Remarketing for healthcare without exposing PHI
A remarketing list built from a page about a condition implies that condition for everyone on it. That is a disclosure by inference under HIPAA and a breach of Google's own personalised advertising policy independently of it. Site-wide audiences are usually fine; condition-level ones are not.
- The auction
- Compliance audits keep finding the same thing: practices using audience features that quietly encode health status. It is rarely deliberate. Someone builds a list from the page that converts best, and the page that converts best is the one about the condition.
- The conversion
- a compliant audience that still performs
- Source of truth
- your Google Ads audience manager and your tag inventory
- Costliest mistake
- Assuming an audience is anonymous because it contains no names. Membership itself is the disclosure — everyone on a list built from the oncology page is being described as someone who read the oncology page.
The short answer
To run Google Ads for healthcare advertisers building audiences, optimize toward a compliant audience that still performs — recorded in your Google Ads audience manager and your tag inventory — rather than toward form fills or booked appointments. Compliance audits keep finding the same thing: practices using audience features that quietly encode health status. The costliest mistake is assuming an audience is anonymous because it contains no names. Everything below is the build order, in the sequence you would actually work through it.
Written by Ariful Islam — eight years building Google Ads accounts and the conversion tracking underneath them.
Read this before step one
Google Ads does not fail on its own. It fails on top of three things that were already broken.
- 01
Conversion tracking that reports the truth
If Google is counting form fills rather than a compliant audience that still performs, every bid it makes is aimed at the wrong outcome. First-party, server-side, joined back to your own system — not a browser tag that a consent banner or a cookie policy can silence.
- 02
A landing page that answers the search
One page for every ad group means the page answers a general question when the search asked a specific one. Google scores that as poor landing page experience and charges you more per click for it.
- 03
The right campaign for the goal
Performance Max on a broken signal spends faster and explains less. Search first, on a conversion you trust, then expand — in that order, because the order is not a preference.
Get all three right and the playbook below compounds. Get the first one wrong and everything below is executed perfectly in the wrong direction — which is the single most expensive thing that happens in this channel.
Not sure which of the three is wrong on your account? Send it over and we will tell you what it is actually reporting.
Before building anything new
Most practices have audiences nobody remembers creating. Start with what exists, because that is what is running today.
- 01List every audience in the account and what URL rule built it.
- 02Flag any built from a page naming a condition, treatment or medication.
- 03Flag any customer list uploaded from a patient database.
- 04Pause the flagged ones now and review afterwards. The order matters.
The rule, not a vibe
Google prohibits building audiences on health status, and HIPAA prohibits disclosure of identifiers tied to health context. A URL that names a condition does both at once.
- 01A page path containing a condition name makes any list built from it sensitive.
- 02So does a conversion event fired only on a condition-specific action.
- 03So does an uploaded list of patients, however it is hashed.
- 04Site-wide and homepage audiences generally do not, because membership implies nothing.
What still works
Broad audiences lose some precision and keep most of the value, because intent in healthcare is carried more by the search than by the page.
- 01Build from the site as a whole rather than from clinical sections.
- 02Exclude condition pages from audience rules rather than targeting them.
- 03Use search intent — which is the query, not the person — to do the targeting work.
- 04Keep audiences large. Small lists are more identifying, not less.
Where it actually leaks
Audience rules are only half of it. The tag on a clinical page transmits the URL, and the URL is often the disclosure.
- 01Strip condition names from URL paths before anything is transmitted.
- 02Do the stripping server-side, not in the browser tag.
- 03Turn off Enhanced Conversions on clinical funnels pending legal review.
- 04Check what your call tracking and chat vendors push into Ads by default.
So it survives the next hire
This decision gets reversed by whoever inherits the account unless the reasoning is recorded somewhere they will find it.
- 01Document which audiences are prohibited and why, in the account itself.
- 02Add it to whatever agency brief or scope of work exists.
- 03Review quarterly — audiences accumulate.
- 04Give the compliance officer a copy so the answer is consistent.
When Google Ads is the wrong answer here
Three situations where running this playbook will lose money. Read them before you fund the account, not after.
- You have not launched yet and nothing is broken. Build it right the first time — this page describes repairs, and repairs are more expensive than construction.
- The question is legal rather than technical. This page explains the mechanism and what it implies; it is not legal advice and does not replace your counsel's sign-off.
- You are looking for a way around a rule rather than a way to comply with it. Circumventing a platform's systems costs the account permanently, and we will not help with it.
Questions this raises
- Can healthcare advertisers use remarketing at all?
- Yes, with audiences that do not encode health status. A site-wide list is usually acceptable; a list built from a condition page is not.
- Does hashing an uploaded customer list make it compliant?
- No. Hashing protects the identifier in transit; it does not change the fact that the list is a set of patients and that membership discloses that.
- What about observation-mode audiences?
- Observation does not restrict who sees the ad, but the list still exists and still has the same membership. The policy question is the same.
- Is a cosmetic practice affected?
- Google's personalised advertising rules on health status apply regardless of whether you are a HIPAA covered entity. The HIPAA question is separate and turns on whether you bill electronically.
- Will broad audiences perform worse?
- Somewhat, and less than people expect. In healthcare the search query carries most of the intent; the audience was adding less than it appeared to.
Five problems we get called in to fix
Every one of these arrived as “the campaign has stopped working”. None of them were the campaign. If you recognize your own symptom here, the cause is probably the one sitting next to it.
The reported number and the real number stopped agreeing.
Nothing joins the ad click to your Google Ads audience manager and your tag inventory, so the platform reports what it can see and nobody reconciles it.
Capture the click identifier at the form, store it against the record, send the outcome back when it is known.
Conversions collapsed and nothing in the account changed.
The tracking broke, not the campaign — a site update, a consent banner change, or a browser tightening cookie rules.
First-party server-side tagging, so measurement does not depend on a third-party cookie surviving, plus monitoring so the next break is an alert rather than a quarter.
Compliance asked a question nobody could answer in writing.
The tags were installed by whoever built the site, and no one has audited what leaves the page or where it goes.
An inventory of every tag on every clinical page, then a server-side container that redacts before anything is forwarded.
So what should you actually do with this?
Three honest options. The first one is genuinely fine for a lot of businesses, and we would rather you picked it knowingly than drifted into it.
Run it yourself
Good if you have the hours and someone technical
- A build, then a weekly routine that never stops
- You end up understanding your own account, which is worth real money later
- The measurement step still needs a developer
- Your mistakes are paid for at auction prices while you learn
Hire a general agency
Good if you want it off your desk this month
- Fast to start, and most are competent at the campaign work
- Usually optimizes toward whatever is easy to count — the form fill, the booked call
- Reports come from the ad platform's own numbers
- The measurement problem stays yours, because it lives in your systems
Work with us
Good if the reporting has stopped matching reality
- We build the measurement first — first-party, server-side, joined back to your Google Ads audience manager and your tag inventory
- Then we run the account on a conversion we can both check
- Reporting is against your numbers, not the Google column
- Eight years of this, and the tracking and the media are the same team
We are not going to promise you a number. Anyone who quotes you a return before seeing what your account currently reports is guessing, and the guess is always flattering. What we will tell you, for free and before any of this becomes a conversation about money, is what your account is actually measuring today.
Or we run it for you
Eight years of Google Ads, on top of tracking that reports the truth.
Everything above is doable. Doing it every week for a year, while running the business it is meant to fill, is the part that does not fit.
Most agencies will run the campaign and take your word for what a conversion is. We build the measurement first — first-party, server-side, joined back to your Google Ads audience manager and your tag inventory — and then manage the account on a signal we can both trust. It is the same reason the playbook above starts with the conversion rather than the keywords.
- Account build or rebuild, structured the way this page describes
- Conversion tracking wired to your Google Ads audience manager and your tag inventory, not to form fills
- Server-side, first-party tagging so the signal survives the browser
- Landing pages that answer the ad, one per intent
- Monthly reporting against your own numbers, not the Google column
- The search terms report worked every week, not quarterly
The first conversation is a read of what your account is actually reporting. No deck, and nothing to sign to get it.
