HIPAA and Marketing Pixels: What You Can Legally Track

Your agency dropped a Meta pixel and a GA4 tag on your practice's website, wired the appointment form up as a conversion, and called it attribution. On a healthcare site, that setup can be an impermissible disclosure of protected health information — and the two companies whose tags you just installed will not sign a Business Associate Agreement to cover it.

This is not theoretical. On July 20, 2023, the FTC and HHS Office for Civil Rights sent a joint warning letter to approximately 130 hospital systems and telehealth providers, naming the Meta/Facebook pixel and Google Analytics by name. If you run a therapy practice, a treatment center, a dental group or a clinic, the tags on your site are a compliance surface, not just a marketing setting. Here is exactly what you can and cannot track — and how to still prove the ad spend works.

Is Google Analytics HIPAA compliant?

No. Google's own documentation says it plainly: Google 'makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service.' That sentence is on Google's HIPAA and Google Analytics support page, not on a competitor's blog.

The same page tells covered entities they 'may only use Google Analytics on pages that are not HIPAA-covered,' and that 'authenticated pages are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages.' It also warns that unauthenticated pages related to the provision of health care are more likely to be covered.

Google reinforces this on the other side of the house. Google Cloud's HIPAA compliance guide publishes the list of products its BAA actually covers — BigQuery, Cloud Storage, the Healthcare API, and dozens more — and tells customers to 'disable or otherwise ensure that you do not use Google Cloud Products that are not explicitly covered by the BAA' when working with PHI. Google Analytics is not on that list. Neither is Google Ads.

So the answer to the question every practice owner asks is: GA4 is fine on your careers page and your directions page. It is not fine on your patient portal login, your appointment booker, or your 'do I have an anxiety disorder?' quiz. If you want a genuinely privacy-simple analytics setup, our comparison of GA4 versus Plausible and Fathom is the right starting point — but understand that no analytics tool is HIPAA-safe by default. The BAA is the only thing that makes it so.

How can a tracking pixel disclose PHI on a healthcare site?

A pixel discloses PHI the moment it sends an identifier — an IP address, device ID, cookie ID or hashed email — together with information that relates to a person's health, care, or payment for care. OCR's bulletin gives the textbook example: someone reading a hospital's oncology services page to get a second opinion on their brain tumor. Transmitting that person's IP address alongside that pageview is a disclosure of PHI.

In practice, the leak is almost never the pixel firing on the homepage. It is what the tag scrapes off the pages that matter:

Session replay is the one that gets missed. It records the free-text box where a patient types 'I have been having panic attacks since my divorce.' If that vendor has not signed a BAA, that is an impermissible disclosure, and there is no configuration setting that fixes it after the fact.

What does the HHS OCR tracking guidance actually say now?

Part of it was struck down — and most agencies have not read the part that survived. On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated a portion of OCR's online tracking bulletin in American Hospital Association v. Becerra: specifically, the guidance that HIPAA obligations are triggered where a technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or health care providers. HHS says it 'is evaluating its next steps.'

If an agency is telling you 'a court threw that out, put the pixel back,' they read one paragraph. Everything below is still standing:

• Tracking technologies on user-authenticated pages — patient portals, telehealth platforms — generally have access to PHI, and a BAA is required.
• A portal login or registration page is technically unauthenticated, but if a tag captures what the user types into it, that is a disclosure of PHI.
• An unauthenticated page that lets someone book an appointment or run a symptom checker can disclose PHI, because the reason for the visit is individually identifiable health information.
• Cookie banners do not fix this. OCR states that banners asking users to accept or reject tracking technologies 'do not constitute a valid HIPAA authorization.'
• A vendor promising to strip PHI on their end does not fix it either. OCR says it is 'insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information.'
• OCR states it is prioritizing HIPAA Security Rule compliance in its tracking-technology investigations — meaning your risk analysis had better name your tags.

The downside is not a stern letter. Under the bulletin, an impermissible disclosure to a tracking vendor with no BAA and no Privacy Rule permission is presumed to be a breach of unsecured PHI unless you can demonstrate a low probability that the PHI was compromised. That means individual notification, notice to the Secretary, and media notice once it is large enough. Our healthcare SEO playbook covers the rest of the compliance surface; this page owns the tags.

Which marketing tools will sign a BAA, and which never will?

Google and Meta will not sign a BAA for their analytics and advertising products, and no plan tier, spend level or account manager changes that. Call-tracking and customer-data platforms built for healthcare will.

Meta's position is the blunt one. Its Business Tools Terms, effective November 3, 2025, require you to represent and warrant that you will not share data with Meta that 'includes or is based on, directly or otherwise, health information' — and add that your event, conversion and custom-audience names 'must not reflect, imply or be based on' that information either. An event named rehab_admit breaks that clause on its own.

The verdict: there is no configuration of GA4 or the Meta pixel that makes them HIPAA-compliant on a page where PHI can appear. You either keep those tags entirely off HIPAA-covered pages, or you put a BAA-signing platform in between that de-identifies events before Google or Meta ever see them. Vendors like Freshpaint sell exactly that middle layer — and their own writeup of the BAA problem is worth reading, with the obvious caveat that they are selling the fix. Anyone offering you a third option is selling you a breach.

Can you run Google Ads conversion tracking on a healthcare site?

Yes — but only if the conversion signal that reaches Google carries no PHI at all. The Google Ads tag is not on Google's BAA-covered product list, so it must never fire with an identifier attached to health information. That constraint is workable, and it is mostly about what you strip out:

• Fire conversions from a generic thank-you page. /thank-you, never /thank-you?service=iop&insurance=aetna.
• Strip query strings and condition values out of page URLs and event parameters before any tag reads them.
• Never name a conversion after a condition, service line or treatment. Meta's terms forbid it explicitly; treat Google the same way.
• Turn off autocapture and enhanced-measurement features that scrape form fields you did not choose to send.
• Keep the tag off patient portals, symptom checkers, intake forms and anything behind a login.
• Do not assume enhanced conversions or CAPI solve this. They exist to send more identity, not less — hashed emails and phone numbers. On a page where the visit itself reveals why someone is there, that is the opposite of what you need, and Meta's terms already prohibit it.

Our full Meta Pixel and CAPI setup guide is the right build for a plumber or a roofer. On a HIPAA-covered site, it is the exact setup you cannot run unfiltered — the server-side layer has to be a BAA-signed platform, not a Meta endpoint you own.

What does a compliant measurement stack look like end to end?

It routes every tracking event through a vendor that has signed a BAA, de-identifies it there, and only then forwards a stripped signal to Google or Meta. OCR's bulletin describes this pattern directly: if a tracking vendor will not provide a BAA, a regulated entity can 'establish a BAA with another vendor, for example a Customer Data Platform vendor,' that de-identifies the tracking information and passes only de-identified data onward. Six layers, in order:

• The site. No third-party tags on authenticated pages, appointment forms, symptom checkers, or portal login and registration pages. This is a page-by-page decision, not a site-wide toggle.
• Collection. A BAA-signed healthcare CDP or privacy platform is the only thing that receives raw events. It sits in front of the ad platforms, not beside them.
• De-identification. Identifiers are irreversibly removed inside the BAA-covered platform before anything is forwarded anywhere.
• Destinations. Google Ads and Meta receive a de-identified conversion signal with no condition, service, insurance or reason-for-visit in the payload.
• Calls. Call tracking runs on a healthcare plan with a signed BAA. CallRail's healthcare plans start at $150/month, and its healthcare accounts are separate accounts that log users out every 30 minutes and restrict integrations that send PHI to third parties.
• The CRM or EHR. This is where real, identified outcomes live — and nothing from here is ever uploaded to an ad platform.

What breaks this stack in practice is never the pixel. It is the marketing coordinator adding a heatmap tool, a chat widget, a review-request script or a scheduling embed nine months later without asking whether that vendor signed anything. Put tag governance in writing — one named owner, one approval step — or your compliant stack has a 90-day shelf life.

How do you prove the ad spend works without leaking PHI?

You measure at the campaign level and reconcile inside your own systems. The number you defend to your board is cost per booked appointment, computed in your CRM or practice-management system — not a conversion count sitting inside a Google Ads dashboard you were never allowed to populate that way.

• Give each campaign its own tracking number through a BAA-signed call-tracking vendor, then match booked appointments back to the number in your PMS.
• Import offline conversions using de-identified IDs generated inside your BAA-covered platform, not hashed patient emails.
• Use geo holdouts and clean before-and-after windows to size channel impact when user-level attribution is off the table.
• Report on booked and kept appointments, not form fills. A form fill on a therapy site is not a patient.
• Ask one question of every new report: could we rebuild this if we deleted the pixel tomorrow? If the answer is no, your business case is built on a tag you are not allowed to have.

This is also why we do not sell 'HIPAA-safe tracking' as a line-item upsell. If you are a covered entity, the compliant measurement stack is the measurement stack. It goes in the base scope for mental health practices and for paid ads, because the alternative is a program that cannot be reported on without generating a breach notification.

What should your practice remove from its site this week?

Open your tag manager and your page source and list every third-party script — most practices find between six and fifteen. Anything that has not signed a BAA and can see a HIPAA-covered page comes off now; the rest gets a written decision this month.

• Meta pixel on any page with an appointment form, condition detail, symptom checker or portal login. Remove it.
• GA4 on authenticated pages and pages related to the provision of care. Remove or restrict, per Google's own instruction.
• Session replay and heatmap scripts anywhere a patient can type. Remove until a BAA exists.
• Chat widgets and scheduling embeds. Get the BAA or get a different vendor.
• Any call-tracking script not running on a healthcare plan with a signed BAA. Swap it.
• Reason-for-visit, service, insurance and condition values in URL query strings and event names. Strip them.
• A cookie banner being treated as consent for tracking. It is not a HIPAA authorization. Stop presenting it as one.

Then document what you removed and why. OCR says it is prioritizing Security Rule compliance in tracking-technology investigations, and a risk analysis that names your tracking technologies is the exact artifact an investigator will ask for. A screenshot of a clean tag manager is not a compliance program, but an undocumented one is not a defense either.

If an agency just handed your clinic a Google Ads pixel and called it HIPAA-compliant marketing, get a second opinion on the tags before you get one on the strategy. We build the measurement layer first for mental health and behavioral health practices — month-to-month, no lock-in, no ranking guarantees, and no conversion tracking that would embarrass you in a breach notification. Get my free audit.