Remarketing for healthcare without exposing PHI
A remarketing list built from a page about a condition implies that condition for everyone on it. That is a disclosure by inference under HIPAA and a breach of Google's own personalised advertising policy independently of it. Site-wide audiences are usually fine; condition-level ones are not.
The short answer
To run Google Ads for healthcare advertisers building audiences, optimize toward a compliant audience that still performs — recorded in your Google Ads audience manager and your tag inventory — rather than toward form fills or booked appointments. Compliance audits keep finding the same thing: practices using audience features that quietly encode health status. The costliest mistake is assuming an audience is anonymous because it contains no names. Everything below is the build order, in the sequence you would actually work through it.
Written by Ariful Islam — eight years building Google Ads accounts and the conversion tracking underneath them.
Specific to Remarketing
Healthcare remarketing that does not encode a patient's condition
Healthcare remarketing is workable only from neutral pages. Build audiences from your homepage, location and insurance pages through a first-party server that strips page paths, never from condition or treatment pages, and skip patient-list uploads unless counsel approves. Then judge the remarketing campaign on attended appointments imported from the practice system, not on view-through conversions.
Audiences that encode health status arrive from places nobody thinks of as remarketing. The default Google Ads tag builds an all-visitors list that includes the bariatric page. GA4 links push predictive and page-path audiences into Google Ads automatically. A Performance Max audience signal gets a patient list uploaded to "help the algorithm". YouTube engagement lists collect viewers of a condition explainer video. Each one tells Google that a specific browser or email read about a specific condition, and Google's own personalized advertising policy restricts health-based targeting, separate from anything HIPAA says.
Shape audiences around the visit, not the condition. Allow list membership only from pages a patient of any service would see: the homepage, location pages, provider bios, insurance accepted and new-patient forms that do not name a reason for visit. Send that membership from a server-side container that replaces the full URL with a generic page category. Use those lists for bid adjustments in observation mode on Search, where they still help, rather than for display remarketing creative that follows people around. Value a remarketing conversion like any other attended appointment, not higher.
The specific trap is suppression lists. Uploading your patient list to exclude current patients sounds harmless, but the upload itself tells Google who your patients are, and a list built from a single service line describes their condition. The same goes for GA4 audiences named after a treatment. Inventory every audience in the shared library, record its source tag and pages, and delete any built from condition URLs; from the practice management system, send back only attended-appointment conversions, so you can see whether neutral audiences still produce patients.
Search terms to start from
- hipaa compliant remarketing
- healthcare remarketing google ads
- can medical practices use retargeting
- remarketing phi risk
- customer match hipaa
- google ads health personalized advertising policy
- compliant retargeting for clinics
- ga4 audiences healthcare compliance
Negative keywords
- email remarketing
- remarketing jobs
- remarketing definition
- free
- course
- facebook retargeting ads examples
- remarketing agency salary
- template
Read this before step one
Google Ads does not fail on its own. It fails on top of three things that were already broken.
- 01
Conversion tracking that reports the truth
If Google is counting form fills rather than a compliant audience that still performs, every bid it makes is aimed at the wrong outcome. First-party, server-side, joined back to your own system — not a browser tag that a consent banner or a cookie policy can silence.
- 02
A landing page that answers the search
One page for every ad group means the page answers a general question when the search asked a specific one. Google scores that as poor landing page experience and charges you more per click for it.
- 03
The right campaign for the goal
Performance Max on a broken signal spends faster and explains less. Search first, on a conversion you trust, then expand — in that order, because the order is not a preference.
Get all three right and the playbook below compounds. Get the first one wrong and everything below is executed perfectly in the wrong direction — which is the single most expensive thing that happens in this channel.
Not sure which of the three is wrong on your account? Send it over and we will tell you what it is actually reporting.
Before building anything new
Most practices have audiences nobody remembers creating. Start with what exists, because that is what is running today.
- 01List every audience in the account and what URL rule built it.
- 02Flag any built from a page naming a condition, treatment or medication.
- 03Flag any customer list uploaded from a patient database.
- 04Pause the flagged ones now and review afterwards. The order matters.
The rule, not a vibe
Google prohibits building audiences on health status, and HIPAA prohibits disclosure of identifiers tied to health context. A URL that names a condition does both at once.
- 01A page path containing a condition name makes any list built from it sensitive.
- 02So does a conversion event fired only on a condition-specific action.
- 03So does an uploaded list of patients, however it is hashed.
- 04Site-wide and homepage audiences generally do not, because membership implies nothing.
What still works
Broad audiences lose some precision and keep most of the value, because intent in healthcare is carried more by the search than by the page.
- 01Build from the site as a whole rather than from clinical sections.
- 02Exclude condition pages from audience rules rather than targeting them.
- 03Use search intent — which is the query, not the person — to do the targeting work.
- 04Keep audiences large. Small lists are more identifying, not less.
Where it actually leaks
Audience rules are only half of it. The tag on a clinical page transmits the URL, and the URL is often the disclosure.
- 01Strip condition names from URL paths before anything is transmitted.
- 02Do the stripping server-side, not in the browser tag.
- 03Turn off Enhanced Conversions on clinical funnels pending legal review.
- 04Check what your call tracking and chat vendors push into Ads by default.
So it survives the next hire
This decision gets reversed by whoever inherits the account unless the reasoning is recorded somewhere they will find it.
- 01Document which audiences are prohibited and why, in the account itself.
- 02Add it to whatever agency brief or scope of work exists.
- 03Review quarterly — audiences accumulate.
- 04Give the compliance officer a copy so the answer is consistent.
When Google Ads is the wrong answer here
Three situations where running this playbook will lose money. Read them before you fund the account, not after.
- You have not launched yet and nothing is broken. Build it right the first time — this page describes repairs, and repairs are more expensive than construction.
- The question is legal rather than technical. This page explains the mechanism and what it implies; it is not legal advice and does not replace your counsel's sign-off.
- You are looking for a way around a rule rather than a way to comply with it. Circumventing a platform's systems costs the account permanently, and we will not help with it.
Questions this raises
- Can we remarket to people who abandoned our online booking form?
- Only if the booking form does not name a condition, service or reason for visit anywhere in the URL, page title or events, and the list is built server-side. If the form starts with "what are you being seen for", treat that list as health data and do not build it.
- Do Google's health targeting rules apply even if we are not a HIPAA covered entity?
- Yes. Google's personalized advertising policy restricts health-based targeting for all advertisers, so a cosmetic clinic or wellness brand can still have audiences disapproved. HIPAA is a separate federal question on top of that.
- Can healthcare advertisers use remarketing at all?
- Yes, with audiences that do not encode health status. A site-wide list is usually acceptable; a list built from a condition page is not.
- Does hashing an uploaded customer list make it compliant?
- No. Hashing protects the identifier in transit; it does not change the fact that the list is a set of patients and that membership discloses that.
- What about observation-mode audiences?
- Observation does not restrict who sees the ad, but the list still exists and still has the same membership. The policy question is the same.
- Is a cosmetic practice affected?
- Google's personalised advertising rules on health status apply regardless of whether you are a HIPAA covered entity. The HIPAA question is separate and turns on whether you bill electronically.
- Will broad audiences perform worse?
- Somewhat, and less than people expect. In healthcare the search query carries most of the intent; the audience was adding less than it appeared to.
Five problems we get called in to fix
Every one of these arrived as “the campaign has stopped working”. None of them were the campaign. If you recognize your own symptom here, the cause is probably the one sitting next to it.
The reported number and the real number stopped agreeing.
Nothing joins the ad click to your Google Ads audience manager and your tag inventory, so the platform reports what it can see and nobody reconciles it.
Capture the click identifier at the form, store it against the record, send the outcome back when it is known.
Conversions collapsed and nothing in the account changed.
The tracking broke, not the campaign — a site update, a consent banner change, or a browser tightening cookie rules.
First-party server-side tagging, so measurement does not depend on a third-party cookie surviving, plus monitoring so the next break is an alert rather than a quarter.
Compliance asked a question nobody could answer in writing.
The tags were installed by whoever built the site, and no one has audited what leaves the page or where it goes.
An inventory of every tag on every clinical page, then a server-side container that redacts before anything is forwarded.
So what should you actually do with this?
Three honest options. The first one is genuinely fine for a lot of businesses, and we would rather you picked it knowingly than drifted into it.
Run it yourself
Good if you have the hours and someone technical
- A build, then a weekly routine that never stops
- You end up understanding your own account, which is worth real money later
- The measurement step still needs a developer
- Your mistakes are paid for at auction prices while you learn
Hire a general agency
Good if you want it off your desk this month
- Fast to start, and most are competent at the campaign work
- Usually optimizes toward whatever is easy to count — the form fill, the booked call
- Reports come from the ad platform's own numbers
- The measurement problem stays yours, because it lives in your systems
Work with us
Good if the reporting has stopped matching reality
- We build the measurement first — first-party, server-side, joined back to your Google Ads audience manager and your tag inventory
- Then we run the account on a conversion we can both check
- Reporting is against your numbers, not the Google column
- Eight years of this, and the tracking and the media are the same team
We are not going to promise you a number. Anyone who quotes you a return before seeing what your account currently reports is guessing, and the guess is always flattering. What we will tell you, for free and before any of this becomes a conversation about money, is what your account is actually measuring today.
Or we run it for you
Eight years of Google Ads, on top of tracking that reports the truth.
Everything above is doable. Doing it every week for a year, while running the business it is meant to fill, is the part that does not fit.
Most agencies will run the campaign and take your word for what a conversion is. We build the measurement first — first-party, server-side, joined back to your Google Ads audience manager and your tag inventory — and then manage the account on a signal we can both trust. It is the same reason the playbook above starts with the conversion rather than the keywords.
- Account build or rebuild, structured the way this page describes
- Conversion tracking wired to your Google Ads audience manager and your tag inventory, not to form fills
- Server-side, first-party tagging so the signal survives the browser
- Landing pages that answer the ad, one per intent
- Monthly reporting against your own numbers, not the Google column
- The search terms report worked every week, not quarterly
The first conversation is a read of what your account is actually reporting. No deck, and nothing to sign to get it.
