Get your Healthcare tracking to 95%+ accuracy guaranteed in writing.
If you market a clinic, hospital service line, dental group, telehealth brand or behavioral health practice, the default tracking setup sends the ad platforms the page path, the referring condition page, and whatever it can scrape out of your intake form. I rebuild that so a server container you control decides, field by field, what leaves. The conversion still gets counted; the patient detail stays home.
Free30 minutesNo obligation
Healthcare · what breaks
What actually leaks on a healthcare site
- 01
The URL is the diagnosis
A path like /services/oncology/schedule tells Meta what care that visitor wants, and the browser pixel sends the full URL with a cookie and IP attached by default. Nobody chose that; it's just what the tag does.
- 02
Automatic matching scrapes your intake forms
Meta's automatic advanced matching and Google's automatic enhanced conversions read email and phone straight out of form fields you never mapped. On a patient intake form, that is identifiable data leaving on page load.
- 03
Marketing tags survive into the patient portal
A container added for the marketing site gets inherited by MyChart-style portals, confirmation screens and post-login pages, where every view is authenticated and tied to a real chart.
- 04
Events Manager quietly filters your data
Meta's sensitive-data filtering flags and removes events it reads as health-related. The conversions you actually wanted stop arriving, and the only notice sits in an Events Manager panel nobody opens.
Healthcare · the fix
What changes once the server container decides what leaves — Healthcare
One allow-list, every destination
Meta, Google, Microsoft and GA4 each receive exactly what the server container permits and nothing else. Adding a vendor next quarter doesn't reopen the question.
Generic event names, real values
Platforms get appointment_requested with a value band. They don't get the service line, the page path, the referrer, or the reason someone called.
Attended visits, not form fills
The conversion fires when the appointment is actually kept, taken from your scheduling or practice-management record. No-shows stop bidding up the campaigns that produced them.
A written record of what you send
Every outbound field is documented per event. When your privacy officer or an auditor asks what goes to Meta, the answer is a document instead of a guess.
Healthcare · architecture
Where the allow-list sits in a healthcare funnel
Ad click, service-line page, scheduling embed or call, booked appointment, attended visit. Every hop crosses a boundary, and the server container is the one place all of them can be inspected before anything leaves.
- 1
Patient-facing surfaces inventoried first
Every page, form, chat widget, scheduling embed and call widget is marked patient-facing or not before a single tag is changed.
- 2
The browser sends to your subdomain, not a vendor
A GTM server container on something like m.yourclinic.com receives events first, so no vendor sees a request that hasn't been filtered.
- 3
Redaction runs inside the container
Path reduced to a template, query string dropped, referrer cleared, IP truncated or withheld, automatic matching disabled on patient-facing forms.
- 4
The portal is a separate world
Authenticated pages get their own container and consent gate, so nobody drops a marketing tag behind the login six months from now by accident.
- 5
The scheduling system closes the loop offline
Epic Cadence, athenahealth, NextGen, eClinicalWorks or your PM system reports attended and no-show back through the container days later.
Healthcare · events
Generic events out, patient detail in — the field boundary — Healthcare
Each row lists what is permitted to leave, and the last row is the standing block list the container enforces on every event regardless of who asks.
| Event | Fires when | Parameters permitted | Sent from / role |
|---|---|---|---|
| page_view | Any patient-facing page renders | page_template only, consent state — no path, no referrer | Browser to server · reporting only |
| contact_started | A scheduling embed or contact form opens | gclid, event_id, location_group | Browser to server · reporting only |
| appointment_requested | A request or scheduling form submits | gclid, em (hashed, explicitly mapped), ph (hashed), value (band), event_id | Server · optimization (primary) |
| call_qualified | A tracked call connects and clears the duration threshold | gclid, ph (hashed), call_duration — no transcript, no reason for the call | Server · optimization (secondary) |
| appointment_scheduled | The scheduling system confirms a slot | gclid or hashed contact, value (band), currency, event_id | Server · reporting only |
| appointment_attended | The PM or scheduling record marks the visit arrived | gclid or hashed contact, value (band), currency, transaction_id | Server offline import · optimization by value |
| appointment_no_show | The visit is marked no-show or canceled | internal record id only | Held in your systems · never forwarded, reverses the value |
| BLOCKED — never leaves | Any event carrying clinical or identifying context | service line, condition or procedure name, full page path, referrer, query string, provider, MRN, insurance, intake free text, raw IP | Dropped in the container before every destination tag |
Healthcare · prove
Verified against the scheduling system, payload by payload — Healthcare
Two checks run every month. Does the conversion count match the care calendar, and does the outbound payload still contain only what was signed off.
Source of truth
Attended appointments in your scheduling or practice management system — Epic Cadence, athenahealth, NextGen, eClinicalWorks
- Export attended, no-show and canceled appointments for the month, with the attributed source where the record carries one.
- Match attended visits to a stored click ID or hashed contact, and report the unmatched share rather than smoothing it away.
- Compare attended counts to platform-reported conversions by conversion date; expect the platforms to report fewer.
- Capture the literal outbound HTTP payload for each event type and diff it against the signed-off allow-list.
- Re-scan patient-facing pages and the portal for tags added since the last check. The portal must still be at zero.
- Separate attribution differences from real loss, and hand the privacy lead the payload diff either way.
Healthcare · free audit
What we check in the free audit
- The URL is the diagnosis
- Automatic matching scrapes your intake forms
- Marketing tags survive into the patient portal
- Events Manager quietly filters your data
Checked against
Attended appointments in your scheduling or practice management system — Epic Cadence, athenahealth, NextGen, eClinicalWorks
Free30 minutesNo obligation
Healthcare · when not to buy
When a healthcare marketer shouldn't buy this
Four situations where the answer is no.
- You're not a covered entity or business associate. Many cash-pay wellness brands aren't, and a standard server-side build already covers you.
- Legal has already ruled that no third-party ad tags may run on patient-facing pages. Then don't run them, rather than engineering around it.
- Spend is a few hundred dollars a month. Disable automatic matching, pull the tags off the portal, and stop there.
- Nobody internally owns the field-level decisions. Without a privacy lead who can sign off, there's no allow-list to build against.
Healthcare · what we deliver
What a healthcare tracking build includes
Surface inventory: what fires where
Every page, form, chat widget, scheduling embed and call widget mapped to the tags currently on it, each one marked patient-facing or not.
First-party server container on your subdomain
A GTM server container on something like m.yourclinic.com, so browser events land on infrastructure you control before any vendor sees them.
Field-level redaction rules
Page paths reduced to templates, query strings dropped, referrer cleared, IP truncated or withheld. Written as container logic that runs on every event, not as a policy PDF.
Automatic matching turned off, deliberately
Automatic advanced matching and auto enhanced conversions disabled on patient-facing surfaces, replaced by explicit hashed fields you signed off on.
Portal and post-login tag isolation
A separate container and consent gate for authenticated pages, so nobody can drop a marketing tag onto the portal six months from now by accident.
Booking-to-visit reconciliation
Requested, scheduled, attended and no-show pulled from your scheduling or PM system and matched against what each platform recorded. That's the Source-of-Truth Reconciliation Method applied to a care calendar.
Written guarantee
95%+ tracking accuracy
Measured against Attended appointments in your scheduling or practice management system — Epic Cadence, athenahealth, NextGen, eClinicalWorks. Miss it and we keep working at no cost.
FAQ
Healthcare questions, answered
No tool is compliant by itself, and anyone selling you one is overselling. Compliance depends on what you send, who receives it, and what agreements exist. A server container helps because it is the single place where every field can be inspected and blocked before it leaves. This is practitioner guidance from someone who builds these setups, not legal advice — put the final field list in front of your privacy officer or counsel.
Not for their advertising products. So the working assumption has to be that anything sent to an ad platform is unprotected, and the entire design job is making sure nothing that identifies a person and reveals their care ever reaches one.
Not off condition-specific pages, and not off patient lists, if you're a covered entity. What usually survives is broad brand and general service-category audiences built from non-clinical pages, plus conversion optimization on generic, non-descriptive events.
It lowers it. We often land below the 8+ EMQ we guarantee on commercial ecommerce accounts, and on a covered entity that is the correct trade. What recovers most of the performance is sending fewer but truer events — attended appointments rather than every form touch — so the optimizer learns from real outcomes.
Then the browser can't close the loop, and that's fine. We store the click ID at first touch on your own site, take the confirmation from the vendor export, webhook or your PM system, and send the conversion server-side later with that ID attached.
We show you the actual HTTP payloads leaving the server container for each event type, and hand over a written field map. It's a check you can re-run yourself any time someone adds a tag.
If you're not a covered entity or business associate — plenty of med spas, gyms, supplement brands and cash-pay wellness practices aren't — HIPAA isn't your constraint. Washington's My Health My Data Act or CCPA sensitive-data rules may still be, but a standard server-side build covers you. And if you're spending a few hundred a month, just fix the obvious leaks and skip the rebuild.
More on Healthcare
- GuideHealthcare Marketing Tracking: What You Can (and Can't) Send to Ad Platforms
- Answering serviceGoogle Ads for healthcare answering and patient communication services: the buil…
- Healthcare Translation ServiceGoogle Ads for healthcare translation service: the build order
- CredentialingGoogle Ads for healthcare credentialing services: the build order
Free · 30 min
Find out what your site is sending right now
WhatsAppFree30 minutesNo obligation
