# HIPAA-Aware Conversion Tracking for Google Ads

> How medical practices can measure Google Ads without sending patient data to ad platforms: what to avoid, offline imports, call tracking, and BAAs.

- URL: https://www.netembark.com/ppc/medical-practices/hipaa-conversion-tracking/
- Published: 2026-10-12
- Updated: 2026-10-13
- Author: Gary Pyatigorsky

---

/* ---- inner-page additions (.ne-page) ---- */ .ne-page{overflow-x:clip} .ne-page section.slight{background:#fff} .ne-page section.sice{background:#EEF5FB} .ne-page section.smid{background:#D6E6F5} .ne-page section.sdark{background:#44566B;color:#fff} .ne-page .sdark h2,.ne-page .sdark h3:not(.card h3):not(.ctitle){color:#fff} .ne-page .sdark .eyebrow{color:#BFDCF4} .ne-page .sdark .lead,.ne-page .sdark\>.wrap\>div\>p,.ne-page .sdark .split p{color:#E6EDF4} .ne-page .sdark .checks li{color:#F2F6FA} .ne-page .sdark .checks li:before{background:#7EB6E3;color:#3C3C3B} .ne-page .sdark .card{border-color:transparent} .ne-page .sdark .card h3{color:#3C3C3B} .ne-page .phero{min-height:560px;padding:96px 0 88px} .ne-page .phero .htext{max-width:820px} .ne-page .phero h1{font-size:clamp(34px,4.6vw,56px)} .ne-page .split.rev\>div:first-child{order:2} .ne-page .split .media img{border-radius:22px;box-shadow:0 24px 50px rgba(60,60,59,.18);aspect-ratio:4/3;object-fit:cover;width:100%} .ne-page .split p+p{margin-top:14px} .ne-page .split .lead+.checks{margin-top:22px} .ne-page .grid5.c2{grid-template-columns:repeat(2,1fr)} .ne-page .grid5.c4{grid-template-columns:repeat(4,1fr)} .ne-page .grid5.c5{grid-template-columns:repeat(5,1fr);gap:18px} .ne-page .grid5.c5 .card{padding:26px 20px} .ne-page .grid5.c5 .card h3{font-size:18px} .ne-page .imgband{background:linear-gradient(180deg,#44566B 0 50%,#fff 50% 100%);padding:0} .ne-page .imgband.flip{background:linear-gradient(180deg,#fff 0 50%,#44566B 50% 100%)} .ne-page .imgband.ice{background:linear-gradient(180deg,#EEF5FB 0 50%,#fff 50% 100%)} .ne-page .imgband figure{position:relative;border-radius:24px;overflow:hidden;box-shadow:0 30px 60px rgba(60,60,59,.22);background:#EEF5FB} .ne-page .imgband img{width:100%;height:clamp(220px,32vw,420px);object-fit:cover} .ne-page .imgband figcaption{position:absolute;left:20px;bottom:20px;right:20px;max-width:560px;background:rgba(60,60,59,.82);color:#fff;font-weight:600;font-size:15px;padding:12px 18px;border-radius:12px} .ne-page .vsec .yt{position:relative;max-width:880px;margin:36px auto 0;aspect-ratio:16/9;border-radius:22px;overflow:hidden;background:#3C3C3B;box-shadow:0 30px 60px rgba(60,60,59,.22);cursor:pointer} .ne-page .vsec .yt img{width:100%;height:100%;object-fit:cover;opacity:.9} .ne-page .vsec .yt iframe{position:absolute;inset:0;width:100%;height:100%;border:0} .ne-page .ytplay{position:absolute;left:50%;top:50%;transform:translate(-50%,-50%);width:88px;height:62px;background:none;border:0;cursor:pointer;transition:transform .2s} .ne-page .yt:hover .ytplay{transform:translate(-50%,-50%) scale(1.08)} .ne-page .ytplay svg{width:100%;height:100%} .ne-page .vnote{margin-top:16px;font-size:15px} .ne-page .vnote a{color:#2F7BBD;font-weight:600} .ne-page .journey{list-style:none;position:relative;margin-top:28px;display:grid;gap:14px} .ne-page .journey li{display:grid;grid-template-columns:44px 1fr;column-gap:14px;align-items:center;background:#fff;border:1px solid #D5E5F3;border-radius:14px;padding:12px 16px;animation:jstep 6s infinite;animation-delay:calc(var(--i)*1.2s)} .ne-page .journey li small{grid-column:2;color:#55595E;font-size:14px;line-height:1.4} .ne-page .journey li b{font-family:Montserrat,sans-serif;color:#3C3C3B} .ne-page .adot{grid-row:span 2;width:40px;height:40px;border-radius:50%;background:#EEF5FB;color:#2F7BBD;font:800 16px Montserrat,sans-serif;display:grid;place-items:center;border:2px solid #7EB6E3} @keyframes jstep{0%,100%{box-shadow:none;border-color:#D5E5F3}8%,18%{box-shadow:0 10px 26px rgba(47,123,189,.22);border-color:#2F7BBD}} .ne-page .journey .pulse{display:none} .ne-page .aframe{background:#fff;border-radius:22px;box-shadow:0 24px 50px rgba(60,60,59,.14);padding:18px 22px 22px;position:relative;overflow:hidden} .ne-page .abar{display:flex;gap:6px;margin-bottom:16px} .ne-page .abar span{width:11px;height:11px;border-radius:50%;background:#D5E5F3} .ne-page .abar span:first-child{background:#FBBC04} .ne-page .abars{height:240px;display:flex;align-items:flex-end;gap:4%;padding:0 4px;border-bottom:2px solid #E3EAF3} .ne-page .abars i{flex:1;height:calc(var(--h)*1%);background:linear-gradient(180deg,#7EB6E3,#2F7BBD);border-radius:8px 8px 0 0;transform-origin:bottom;animation:agrow 4.8s ease-in-out infinite;animation-delay:var(--d)} @keyframes agrow{0%{transform:scaleY(.15)}35%,80%{transform:scaleY(1)}100%{transform:scaleY(.15)}} .ne-page .aline{position:absolute;left:22px;right:22px;top:46px;height:220px;pointer-events:none} .ne-page .aline svg{width:100%;height:100%} .ne-page .aline path{fill:none;stroke:#FBBC04;stroke-width:4;stroke-linecap:round;stroke-dasharray:420;stroke-dashoffset:420;animation:adraw 4.8s ease-in-out infinite;vector-effect:non-scaling-stroke} @keyframes adraw{0%{stroke-dashoffset:420}40%,85%{stroke-dashoffset:0}100%{stroke-dashoffset:420}} .ne-page .acap{font-size:12px;color:#55595E;margin-top:10px;text-align:right} .ne-page .kpis.k4{grid-template-columns:repeat(4,1fr)} .ne-page .vlinks{margin-top:28px;display:flex;gap:12px 28px;justify-content:center;flex-wrap:wrap} .ne-page .vlinks a{color:#fff;font-weight:700;border-bottom:2px solid #7EB6E3} .ne-page .quotes.qn2{grid-template-columns:repeat(2,1fr);max-width:900px;margin-left:auto;margin-right:auto} .ne-page .quotes.qn1{grid-template-columns:1fr;max-width:640px;margin-left:auto;margin-right:auto} .ne-page .rv .rating .stars{letter-spacing:1px} .ne-page .faqs.sice{background:#EEF5FB} .ne-page .faqs.sice .faq{background:#fff} .ne-page .partners-sec .badges{margin-top:28px} .ne-page .chips{list-style:none;display:flex;flex-wrap:wrap;gap:10px;margin:22px 0 28px} .ne-page .chips li{border:1px solid #C3D7EA;background:#fff;border-radius:999px;padding:7px 16px;font-weight:600;font-size:14px;color:#3C3C3B} .ne-page .sdark .chips li{background:transparent;border-color:rgba(255,255,255,.4);color:#fff} .ne-page .terms{display:grid;grid-template-columns:repeat(3,1fr);gap:20px;margin-top:36px;text-align:left} .ne-page .term{background:#fff;border-radius:18px;padding:26px;border:1px solid #C3D7EA} .ne-page .term b{display:block;font:800 28px Montserrat,sans-serif;color:#2F7BBD;margin-bottom:6px} .ne-page .term p{color:#3F4A56;font-size:16px} .ne-page .roadmap{display:grid;grid-template-columns:repeat(4,1fr);gap:20px;margin-top:44px;text-align:left;counter-reset:r} .ne-page .rphase{background:#fff;border:1px solid #E3EAF3;border-top:5px solid #7EB6E3;border-radius:18px;padding:26px 22px} .ne-page .rphase:nth-child(4){border-top-color:#FBBC04} .ne-page .rphase .when{font-size:12px;letter-spacing:.12em;text-transform:uppercase;font-weight:800;color:#2F7BBD} .ne-page .rphase h3{font-size:19px;margin:6px 0 10px} .ne-page .rphase ul{padding-left:18px;color:#55595E;font-size:15px} .ne-page .rphase li{margin-bottom:6px} .ne-page .partner-note{margin-top:22px;padding:18px 20px;border-left:4px solid #FBBC04;background:rgba(255,255,255,.7);border-radius:10px;font-size:16px;color:#3C3C3B} .ne-page .cgrid{display:grid;grid-template-columns:1.25fr .9fr;gap:40px;align-items:start} .ne-page .cform{background:#fff;border:1px solid #E3EAF3;border-radius:22px;padding:32px;box-shadow:0 24px 50px rgba(60,60,59,.1)} .ne-page .cform h2{font-size:28px} .ne-page .cform .fgrid2{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin:18px 0} .ne-page .cform .fld{display:flex;flex-direction:column;gap:6px} .ne-page .cform .full{grid-column:1/-1} .ne-page .cform label{font-weight:600;font-size:14px;color:#3C3C3B} .ne-page .cform input,.ne-page .cform textarea{font:16px Inter,sans-serif;padding:12px 14px;border:1px solid #C9D6E3;border-radius:10px;width:100%;background:#fff} .ne-page .cform input:focus,.ne-page .cform textarea:focus{outline:3px solid #7EB6E3;border-color:#2F7BBD} .ne-page .cform textarea{min-height:120px;resize:vertical} .ne-page .cform .btn-submit{width:100%;font-size:17px;padding:16px} .ne-page .cform .small{font-size:13.5px;color:#55595E;margin-top:10px} .ne-page .cinfo{display:grid;gap:16px} .ne-page .ci{background:#fff;border:1px solid #C3D7EA;border-radius:18px;padding:22px 24px;display:flex;gap:16px;align-items:flex-start} .ne-page .ci .icon{flex:none;width:48px;height:48px;margin:0} .ne-page .ci .icon svg{width:22px;height:22px} .ne-page .ci b{display:block;font-family:Montserrat,sans-serif;color:#3C3C3B} .ne-page .ci a{color:#2F7BBD;font-weight:700;font-size:18px} .ne-page .ci p{color:#55595E;font-size:15px} .ne-page .mnav{display:none} .ne-page .mnav:not(\[hidden\]){display:flex;flex-direction:column;gap:4px;padding:10px 24px 20px;background:#fff;border-top:1px solid #E3EAF3} .ne-page .mnav a{padding:10px 0;font-weight:600;border-bottom:1px solid #EEF2F6} .ne-page .mnav a.btn{border:0;margin-top:10px;text-align:center} .ne-page .burger{cursor:pointer;color:#3C3C3B} @media(min-width:981px){.ne-page .mnav{display:none!important}} @media(max-width:1100px){.ne-page .grid5.c5{grid-template-columns:repeat(3,1fr)}.ne-page .roadmap{grid-template-columns:1fr 1fr}} @media(max-width:980px){.ne-page .grid5.c4,.ne-page .kpis.k4{grid-template-columns:1fr 1fr}.ne-page .split.rev\>div:first-child{order:0}.ne-page .cgrid{grid-template-columns:1fr}.ne-page .terms{grid-template-columns:1fr}.ne-page .quotes.qn2{grid-template-columns:1fr}} @media(max-width:600px){.ne-page .phero{min-height:auto;padding:56px 0 48px}.ne-page .grid5.c2,.ne-page .grid5.c4,.ne-page .grid5.c5,.ne-page .roadmap{grid-template-columns:1fr}.ne-page .cform{padding:22px}.ne-page .cform .fgrid2{grid-template-columns:1fr}.ne-page .abars{height:180px}.ne-page .aline{height:160px}.ne-page .imgband figcaption{position:static;border-radius:0;max-width:none}.ne-page .kpis.k4{grid-template-columns:1fr 1fr}} @media(prefers-reduced-motion:reduce){.ne-page .journey li,.ne-page .abars i,.ne-page .aline path{animation:none}.ne-page .aline path{stroke-dashoffset:0}} .ne-page .cbadges{display:flex;align-items:center;gap:14px;flex-wrap:wrap;margin:0 0 26px} .ne-page .cbadges img{height:72px;width:auto;border-radius:10px} .ne-page .cbadges img.mlogo{height:30px} .ne-page .sdark .wcard h3{color:#3C3C3B} .ne-page .imgband.graphic img{object-fit:contain;height:auto;max-height:440px;background:#EEF5FB} .ne-page .imgband.graphic figcaption{position:static;max-width:none;border-radius:0;text-align:center;background:#3C3C3B} .ne-page .sdark .card .checks li{color:#3C3C3B} .ne-page .sdark .card .checks li:before{background:#2F7BBD;color:#fff} .ne-page .sdark .card p{color:#55595E} .ne-page .phero .hbg{position:absolute;inset:0;width:100%;height:100%;object-fit:cover;z-index:0} .ne-page a.btn\[href="/contact-us/"\],.ne-page .band a.btn\[href="/contact-us/"\]{background:#FBBC04;color:#3C3C3B;border:0;font-weight:800} .ne-page a.btn\[href="/contact-us/"\]:hover{background:#E0A800;color:#3C3C3B} .ne-page .casetabs{flex-wrap:wrap;justify-content:center;border-radius:22px;max-width:100%} .ne-page .gform_wrapper{margin:18px 0 0} .ne-page .gform_wrapper .gfield{margin-bottom:14px} .ne-page .gform_wrapper .gfield_label,.ne-page .gform_wrapper label{font:600 14px Inter,sans-serif;color:#3C3C3B;margin-bottom:6px;display:block} .ne-page .gform_wrapper input:not(\[type=submit\]):not(\[type=checkbox\]):not(\[type=radio\]),.ne-page .gform_wrapper textarea,.ne-page .gform_wrapper select{font:16px Inter,sans-serif;padding:12px 14px!important;border:1px solid #C9D6E3!important;border-radius:10px!important;width:100%!important;background:#fff;box-shadow:none} .ne-page .gform_wrapper input:focus,.ne-page .gform_wrapper textarea:focus{outline:3px solid #7EB6E3;border-color:#2F7BBD!important} .ne-page .gform_wrapper .gform_footer input\[type=submit\],.ne-page .gform_wrapper .gform_footer button,.ne-page .gform_wrapper .gform_button{width:100%;background:#FBBC04!important;color:#3C3C3B!important;border:0!important;border-radius:999px!important;padding:16px!important;font:800 17px Inter,sans-serif!important;cursor:pointer} .ne-page .gform_wrapper .gform_button:hover{background:#E0A800!important} .ne-page .gform_wrapper .gfield_required{color:#2F7BBD} .ne-page .gform_wrapper .validation_message{color:#B3261E;font-size:14px}

@media(max-width:700px){.ne-page .plist{display:flex !important;flex-direction:column !important;align-items:flex-start !important;justify-content:flex-start !important;width:max-content;max-width:100%;margin-left:auto !important;margin-right:auto !important;gap:18px}.ne-page .plist li{justify-content:flex-start !important;width:100%;margin:0 !important}.ne-page .plist .pmark{width:32px;flex:0 0 32px;display:inline-flex;justify-content:center}} .ne-page header .logo img{height:62px !important}.ne-page header.shrink .logo img{height:46px !important}@media(max-width:700px){.ne-page header .logo img{height:50px !important}.ne-page header.shrink .logo img{height:42px !important}} .ne-page .sdark .step p,.ne-page .sdark .steps p,.ne-page .sdark \> .wrap \> p,.ne-page .sdark .center \> p{color:#E6EEF6 !important}.ne-page .sdark .step h3{color:#fff !important} .ne-page .wcard h3{color:#3C3C3B !important}.ne-page .sdark .partner-note,.ne-page .sdark .partner-note b{color:#E6EEF6 !important} /* medical pages */ .ne-page .wrap.narrow2{max-width:920px;margin-left:auto!important;margin-right:auto!important} .ne-page .msec h2{margin-bottom:18px} .ne-page .mbody p,.ne-page .mtext p{margin:0 0 14px} .ne-page .mbody h3,.ne-page .mtext h3{margin:22px 0 8px} .ne-page .mbody .checks,.ne-page .mtext .checks{margin:6px 0 18px} .ne-page .mcards{display:grid;grid-template-columns:repeat(auto-fit,minmax(300px,1fr));gap:22px;margin-top:26px} .ne-page .mcards .card{padding:28px 26px} .ne-page .mcards .card p,.ne-page .mcards .card li{font-size:15.5px;color:#55595E} .ne-page .mcards .card h3{font-size:19px;margin:0 0 10px} .ne-page .tscroll{overflow-x:auto;margin:10px 0 22px;-webkit-overflow-scrolling:touch} .ne-page .tscroll .mtable{min-width:520px} .ne-page .note.legal{background:#FFF8E1;border-left:4px solid #FBBC04;padding:12px 16px;border-radius:8px;color:#3C3C3B;font-size:14.5px} .ne-page .msec a:not(.btn),.ne-page .mtext a:not(.btn){color:#1F5F99;text-decoration:underline} @media(max-width:700px){.ne-page .mcards{grid-template-columns:1fr}.ne-page .mcards .card{padding:22px 18px}} .ne-page .mtable td{color:#3C3C3B}.ne-page .mtable td.good{color:#1F5F99}

.ne-page .burger{min-width:48px;min-height:48px;display:inline-flex;align-items:center;justify-content:center;padding:0;margin-right:-8px;color:#3C3C3B;cursor:pointer;touch-action:manipulation;-webkit-tap-highlight-color:transparent;position:relative;z-index:5}@media(min-width:981px){.ne-page .burger{display:none!important}} /* Brands we've worked with: original client logo grid */ .ne-page .clogos{background:#fff;border-top:1px solid #E6ECF2} .ne-page .clogos .lead{margin-left:auto;margin-right:auto} .ne-page .lgrid{list-style:none;margin:36px 0 0;padding:0;display:grid;grid-template-columns:repeat(6,minmax(0,1fr));gap:14px} .ne-page .lgrid li{margin:0;padding:14px 12px;height:96px;display:flex;align-items:center;justify-content:center;background:#fff;border:1px solid #E6ECF2;border-radius:10px;transition:border-color .25s,box-shadow .25s} .ne-page .lgrid img{display:block;max-width:100%;max-height:64px;width:auto;height:auto;object-fit:contain;filter:grayscale(1);opacity:.72;transition:filter .3s,opacity .3s} .ne-page .lgrid li:hover{border-color:#C9D6E3;box-shadow:0 6px 18px rgba(31,95,153,.10)} .ne-page .lgrid li:hover img,.ne-page .lgrid li:focus-within img{filter:none;opacity:1} @media(hover:none){.ne-page .lgrid img{filter:none;opacity:1}} @media(max-width:1100px){.ne-page .lgrid{grid-template-columns:repeat(5,minmax(0,1fr))}} @media(max-width:700px){.ne-page .lgrid{grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-top:24px}.ne-page .lgrid li{height:72px;padding:8px 6px}.ne-page .lgrid img{max-height:48px}} .ne-page header a.btn\[href="/contact-us/"\]{white-space:nowrap !important}@media(max-width:600px){.ne-page header a.btn\[href="/contact-us/"\]{font-size:13px !important;padding:8px 14px !important;line-height:1.2 !important}}@media(max-width:360px){.ne-page header a.btn\[href="/contact-us/"\]{font-size:12px !important;padding:7px 11px !important}} @media(max-width:700px){.ne-page .lgrid{display:grid !important;grid-auto-flow:column !important;grid-template-rows:repeat(3,auto) !important;grid-template-columns:none !important;grid-auto-columns:31% !important;overflow-x:auto;scroll-snap-type:x mandatory;-webkit-overflow-scrolling:touch;gap:10px !important;padding-bottom:10px;scrollbar-width:thin}.ne-page .lgrid li{scroll-snap-align:start}}

/* ---- sticky header: phone + Book a call always visible (nav.py) ---- */ .ne-page header{position:fixed !important;top:0;left:0;right:0;width:100%;box-sizing:border-box;z-index:999 !important;background:#fff;transition:box-shadow .2s,padding .2s} .ne-page .topbar{display:none !important} /* fixed (not sticky): Betheme sets body{overflow-x:hidden} ul\>li{position:relative}} @media(min-width:981px) and (max-width:1280px){.ne-page header nav.mainnav ul{gap:14px;font-size:14px}.ne-page header .wrap{gap:14px}} @media(min-width:981px) and (max-width:1100px){.ne-page header nav.mainnav ul{gap:11px;font-size:13.5px}.ne-page header a.btn.hide-m{padding:10px 16px !important;font-size:14px !important}} .ne-page .hasdd{display:flex;align-items:center;gap:2px} .ne-page .ddbtn{background:none;border:0;padding:6px 4px;cursor:pointer;color:inherit;display:inline-flex;align-items:center;border-radius:4px} .ne-page .ddbtn .chev,.ne-page .maccbtn .chev{transition:transform .2s} .ne-page .hasdd.open .ddbtn .chev{transform:rotate(180deg)}.ne-page .hasdd.open\>.ddtop{color:#2F7BBD} .ne-page .ddpanel{position:absolute;top:100%;left:50%;transform:translate(-50%,8px);padding-top:16px;opacity:0;visibility:hidden;transition:opacity .18s,transform .18s,visibility 0s .18s;z-index:1000;white-space:normal} .ne-page .hasdd.open .ddpanel{opacity:1;visibility:visible;transform:translate(-50%,0);transition:opacity .18s,transform .18s} .ne-page .ddin{width:760px;min-height:430px;position:relative;background:#fff;border-radius:14px;box-shadow:0 18px 50px rgba(60,60,59,.18),0 2px 8px rgba(60,60,59,.08);border-top:4px solid #7EB6E3;padding:16px 0;text-align:left} .ne-page ul.ddlist{display:block !important;width:260px;list-style:none;margin:0;padding:0 0 0 12px;font-size:14.5px !important;border-right:1px solid #E3EAF3} .ne-page .ddlist\>li{display:block} .ne-page .ddindlink{display:flex !important;justify-content:space-between;align-items:center;padding:9px 14px;margin-right:12px;border-radius:8px;color:#3C3C3B !important;font-weight:600} .ne-page .ddarr{font-size:18px;color:#7EB6E3} .ne-page .ddind.act\>.ddindlink,.ne-page .ddindlink:hover,.ne-page .ddindlink:focus-visible{background:#EEF5FB;color:#2F7BBD !important} .ne-page .ddind.act .ddarr{color:#2F7BBD} .ne-page .ddsub{display:none;position:absolute;left:272px;right:0;top:16px;padding:6px 26px 10px} .ne-page .ddind.act\>.ddsub{display:block} .ne-page .ddsubhead{display:block;font-family:Montserrat,sans-serif;font-weight:800;font-size:16px;color:#2F7BBD !important;padding:4px 10px 10px;border-bottom:1px solid #E3EAF3;margin-bottom:8px} .ne-page .ddsub ul{display:grid !important;grid-template-columns:1fr 1fr;gap:2px 14px !important;list-style:none;margin:0;padding:0} .ne-page .ddsub ul a{display:block;padding:9px 10px;border-radius:8px;color:#3C3C3B;font-weight:500;font-size:14px} .ne-page .ddsub ul a:hover,.ne-page .ddsub ul a:focus-visible{background:#EEF5FB;color:#2F7BBD} .ne-page .ddallrow{margin-top:8px;padding:8px 14px 0;border-top:1px solid #E3EAF3;margin-right:12px} .ne-page .ddall{font-weight:700;font-size:14px;color:#2F7BBD !important} .ne-page .macc{border-bottom:1px solid #EEF2F6} .ne-page .maccbtn{width:100%;min-height:48px;display:flex;justify-content:space-between;align-items:center;background:none;border:0;padding:10px 0;font:inherit;font-weight:600;color:#3C3C3B;cursor:pointer;text-align:left} .ne-page .maccbtn\[aria-expanded="true"\]{color:#2F7BBD}.ne-page .maccbtn\[aria-expanded="true"\] .chev{transform:rotate(180deg)} .ne-page .macclist{display:flex;flex-direction:column;padding:0 0 8px 14px;border-left:3px solid #7EB6E3;margin:0 0 10px 2px} .ne-page .macclist\[hidden\]{display:none} .ne-page .mnav .macclist a{min-height:48px;display:flex;align-items:center;font-weight:500;font-size:15px;border-bottom:1px solid #F2F5F8} .ne-page .mnav a.btn{min-height:48px;display:flex !important;align-items:center;justify-content:center} .ne-page .mnav .macclist a.mall{font-weight:700;color:#2F7BBD;border-bottom:0} .ne-page .macc2{border-bottom:1px solid #F2F5F8} .ne-page .maccbtn2{font-size:15px;font-weight:600;padding:10px 4px 10px 0} .ne-page .macclist2{border-left-color:#2F7BBD;margin:0 0 6px 0;padding-left:12px} .ne-page .mnav .macclist2 a.mall{border-bottom:1px solid #F2F5F8} .ne-page .mnav .macclist2 a{font-size:14.5px}

[![Netembark](https://www.netembark.com/wp-content/uploads/2026/10/netembark-logo.png)](https://www.netembark.com/)

[(800) 707-2697](tel:+18007072697)
 [Book a call](https://www.netembark.com/contact-us/)

![](https://www.netembark.com/wp-content/uploads/2026/10/home-digital-marketing-analytics-1.webp)

Google Ads for medical practices · HIPAA-aware tracking

# HIPAA-Aware Conversion Tracking for Google Ads

This page is general information about advertising platform policies and privacy practices. It isn’t legal advice. Practices should confirm their HIPAA and state-law obligations with qualified healthcare counsel.

[Book a call](https://www.netembark.com/contact-us/)See case studies

Google Premier Partner 2023Month-to-monthSame-day reply

4.9Google rating

As featured in![Forbes](https://www.netembark.com/wp-content/uploads/2026/10/forbes-logo.svg)

[![Expertise.com Best Advertising Agencies in Newark](https://www.netembark.com/wp-content/uploads/2026/10/BestAgenciesNewark.jpg)](https://www.expertise.com/nj/newark/advertising-agencies)
 [![Google Premier Partner 2023](https://www.netembark.com/wp-content/uploads/2026/10/premier-badge-2023.svg)](https://www.google.com/partners/agency?id=5349039247)

![Facebook Certified Digital Marketing Associate](https://www.netembark.com/wp-content/uploads/2026/10/facebook-badge.png)

![Facebook Certified Creative Strategy Professional](https://www.netembark.com/wp-content/uploads/2026/10/facebook-certified-creative-strategy-professional.png)

HIPAA-aware tracking

## The short answer

- Design tracking so **protected health information (PHI) never reaches Google’s ad or analytics tools.** Google states it does not offer business associate agreements (BAAs) for Google Analytics.
- **Don’t use enhanced conversions for medical-service conversions.** Google’s own policy excludes them.
- **Keep clinical detail inside systems covered by a BAA.** Send Google only a click ID, a generic conversion name, and a timestamp.
- **Treat call recordings, chat transcripts, and booking widgets as PHI risks,** and confirm BAAs with those vendors.

[Book a call](https://www.netembark.com/contact-us/)

![Netembark team planning a medical practice Google Ads campaign](https://www.netembark.com/wp-content/uploads/2026/10/ppc-campaign-strategy-1.webp)

HIPAA-aware tracking

## Who this applies to

HIPAA applies to covered entities (most healthcare providers that bill health plans electronically, plus health plans and clearinghouses) and to their business associates (vendors that handle PHI on their behalf). Most physician practices are covered entities. Some cash-only businesses, such as certain med spas, may not be. Even when HIPAA doesn’t apply, state consumer health privacy laws, the FTC Act, and the ad platforms’ own policies still can. Whether HIPAA applies to your practice is a question for your counsel.

## Numbers Don’t Lie!

**$40M+**Google Ads spend managed

**18**years in business

**1,000+**happy customers

**1M+**conversions

**4.9★**Google rating

**Up to 6x**ROAS*

- Since 2009
- Fortune 5000 Company
- Top 1% of digital marketing agencies

[Book a call](https://www.netembark.com/contact-us/)

* Best result in an e-commerce Google Ads account; results vary by account. See case studies

HIPAA-aware tracking

## Where patient data leaks into ad platforms

These are the most common leak points we find in medical-practice tracking setups:

| Leak point | Example | Why it matters |
| --- | --- | --- |
| Page URLs | `/thank-you?name=jane&procedure=hernia-repair` | Ad and analytics tags read the full URL. |
| Page titles | “Appointment confirmed: bariatric consult” | Tags read page titles on conversion pages. |
| Form fields | Auto-detected email, phone, or symptom fields | Some tag features collect form data automatically. |
| Embedded widgets | Third-party scheduling, chat, or intake tools | They may load their own trackers inside your pages. |
| Call recordings and transcripts | Patient describing symptoms to the front desk | Recordings held by a vendor without a BAA. |
| Conversion names | “Diabetic foot ulcer consult” | Labels tied to a click ID can reveal health information. |
| Authenticated pages | Patient portal with ad or analytics tags | Logged-in pages are very likely to involve PHI. |

HIPAA-aware tracking

## What Google’s own policies say

### Enhanced conversions

Google’s [Customer data policies](https://support.google.com/adspolicy/answer/7475709) state that conversions related to sensitive categories can’t be used for measurement in enhanced conversions or store sales uploads. The sensitive categories explicitly include “health or medical information, like purchases of medical services, prescription drugs or medical devices.” Enhanced conversions work by sending hashed first-party data such as email addresses. For a medical practice’s patient conversions, leave the feature off.

### Google Analytics

Google’s [HIPAA and Google Analytics](https://support.google.com/analytics/answer/13297105) article says HIPAA-regulated entities must not use Google Analytics in any way that exposes PHI to Google, says Google “does not offer Business Associate Agreements in connection with this service,” and advises not to place Analytics tags on authenticated pages or on HIPAA-covered pages. It suggests working with your legal team to identify pages that don’t relate to the provision of healthcare services.

### Audiences and Customer Match

Under Google’s [Personalized advertising policy](https://support.google.com/adspolicy/answer/143465) and its [Health category page](https://support.google.com/adspolicy/answer/16701855), ads promoting health products and services can’t use advertiser-curated audiences: remarketing lists, Customer Match, lookalikes, or audience expansion. Separately from HIPAA, this means uploading patient lists to Google for targeting isn’t an option for health-service ads.

HIPAA-aware tracking

## What HHS says, and what the court changed

HHS’s Office for Civil Rights published a [bulletin on online tracking technologies](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html) in December 2022 and revised it in March 2024. On June 20, 2024, a federal court in Texas (*American Hospital Association v. Becerra*) vacated one part of it: the position that HIPAA is triggered when a tracking technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. HHS [withdrew its appeal](https://www.aha.org/news/headline/2024-08-29-hhs-will-not-appeal-aha-court-victory-online-tracking-case) in August 2024.

What that means in practice:

- **Vacated:** the “IP address + public health page” theory on its own.
- **Still in the bulletin:** guidance on tracking on authenticated pages (portals, apps), the need for HIPAA permissions and BAAs when PHI is disclosed to tracking vendors, and the point that cookie banners aren’t HIPAA authorizations. HHS’s page notes it is evaluating its next steps, so check it for updates.
- **Booking, intake, and confirmation flows** aren’t simply “public pages.” A conversion that shows a specific person requested an appointment with a specific provider is closer to the line. Treat it carefully.

[Book a call](https://www.netembark.com/contact-us/)

![Google Ads reporting dashboard showing booked appointments](https://www.netembark.com/wp-content/uploads/2026/10/ppc-roi-reporting-1.webp)

HIPAA-aware tracking

## A safer measurement setup

This is the general pattern we use. Your counsel should approve the specifics.

### Step 1: Map every conversion path

List every way a new patient converts: web forms, online booking, calls from ads, calls from the website, chat, and text. For each one, write down which systems touch the data and which vendors those systems send data to.

### Step 2: Strip patient data from pages and tags

- No names, contact details, dates of birth, conditions, procedures, or appointment details in URLs or page titles on any page where tags fire.
- Turn off automatic form-field collection in ad and analytics tags on intake and booking forms.
- Remove ad and analytics tags from authenticated pages entirely.
- Use generic conversion action names (“Qualified lead,” “Appointment request”).

### Step 3: Capture the click ID, not the patient

Store the Google click ID (GCLID) in a hidden form field or call-tracking record that goes **only** to your practice’s BAA-covered system (CRM, scheduling, or call platform). The click ID links a conversion to an ad click without telling Google who the patient is.

### Step 4: Confirm conversions in a BAA-covered system

Have staff mark which leads became real new-patient appointments, inside the covered system. That also improves bidding, because Google optimizes toward booked appointments instead of every form fill.

### Step 5: Import minimal offline conversions

Upload the click ID, a generic conversion name, a timestamp, and optionally a value through [offline conversion import](https://support.google.com/google-ads/answer/2998031). Don’t include hashed emails or phone numbers (that’s enhanced conversions, which Google excludes for medical-service conversions). Google moved offline conversion and enhanced-conversions-for-leads uploads to its Data Manager API as of June 15, 2026, so check that older integrations still work.

### Step 6: Consider server-side tagging

With server-side tagging, the browser sends events to a server container you control, which removes disallowed fields before forwarding anything to ad platforms. It reduces what third parties collect directly from the browser. It doesn’t make a setup compliant on its own. If the server or its host receives PHI, that host needs a BAA, and the forwarding rules still have to keep PHI away from vendors without one.

## Want patients from search, not just clicks?

Request a Google Ads audit. Book a free call with a Google Premier Partner team; we reply the same business day.

[Book a call](https://www.netembark.com/contact-us/)[(800) 707-2697](tel:+18007072697)

HIPAA-aware tracking

## Call tracking

Google Ads can [track phone call conversions](https://support.google.com/google-ads/answer/6100664) from call assets, Google forwarding numbers on your website, and mobile click-to-call. A minimum call length counts as a conversion. Third-party call tracking adds dynamic number insertion, recording, and call scoring.

- **Recordings and transcripts usually contain PHI.** If recording is on, the call-tracking vendor generally needs a BAA, access should be limited, and retention settings should be deliberate. Some practices turn recording off for new-patient lines.
- **AI call scoring and keyword spotting** should run inside the BAA-covered vendor. Only a generic outcome (“Appointment booked”) goes to Google via offline import.
- **Don’t send call details to Google** beyond what the call conversion feature itself uses.

[Book a call](https://www.netembark.com/contact-us/)

![Campaign analytics on a laptop](https://www.netembark.com/wp-content/uploads/2026/10/ppc-analytics-laptop-1.webp)

HIPAA-aware tracking

## Business associate agreements: who needs one

| Vendor type | Touches PHI? | BAA needed? |
| --- | --- | --- |
| Call tracking with recording/transcription | Usually yes | Generally yes |
| CRM / lead management storing patient inquiries | Usually yes | Generally yes |
| Online scheduling and intake tools | Yes | Generally yes |
| Live chat / text messaging | Often yes | Generally yes |
| Server-side tagging host | If it receives PHI | Yes, if it receives PHI |
| Marketing agency with access to any of the above | Depends on access | Yes, if it accesses PHI |
| Google Analytics | Must not receive PHI | Google states it does not offer a BAA for Analytics |
| Google Ads | Design so it receives no PHI | Don’t assume one is available; design around it |

HIPAA-aware tracking

## Audit checklist

*This page is general information about advertising platform policies and privacy practices. It isn’t legal advice. Practices should confirm their HIPAA and state-law obligations with qualified healthcare counsel.*

- Every conversion path mapped, with the vendors each one touches
- No PHI in URLs, page titles, or tag-readable form fields on any page with ad or analytics tags
- Automatic form-field collection disabled in tags on intake and booking forms
- No ad or analytics tags on patient portals or other authenticated pages
- Enhanced conversions off for patient conversions
- Conversion action names generic
- Click ID captured into a BAA-covered system. Confirmed appointments imported as minimal offline conversions.
- Call tracking vendor’s BAA confirmed. Recording and transcription settings deliberate.
- Embedded scheduling, chat, and intake widgets checked for their own trackers
- No remarketing lists, Customer Match, or lookalikes on health-service campaigns
- BAAs in place with every vendor that handles PHI
- Privacy policy describes data sharing for measurement (Google’s [Customer data policies](https://support.google.com/adspolicy/answer/7475709) require disclosure)
- Setup reviewed by counsel and re-checked whenever tags, vendors, or forms change

Netembark is a Google Premier Partner (2023) headquartered in Freehold, NJ, with additional offices serving clients in New York and Florida. [See our credentials](https://www.netembark.com/about-us/). See how we run [Google Ads for medical practices](https://www.netembark.com/ppc/medical-practices/).

Results · case studies

## Medical practice Google Ads results

Three Netembark medical lead-generation accounts. Pick a case study.

### Hudson Pro Ortho, Google Ads lead generation

One month vs. the prior month: more patient leads at a lower cost per lead, on less total spend.

**161**conversions (leads)*+14.2% vs prior month*

**$71.29**cost per conversion*down from $87.78*

**13.08%**conversion rate*+22.8% vs prior month*

| Metric | Current month | vs prior |
| --- | --- | --- |
| Impressions | 33,651 | -11.69% |
| Clicks | 1,231 | -7.02% |
| CTR | 3.66% | +5.28% |
| Cost | $11,477.12 | -7.27% |
| Avg. CPC | $9.32 | – |
| Conv. rate | 13.08% | +22.81% |
| Conversions | 161 | +14.18% |
| Cost / conv. | $71.29 | -18.79% |

Prior-month values are calculated from the reported % change.

### Avant Dermatology & Aesthetics, Google Ads lead generation

Patient leads for a dermatology and aesthetics practice at a low cost per conversion.

**182**conversions*September 2026*

**15.52%**conversion rate*all campaigns*

**$14.12**cost per conversion*all campaigns*

| Metric (Sep 1–30, 2026) | Value |
| --- | --- |
| Impressions | 21,012 |
| Clicks | 1,172 |
| Avg. CPC | $2.19 |
| Cost | $2,571.64 |
| Conversions | 182 |
| Phone conversions | 114 |
| Conv. rate | 15.52% |
| Cost / conv. | $14.12 |

Source: Netembark monthly Google Ads report, Key Insights (All Campaigns), September 2026.

### Noor Dermatology, Google Ads lead generation

Steady patient inquiries for a dermatology practice from Google Search.

**142**conversions*September 2026*

**7.23%**conversion rate*all campaigns*

**$22.74**cost per conversion*all campaigns*

| Metric (Sep 1–30, 2026) | Value |
| --- | --- |
| Impressions | 31,066 |
| Clicks | 1,964 |
| Avg. CPC | $1.64 |
| Cost | $3,229.16 |
| Conversions | 142 |
| Phone conversions | 86 |
| Conv. rate | 7.23% |
| Cost / conv. | $22.74 |

Source: Netembark monthly Google Ads report, Key Insights (All Campaigns), September 2026.

[Google Ads for medical practices →](https://www.netembark.com/ppc/medical-practices/) [PPC management →](https://www.netembark.com/ppc/)

Certifications & partnerships

## Work with a certified team

[![Google Premier Partner 2023](https://www.netembark.com/wp-content/uploads/2026/10/premier-badge-2023.svg)**Google Premier Partner**2023 · view verified profile](https://www.google.com/partners/agency?id=5349039247)

![Meta](https://www.netembark.com/wp-content/uploads/2026/10/meta-logo.svg)**Meta Business Partner**All 6 Meta certifications

![Microsoft Advertising](https://www.netembark.com/wp-content/uploads/2026/10/microsoft-advertising-logo.png)**Microsoft Advertising Partner**Bing search ads

- Featured in Forbes
- Expertise.com Best Advertising Agencies in Newark
- Fortune 5000 Company
- Top 1% of digital marketing agencies
- Since 2009

FAQ

## Frequently asked questions

Is Google Ads HIPAA compliant?

No ad platform makes a practice HIPAA compliant. What matters is how tracking is set up. Practices should design measurement so protected health information never reaches Google's ad or analytics tools: no patient details in URLs, page titles, or tag-readable form data, and no tags on patient portals. Confirmed appointments should be imported as minimal offline conversions. This is general information, not legal advice.

Can a medical practice use Google's enhanced conversions?

Not for medical-service conversions. Google's customer data policies say conversions related to sensitive categories can't be used for measurement in enhanced conversions, and the sensitive categories include health or medical information such as purchases of medical services. Offline conversion import using only the Google click ID is the usual alternative.

Can I use Google Analytics on a medical practice website?

Only in ways that don't expose protected health information to Google. Google says HIPAA-regulated entities must not use Google Analytics in a way that exposes PHI. It also says it does not offer business associate agreements for Analytics, and advises against placing Analytics tags on authenticated pages or HIPAA-covered pages. Work with counsel to decide which pages can carry tags.

What is offline conversion import, and why do healthcare advertisers use it?

Offline conversion import lets an advertiser tell Google Ads that a click later became a conversion, such as a booked appointment, by uploading the Google click ID, a conversion name, and a time. Healthcare advertisers use it so the clinical detail stays in their own BAA-covered systems while Google receives only a minimal signal.

Does a call tracking vendor need a BAA?

Generally yes, if the vendor records, transcribes, or stores calls for a HIPAA-covered practice, because those calls often contain protected health information. Confirm the BAA before turning on recording or transcription, limit access to recordings, and send Google only generic call outcomes.

What did the AHA v. Becerra decision change?

In June 2024 a federal court vacated one part of HHS's online tracking bulletin: the position that connecting a visitor's IP address with a visit to a public, unauthenticated page about health conditions or providers is enough on its own to trigger HIPAA. HHS dropped its appeal in August 2024. The rest of the bulletin remains, including guidance on authenticated pages and business associate agreements.

Is server-side tagging HIPAA compliant?

Server-side tagging is a tool, not a compliance status. It lets a practice-controlled server remove fields before data reaches ad platforms, which can reduce what third parties collect. If the server or hosting provider receives protected health information, it needs a business associate agreement, and the forwarding rules must still keep PHI away from vendors without one.

## Ready for more booked appointments?

Book a call with our medical Google Ads team. Paid ads are month to month, and we reply the same business day.

[Book a call](https://www.netembark.com/contact-us/)[(800) 707-2697](tel:+18007072697)

(function(){var R=document.querySelector('.ne-page');if(!R)return; R.querySelectorAll('.hasdd').forEach(function(li){var b=li.querySelector('.ddbtn'),t=null; function set(o){clearTimeout(t);li.classList.toggle('open',o);b.setAttribute('aria-expanded',o)} li.addEventListener('mouseenter',function(){if(matchMedia('(min-width:981px)').matches)set(true)}); li.addEventListener('mouseleave',function(){clearTimeout(t);t=setTimeout(function(){set(false)},250)}); b.addEventListener('click',function(e){e.preventDefault();set(!li.classList.contains('open'))}); li.addEventListener('focusin',function(){set(true)}); li.addEventListener('focusout',function(e){if(!li.contains(e.relatedTarget))set(false)}); li.addEventListener('keydown',function(e){if(e.key==='Escape'&&li.classList.contains('open')){set(false);li.querySelector('.ddtop').focus();e.stopPropagation()}});}); var H=R.querySelector('header');if(H){var ab=document.body.classList.contains('admin-bar'); var hh=function(){if(!H.classList.contains('shrink'))R.style.setProperty('--ne-hh',H.offsetHeight+'px')}; var f=function(){H.classList.toggle('shrink',scrollY\>40); var A=document.getElementById('wpadminbar');if(ab&&A){H.style.top=Math.max(0,Math.round(A.getBoundingClientRect().bottom))+'px'}else H.style.top=''}; addEventListener('scroll',f,{passive:true});addEventListener('resize',function(){f();hh()});hh();f();addEventListener('load',function(){hh();f()})} R.querySelectorAll('.ddind').forEach(function(r){function act(){r.parentNode.querySelectorAll('.ddind').forEach(function(x){x.classList.toggle('act',x===r)})} r.addEventListener('mouseenter',act);r.addEventListener('focusin',act)}); R.querySelectorAll('.maccbtn').forEach(function(b){var l=document.getElementById(b.getAttribute('aria-controls')); b.addEventListener('click',function(){var o=b.getAttribute('aria-expanded')!=='true';b.setAttribute('aria-expanded',o);l.hidden=!o})}); })();

---

Site index for agents: https://www.netembark.com/llms.txt