

To see what your site’s tags already send before a visitor consents, the five-minute browser test shows it in your own browser.

Common questions

Does Google sign a BAA for Google Ads?

No. Google signs business associate agreements for some Workspace and Cloud services, and Google Ads isn’t one of them.

Did the court ruling make tracking pixels safe?

No. In June 2024 a federal court vacated one part of OCR’s tracking guidance: an IP address combined with a visit to a public, unauthenticated page about a health condition or provider. A call or a form from someone seeking care still hands you an identifier tied to care, and the ruling didn’t touch that.

Can I still import booked patients?

Yes, with a click id and no personal identifier. That’s the version to build first.

When to bring me in

Bring me in when keywords keep getting disapproved, when you can’t measure calls and forms without touching patient data, or when cost per new patient keeps climbing.

I'm Conner Crowe, and I write every audit myself. Send the free audit request and add me as a read-only user, and within 24 hours of access you'll have a written read on what you can measure safely and what to fix first. No call needed, and nothing in your account or store changes.

Request a free Google Ads audit →

See how I work on Google Ads for medical practices.