Is Google Ads HIPAA compliant? What you can and cannot send
Google does not sign a Business Associate Agreement for Google Ads, so no protected health information may reach it. That does not stop you advertising — it means the conversion you send back has to be stripped of anything that identifies a person alongside a health context, which is a build problem rather than a legal dead end.
- The auction
- The question arrives at practices in one of two ways: a compliance officer asks it before a campaign launches, or a lawyer asks it after a breach notification. The answer is the same either way and almost nobody has it written down, which is why most practices either stop advertising entirely or carry on and hope.
- The conversion
- an appointment attended, sent back without any identifying detail
- Source of truth
- your EHR or practice management system
- Costliest mistake
- Assuming a signed BAA exists because the platform is large. Google publishes no BAA for Google Ads. Sending a conversion that pairs an identifier with a health context is a disclosure, and it does not become one less because the tag fired automatically.
The short answer
To run Google Ads for healthcare advertisers subject to HIPAA, optimize toward an appointment attended, sent back without any identifying detail — recorded in your EHR or practice management system — rather than toward form fills or booked appointments. The question arrives at practices in one of two ways: a compliance officer asks it before a campaign launches, or a lawyer asks it after a breach notification. The costliest mistake is assuming a signed BAA exists because the platform is large. Everything below is the build order, in the sequence you would actually work through it.
Written by Ariful Islam — eight years building Google Ads accounts and the conversion tracking underneath them.
Read this before step one
Google Ads does not fail on its own. It fails on top of three things that were already broken.
- 01
Conversion tracking that reports the truth
If Google is counting form fills rather than an appointment attended, sent back without any identifying detail, every bid it makes is aimed at the wrong outcome. First-party, server-side, joined back to your own system — not a browser tag that a consent banner or a cookie policy can silence.
- 02
A landing page that answers the search
One page for every ad group means the page answers a general question when the search asked a specific one. Google scores that as poor landing page experience and charges you more per click for it.
- 03
The right campaign for the goal
Performance Max on a broken signal spends faster and explains less. Search first, on a conversion you trust, then expand — in that order, because the order is not a preference.
Get all three right and the playbook below compounds. Get the first one wrong and everything below is executed perfectly in the wrong direction — which is the single most expensive thing that happens in this channel.
Not sure which of the three is wrong on your account? Send it over and we will tell you what it is actually reporting.
The rule, not the folklore
HIPAA restricts disclosure of protected health information to third parties without a Business Associate Agreement. PHI is not just a name — it is any identifier tied to a health context. A cookie ID paired with a visit to a page about a condition is enough, which is the part most marketing teams have never been told.
- 01Confirm whether you are a covered entity or a business associate. Almost every clinical practice is.
- 02Ask your platform vendors, in writing, whether they will sign a BAA. Google will not for Ads.
- 03List every place a conversion currently leaves your systems.
- 04Assume the tag is a disclosure until you have proven it is not.
The BAA question, answered
Google offers a BAA for some Cloud products under specific configurations. It does not offer one for Google Ads or for standard Google Analytics. That is the whole basis of the answer, and it has not changed.
- 01Do not rely on a Cloud BAA to cover an Ads implementation. They are different products.
- 02Do not treat Consent Mode as a substitute for a BAA. It governs consent, not disclosure.
- 03Document the answer once so the next person who asks gets the same one.
The line, drawn precisely
An event that says a conversion happened, with no identifier and no health context, is not PHI. The same event carrying a click ID and a page path that names a condition is. The work is stripping the second into the first without losing the ability to optimise.
- 01Send the fact of the conversion, its value, and nothing else.
- 02Strip URL paths that name a condition before anything is transmitted.
- 03Never send email, phone, name or any hashed version of them from a health context.
- 04Do not enable Enhanced Conversions on a health funnel without a legal review.
Where the stripping actually happens
This cannot be fixed in the browser, because a browser tag transmits whatever is on the page before you get a say. A server-side container receives the event first, removes what must not leave, and forwards only what is allowed.
- 01Route conversions through your own first-party server endpoint.
- 02Redact in the container, not in the tag manager on the page.
- 03Log what was stripped, so the redaction can be audited later.
- 04Keep the raw event inside your own systems where it is already covered.
The 73% problem
Remarketing lists built from condition pages imply the condition of everyone on them. That is a disclosure by inference, and Google's own personalised advertising policy prohibits building audiences on health status independently of HIPAA.
- 01Do not build remarketing lists from condition-specific pages.
- 02Do not upload customer lists from a patient database.
- 03Broad site-wide audiences are usually acceptable; condition-level ones are not.
- 04Review every existing audience before you review anything else.
The channel everyone forgets
Calls are the main conversion in most practices and the least examined. A call tracking vendor that records, transcribes and stores a conversation about symptoms is holding PHI on your behalf.
- 01Get a BAA from your call tracking vendor or change vendor.
- 02Turn off recording and transcription unless the vendor is covered.
- 03Send the call event to Google without the transcript, the number, or the recording.
- 04Check what your vendor pushes into Ads by default — it is often more than you think.
The order that reduces risk fastest
Fix disclosure before you fix performance. An account that measures nothing is a marketing problem; an account that discloses is a legal one.
- 01Inventory every tag on every page that touches a clinical context.
- 02Disable Enhanced Conversions and condition-level audiences today, pending review.
- 03Stand up a server-side container and route conversions through it.
- 04Write the answer down and give it to whoever asks next.
When Google Ads is the wrong answer here
Three situations where running this playbook will lose money. Read them before you fund the account, not after.
- You have not launched yet and nothing is broken. Build it right the first time — this page describes repairs, and repairs are more expensive than construction.
- The question is legal rather than technical. This page explains the mechanism and what it implies; it is not legal advice and does not replace your counsel's sign-off.
- You are looking for a way around a rule rather than a way to comply with it. Circumventing a platform's systems costs the account permanently, and we will not help with it.
Questions this raises
- Does Google sign a BAA for Google Ads?
- No. Google publishes BAAs for certain Cloud products under specific configurations, not for Google Ads or standard Google Analytics. Any answer that says otherwise is describing a different product.
- Can we run Google Ads at all as a healthcare provider?
- Yes. Advertising is not the problem — transmitting protected health information is. The work is making sure the conversion you send back carries no identifier tied to a health context.
- Is Consent Mode enough?
- No. Consent Mode governs whether a user agreed to tracking. It does not govern whether a disclosure to a third party is permitted, and those are separate questions.
- What about hashed emails in Enhanced Conversions?
- Hashing is not de-identification under HIPAA when the context is clinical. Treat Enhanced Conversions on a health funnel as requiring legal sign-off, not as a default.
- Does this apply to a cosmetic practice?
- It depends on whether you are a covered entity, which usually turns on whether you bill insurance electronically. A purely cash-pay med spa may not be — but Google's own sensitive-category rules still apply.
Five problems we get called in to fix
Every one of these arrived as “the campaign has stopped working”. None of them were the campaign. If you recognize your own symptom here, the cause is probably the one sitting next to it.
The reported number and the real number stopped agreeing.
Nothing joins the ad click to your EHR or practice management system, so the platform reports what it can see and nobody reconciles it.
Capture the click identifier at the form, store it against the record, send the outcome back when it is known.
Conversions collapsed and nothing in the account changed.
The tracking broke, not the campaign — a site update, a consent banner change, or a browser tightening cookie rules.
First-party server-side tagging, so measurement does not depend on a third-party cookie surviving, plus monitoring so the next break is an alert rather than a quarter.
Compliance asked a question nobody could answer in writing.
The tags were installed by whoever built the site, and no one has audited what leaves the page or where it goes.
An inventory of every tag on every clinical page, then a server-side container that redacts before anything is forwarded.
So what should you actually do with this?
Three honest options. The first one is genuinely fine for a lot of businesses, and we would rather you picked it knowingly than drifted into it.
Run it yourself
Good if you have the hours and someone technical
- A build, then a weekly routine that never stops
- You end up understanding your own account, which is worth real money later
- The measurement step still needs a developer
- Your mistakes are paid for at auction prices while you learn
Hire a general agency
Good if you want it off your desk this month
- Fast to start, and most are competent at the campaign work
- Usually optimizes toward whatever is easy to count — the form fill, the booked call
- Reports come from the ad platform's own numbers
- The measurement problem stays yours, because it lives in your systems
Work with us
Good if the reporting has stopped matching reality
- We build the measurement first — first-party, server-side, joined back to your EHR or practice management system
- Then we run the account on a conversion we can both check
- Reporting is against your numbers, not the Google column
- Eight years of this, and the tracking and the media are the same team
We are not going to promise you a number. Anyone who quotes you a return before seeing what your account currently reports is guessing, and the guess is always flattering. What we will tell you, for free and before any of this becomes a conversation about money, is what your account is actually measuring today.
Or we run it for you
Eight years of Google Ads, on top of tracking that reports the truth.
Everything above is doable. Doing it every week for a year, while running the business it is meant to fill, is the part that does not fit.
Most agencies will run the campaign and take your word for what a conversion is. We build the measurement first — first-party, server-side, joined back to your EHR or practice management system — and then manage the account on a signal we can both trust. It is the same reason the playbook above starts with the conversion rather than the keywords.
- Account build or rebuild, structured the way this page describes
- Conversion tracking wired to your EHR or practice management system, not to form fills
- Server-side, first-party tagging so the signal survives the browser
- Landing pages that answer the ad, one per intent
- Monthly reporting against your own numbers, not the Google column
- The search terms report worked every week, not quarterly
The first conversation is a read of what your account is actually reporting. No deck, and nothing to sign to get it.
