Why can't I just do this myself?

You can — if you have 80–120 hours to learn server-side GTM, debug iOS dedup edge cases, and stress-test EMQ across every conversion event. We do it in 7–10 days because we've done it 300+ times.

What if it doesn't work?

Two protections: (1) 95% tracking accuracy guarantee — we keep working free until your Meta Match Quality hits 8+. (2) You own the entire stack — server, container, runbook — on your accounts from day one.

Will Apple / Google break this in the future?

1st-party server-side tracking is what survives Apple, Mozilla, and Chrome cookie deprecation. The CAPI / Events API endpoints we use are how Meta, Google, and TikTok publicly committed to keeping the channel open.

Is it HIPAA-safe to track HIPAAtizer submissions for ads?

It can be, if the conversion carries no health information: no field values, no answers in URLs, nothing naming the program someone asked about. We build it that way and hand your compliance lead the list, but the sign-off is theirs.

Why does Google Ads show no conversions from our intake form?

Your site's tags can't see inside the iframe HIPAAtizer serves, so the submit never reaches them. A SubmitSuccess event from the postMessage API, or a server-side upload from your records, fixes it.

Can Zapier send HIPAAtizer leads to Google Ads?

HIPAAtizer's own docs say Zapier isn't HIPAA-compliant. We send conversions by click ID from your records instead, so nothing clinical passes through Zapier.

How do I know which ads led to an admission, not just a form?

Save the click ID with the HIPAAtizer submission, then upload it with the admission date once intake confirms. Google Ads supports exactly this kind of offline import.

We use HIPAAtizer for chiropractic, orthopedic or pain management new-patient forms. Does that change anything?

Only the money step changes: a booked first visit instead of an admission. If the same intake form also goes to patients who booked by phone, separating it from ad inquiries matters even more, or every one of them looks like an ad lead.

HIPAAtizerForms

Patients fill out your HIPAAtizer form. Why can't Google Ads tell which clicks became admissions?

Your HIPAAtizer intake form submits straight to HIPAAtizer's HIPAA cloud, not your website, so your tags see the page visit and miss the inquiry. HIPAAtizer documents no Google Analytics, Tag Manager or Meta Pixel setting. Fixed means every inquiry counted once with zero form answers attached, and admitted or scheduled patients sent back to Google and Meta by click ID.

Get my free conversion tracking audit See what we check

Free30 minutesNo obligation

By Ariful IslamHow HIPAAtizer works ↓

HIPAAtizer · what breaks

What goes wrong with HIPAAtizer and your ads

01
"Google Ads says zero leads, but the inbox is full"
An embedded HIPAAtizer form runs in an iframe served by HIPAAtizer, so your page never sees the submit. Smart Bidding gets no signal and keeps spending blind on admissions keywords.
02
"Every packet counts as a new patient"
Clinics also use HIPAAtizer for consent forms and packets sent to people who already booked. Track all of them and Meta optimizes toward existing patients doing paperwork.
03
"Our thank-you URL has the patient's name in it"
HIPAAtizer can redirect with form variables in the URL. Any Pixel on that thank-you page reads the full address, which turns a tracking shortcut into a privacy incident.
04
"We can't tell which campaign filled a bed"
Admissions get decided on calls and in your EHR, days after the form. Without a click ID on the submission, a rehab or teen treatment center can't tie spend to a single admit.

HIPAAtizer · the fix

What changes — HIPAAtizer

Each inquiry reported once, with nothing clinical attached
One SubmitSuccess from the HIPAAtizer frame, or AllFormsSubmitted on a packet, fires one conversion with an event ID and no field values.
Bidding trained on admits, not paperwork
Scheduled consults and admissions go back to Google Ads and Meta by click ID, so campaigns learn from patients who actually started care.
A setup your compliance lead can sign off on
Every exposed field, redirect and integration is listed in writing, marked PHI or not.

HIPAAtizer · architecture

What HIPAAtizer actually lets you hook into

All of this comes from HIPAAtizer's own docs. Anything they don't cover, we test on your account.

1
postMessage API on embedded forms
Off by default. Once enabled for up to three allowed origins, the iframe emits FormReady, SubmitSuccess and AllFormsSubmitted, and accepts SetFieldValue for exposed fields. HIPAAtizer warns any script on your page can read exposed values.
2
Success page message or redirect
Show a message or send the respondent to a URL, optionally with form variables in it. On a packet, only the last form's success page runs.
3
Webhooks with a body you write
Fire on submission created, updated, deleted or saved for later. Only variables you reference are sent, each request is signed, and PHI should go only to systems under a BAA.
4
CRM and attribution connectors
Native HubSpot and HighLevel contact sync, which HIPAAtizer says aren't HIPAA-compliant by default, plus a WhatConverts connector for marketing-source reporting.
5
No ad platform connection
No documented Google Analytics, Tag Manager, Meta Pixel or conversions API setting, and no hidden-field component. Confirm whether a field can hold a click ID before relying on it.

HIPAAtizer · diagnose

Where HIPAAtizer tracking breaks, in diagnostic order

Privacy exposure gets checked before accuracy, because on a treatment center's site a leak costs more than a missing conversion.

01
Read every success-page redirect
Any form variable in the URL is visible to every tag on the destination page.
02
List the exposed postMessage fields
The field picker marks PHI; none of those should be exposed.
03
Submit once from an ad-tagged URL
Check whether the click ID reaches the HIPAAtizer submission or is lost at the iframe.
04
Separate inquiry forms from packets
Count how many tracked submissions came from patients already booked.
05
Audit Zapier and CRM mappings
Confirm form fields stay off Zapier and that HubSpot or HighLevel only receive contact details.

HIPAAtizer · prove

The QA evidence — HIPAAtizer

Run on your live site with the real embedded form, plus a pass through the share link and QR code versions.

Source of truth

HIPAAtizer submission records by form and date, matched to the scheduled and admitted patients in your intake system

A test inquiry from an ad-tagged URL, with the click ID confirmed on the HIPAAtizer submission.
Network log showing the conversion carries no field values and no answers in any URL.
Exactly one conversion per inquiry in Google Ads and Meta, deduplicated on a shared event ID.
A paperwork packet and a Save & Continue partial confirmed absent from every conversion.
Scheduled and admitted patients matched record by record across a closed window.
Repeated 30 days later and after any change to the form, redirect or integrations.

HIPAAtizer · free audit

What we check in the free audit

Read every success-page redirect
List the exposed postMessage fields
Submit once from an ad-tagged URL
Separate inquiry forms from packets
Audit Zapier and CRM mappings

Checked against

HIPAAtizer submission records by form and date, matched to the scheduled and admitted patients in your intake system

Get my free conversion tracking audit

Free30 minutesNo obligation

HIPAAtizer · when not to buy

When you don't need this on HIPAAtizer

Some practices are better off without a tracking project at all.

If patients reach you by phone and HIPAAtizer only handles pre-visit paperwork, track calls and leave the forms alone.
If you don't run paid ads, HIPAAtizer's dashboard and your intake counts already tell you enough.
If WhatConverts already attributes your HIPAAtizer submissions and matches your intake log, a review is enough.
If the only issue is a redirect putting answers in the URL, switching it to a plain success message is a setting you can change yourself.

HIPAAtizer · what we deliver

The event map on HIPAAtizer

Intake form loaded
From HIPAAtizer's FormReady event, to see who reaches the form and never starts it.
New-patient inquiry submitted
The lead conversion, fired on SubmitSuccess, or AllFormsSubmitted on a packet. No answers attached.
Qualified inquiry
Marked by intake staff, such as insurance verified or right level of care.
Consult scheduled or patient admitted
The money conversion, uploaded from your intake records by click ID with its date.
Excluded: paperwork for booked patients
Consent, HIPAA acknowledgment and pre-visit packets stay out of every ad conversion.
Excluded: Save & Continue partials and test entries
Half-finished forms and staff tests never count as leads.

Written guarantee

95%+ tracking accuracy

Measured against HIPAAtizer submission records by form and date, matched to the scheduled and admitted patients in your intake system. Miss it and we keep working at no cost.

Get my free conversion tracking audit

From $400 · See packages

FAQ

HIPAAtizer questions, answered

HIPAAtizer documents no setting for that, and the form runs in its own frame. Its postMessage API tells your page a submission happened, so your tags fire without seeing answers.

RELATED GUIDES

Free · 30 min

See what your HIPAAtizer forms tell Google and Meta today

Book the free audit

Free30 minutesNo obligation

Patients fill out your HIPAAtizer form. Why can't Google Ads tell which clicks became admissions?

What goes wrong with HIPAAtizer and your ads

"Google Ads says zero leads, but the inbox is full"

"Every packet counts as a new patient"

"Our thank-you URL has the patient's name in it"

"We can't tell which campaign filled a bed"

What changes — HIPAAtizer

Each inquiry reported once, with nothing clinical attached

Bidding trained on admits, not paperwork

A setup your compliance lead can sign off on

What HIPAAtizer actually lets you hook into

postMessage API on embedded forms

Success page message or redirect

Webhooks with a body you write

CRM and attribution connectors

No ad platform connection

Where HIPAAtizer tracking breaks, in diagnostic order

Read every success-page redirect

List the exposed postMessage fields

Submit once from an ad-tagged URL

Separate inquiry forms from packets

Audit Zapier and CRM mappings

The QA evidence — HIPAAtizer

What we check in the free audit

When you don't need this on HIPAAtizer

The event map on HIPAAtizer

Intake form loaded

New-patient inquiry submitted

Qualified inquiry

Consult scheduled or patient admitted

Excluded: paperwork for booked patients

Excluded: Save & Continue partials and test entries

HIPAAtizer questions, answered

Can I put a Meta Pixel or Google tag inside a HIPAAtizer form?−

Is it HIPAA-safe to track HIPAAtizer submissions for ads?+

Why does Google Ads show no conversions from our intake form?+

Can Zapier send HIPAAtizer leads to Google Ads?+

How do I know which ads led to an admission, not just a form?+

We use HIPAAtizer for chiropractic, orthopedic or pain management new-patient forms. Does that change anything?+

More on HIPAAtizer

Booking tools beside HIPAAtizer, and what their bookings feed

See what your HIPAAtizer forms tell Google and Meta today