HIPAA-Aware Conversion Tracking for Google Ads

Enhanced conversions

Google’s Customer data policies state that conversions related to sensitive categories can’t be used for measurement in enhanced conversions or store sales uploads. The sensitive categories explicitly include “health or medical information, like purchases of medical services, prescription drugs or medical devices.” Enhanced conversions work by sending hashed first-party data such as email addresses. For a medical practice’s patient conversions, leave the feature off.

Google Analytics

Google’s HIPAA and Google Analytics article says HIPAA-regulated entities must not use Google Analytics in any way that exposes PHI to Google, says Google “does not offer Business Associate Agreements in connection with this service,” and advises not to place Analytics tags on authenticated pages or on HIPAA-covered pages. It suggests working with your legal team to identify pages that don’t relate to the provision of healthcare services.

Audiences and Customer Match

Under Google’s Personalized advertising policy and its Health category page, ads promoting health products and services can’t use advertiser-curated audiences: remarketing lists, Customer Match, lookalikes, or audience expansion. Separately from HIPAA, this means uploading patient lists to Google for targeting isn’t an option for health-service ads.

Step 1: Map every conversion path

List every way a new patient converts: web forms, online booking, calls from ads, calls from the website, chat, and text. For each one, write down which systems touch the data and which vendors those systems send data to.

Step 2: Strip patient data from pages and tags

• No names, contact details, dates of birth, conditions, procedures, or appointment details in URLs or page titles on any page where tags fire.
• Turn off automatic form-field collection in ad and analytics tags on intake and booking forms.
• Remove ad and analytics tags from authenticated pages entirely.
• Use generic conversion action names (“Qualified lead,” “Appointment request”).

Step 3: Capture the click ID, not the patient

Store the Google click ID (GCLID) in a hidden form field or call-tracking record that goes only to your practice’s BAA-covered system (CRM, scheduling, or call platform). The click ID links a conversion to an ad click without telling Google who the patient is.

Step 4: Confirm conversions in a BAA-covered system

Have staff mark which leads became real new-patient appointments, inside the covered system. That also improves bidding, because Google optimizes toward booked appointments instead of every form fill.

Step 5: Import minimal offline conversions

Upload the click ID, a generic conversion name, a timestamp, and optionally a value through offline conversion import. Don’t include hashed emails or phone numbers (that’s enhanced conversions, which Google excludes for medical-service conversions). Google moved offline conversion and enhanced-conversions-for-leads uploads to its Data Manager API as of June 15, 2026, so check that older integrations still work.

Step 6: Consider server-side tagging

With server-side tagging, the browser sends events to a server container you control, which removes disallowed fields before forwarding anything to ad platforms. It reduces what third parties collect directly from the browser. It doesn’t make a setup compliant on its own. If the server or its host receives PHI, that host needs a BAA, and the forwarding rules still have to keep PHI away from vendors without one.