Web and product analytics
Website analytics for healthcare practices and HIPAA
The short answer
A HIPAA covered entity must not disclose protected health information to an analytics or ad vendor without a business associate agreement or the patient's authorisation, and Google says Google Analytics is not for use with PHI. HHS warned in 2022 that tracking tools on patient portals and appointment pages can disclose PHI; a federal court narrowed that guidance in 2024 for public pages, but authenticated pages and booking flows remain high risk. Measure with tools that sign a BAA, or keep tracking off pages where health information is collected.
Key takeaways
- Google says Google Analytics is not for use with protected health information and offers no BAA for it.
- Portals, booking and intake flows are the high-risk pages; keep standard analytics and ad pixels off them.
- The 2024 AHA v. Becerra ruling narrowed HHS guidance for public pages only.
On this page 6 sections
What changed and when
- December 2022: the HHS Office for Civil Rights published a bulletin on online tracking technologies, saying tracking on authenticated pages (patient portals) and many unauthenticated pages (such as appointment and symptom pages) could disclose PHI to vendors.
- March 2024: HHS revised the bulletin.
- June 2024: in American Hospital Association v. Becerra, a federal court in Texas vacated the part of the guidance that treated an IP address plus a visit to a public page about a health condition as PHI. The rest of HIPAA, including its rules on portals and on forms that collect health information, still applies.
- 2023: the FTC brought its first actions under the Health Breach Notification Rule and the FTC Act against GoodRx and BetterHelp over sharing health data with advertising platforms. That rule covers health apps and services outside HIPAA.
Where the risk sits on a practice website
| Page or flow | Risk with standard analytics and ad pixels |
|---|---|
| Patient portal (logged in) | High: anything identifiable here is PHI |
| Appointment booking and intake forms | High: names, contact details and reasons for visit |
| Symptom checkers and condition-specific forms | High |
| Public pages about services and conditions | Lower after the 2024 ruling, but state health privacy laws (for example Washington's My Health My Data Act) may still apply |
| Home, about, locations, careers | Low |
Practical options
- Map every tag and pixel on the site and which pages it runs on. Agencies often add ad pixels sitewide by default.
- Remove ad pixels and standard GA4 from the portal, booking and intake flows. Count a completed booking with a server-side event that carries no health information.
- Where you need measurement on sensitive flows, use a vendor that signs a business associate agreement and configure it to collect only what you need.
- Strip query strings that carry appointment types or names from URLs before any analytics tool sees them.
- For calls, use a call tracking vendor that offers a HIPAA-eligible plan and a BAA, and decide whether recordings are needed at all.
- Document the review. Regulators ask what you knew and what you did.
Call tracking in healthcare
Calls are how most patients book, so attribution matters. Some call tracking platforms offer HIPAA-eligible plans with a BAA, and limit or switch off features such as transcription. Ask for the BAA before you send a single call through the platform, and check which features it covers.
Questions
- Is Google Analytics HIPAA compliant?
- Google states that Google Analytics should not be used with protected health information and does not sign business associate agreements for it. A covered entity should keep GA off pages where PHI is collected or displayed.
- Did the 2024 court ruling end the HHS tracking guidance?
- Only part of it. In June 2024 a federal court vacated the guidance's treatment of an IP address plus a visit to a public health-related page as PHI. Rules for patient portals, booking flows and forms that collect health information still apply.
- Can a dental or medical practice use call tracking?
- Yes, with a vendor that signs a business associate agreement and a plan configured for HIPAA. Confirm which features (recording, transcription, AI analysis) the agreement covers before turning them on.
Sources
Next step
Explore web analytics
Related guides
Google Consent Mode v2 explained: basic vs advanced
What Consent Mode v2 is, the four consent signals, basic versus advanced mode, when it is required, and what modelled data can and cannot recover.
Server-side tagging for GA4: is it worth it?
How server-side Google Tag Manager works, what it improves (control, cookie life, page speed), what it does not change (consent), and what it costs to run.
Call tracking explained: how it works and who needs it
What call tracking is, how dynamic number insertion works, which businesses benefit, and what to check before you buy a platform.
GA4 alternatives: when to switch and what to switch to
Plausible, Matomo, Fathom, PostHog and Mixpanel compared with Google Analytics 4 by the job each one does, with honest reasons to stay on GA4.