HIPAA and Google Ads: What to Settle Before You Spend

Every medical practice that has ever considered paid search asks the same question first: are Google Ads HIPAA compliant? It is the right instinct and the wrong shape of question, and the difference matters enough to be worth a few minutes.

HIPAA does not regulate advertising platforms. It regulates covered entities — providers, health plans, clearinghouses — and the business associates who handle protected health information on their behalf. Google makes a business associate agreement available for Google Workspace and Google Cloud, covering a defined list of included functionality, and the agreement is accepted inside the Admin console. Google Ads is not a Workspace service, and neither are Analytics or Tag Manager. Confirm that against the current included functionality list with whoever advises you, rather than taking any agency's word for it.

Which reframes everything. You are not asking whether Google is compliant. You are asking whether your own account, your own tags and your own forms are quietly handing Google information that HIPAA says it may not have. That is an engineering question with a definite answer, and it is answerable before a single dollar is spent.

One thing to state plainly up front: we are not a HIPAA compliance adviser and we do not certify anything as compliant. What follows is where the leaks actually happen in ad accounts, so that the person who does advise you has something specific to rule on.

What Counts as PHI Is Broader Than People Expect

The regulation's own definitions are short and worth reading once. Protected health information is defined at 45 CFR 164.501, and the terms it leans on — covered entity, business associate, individually identifiable health information — sit at 45 CFR 160.103.

The part that surprises practices is that health information does not have to include a diagnosis to be identifiable. A name attached to the fact that someone requested an appointment at an oncology clinic is health information about that person. So is an email address paired with the page they filled in. The condition is implied by the context, and the context is the clinic.

This is why "we never send Google any medical records" is not the reassurance it sounds like. Nobody was ever going to upload a chart. The exposure is ordinary form data on a page whose subject matter is itself the sensitive fact.

The Five Places It Actually Leaks

In practice, almost every problem we find in a healthcare account is one of five things. None of them require anyone to have done something careless — four of the five are default behaviour in tools that were set up by a competent person who was not thinking about HIPAA that day.

1. Form field values inside the tag payload

A conversion tag can be configured to read the form it fires on. Form-submission triggers, auto-event variables and generic "capture all fields" setups will happily pass name, email, phone and whatever free-text box the patient typed their symptoms into. The tag was installed to count a lead; it is also transmitting one.

The fix is to send the event and nothing about the person. A conversion is a count, not a record, and no reporting question a practice actually asks requires the patient's identity.

2. Query strings and thank-you page URLs

This is the quietest one. A form that submits over GET, or a confirmation page built as ?service=hepatitis-c-treatment&email=…, writes the sensitive detail into the page path. Analytics and ad tags record page paths by default, so the data arrives without any tag having been misconfigured at all.

Confirmation pages should carry no patient data in the URL — not the service, not the email, not an appointment reference. Keep the detail server-side and give the thank-you page a single static address.

3. Enhanced conversions and customer-data uploads

Features that improve measurement by matching a hashed email or phone number to a Google account are, by design, sending identifiers for people who contacted a clinic. Hashing is not de-identification in the sense HIPAA means it, and the match is the entire point of the feature.

Treat enhanced conversions for leads, customer match and offline conversion imports as switched off on patient forms until your compliance adviser has looked at them specifically and said otherwise in writing. This is the single most common thing we turn off when we inherit a healthcare account.

4. Remarketing lists built from patient behaviour

A list of everyone who visited a treatment page is a list of people with an implied condition, and an ad that follows them around the web discloses it to anyone looking over their shoulder. Google's own restricted targeting rules already prohibit personalised advertising built on health conditions and related sensitive categories, so this is both a HIPAA question and a policy question with a single answer.

There is still useful work here — it just has to run on non-sensitive audiences and contextual signals rather than on who read which condition page. Remarketing for a healthcare account looks different from remarketing for a shoe shop, and should.

5. Call tracking and recordings

Call extensions and call-only ads produce recordings and transcripts, and a patient will describe their symptoms on that call within about nine seconds. Wherever those recordings land is a system holding PHI, which means it needs the same agreement, retention rule and access control as anything else in the practice — and most third-party call-tracking vendors are not set up for that unless you have specifically asked them.

Google's Own Policies Already Narrow the Field

Before HIPAA even enters the conversation, the account has to be allowed to run. Three policies do most of the work, and reading them first saves a cycle of disapprovals.

The healthcare and medicines policy governs what may be promoted and by whom, and it is where certification requirements appear. The restricted targeting rules govern how audiences may be built. The data collection and use policy governs what an advertiser may transmit to Google in the first place — which is the policy most directly parallel to the HIPAA question, and the one almost nobody reads.

Two categories need certification rather than just care. Addiction treatment services and online pharmacies require LegitScript certification before ads will serve, and the certification is held by the practice, not by its agency. Telehealth falls under rules that depend on what is being prescribed. If any of that applies, establish it before the build, because no amount of account structure makes an uncertified advertiser eligible.

Measurement That Survives the Constraint

The fear is that stripping all of this out leaves you flying blind. It does not, because the constraint removes identity and leaves behaviour, and behaviour is what optimisation needs.

A clean healthcare setup still tells you which campaign produced the appointment request, what it cost, which keyword the search came from, and which landing page converted. What it will not tell you is who the person was. Google does not need that to bid, and the practice already knows it from the form submission sitting in its own system.

What this does change is the shape of the reporting. Cost per appointment request is reliable; patient lifetime value piped back into the bidding is not available to you in the usual way. Plan the account around the metric you can measure cleanly — our conversion tracking work on these accounts starts by deciding what may be collected, and builds the measurement to that line rather than installing a standard tag and auditing it afterwards.

The Checklist Before Any Spend

• Ask who your compliance adviser is, and get the decision on what may be collected from them in writing. Everything below is implementation of that decision, not a substitute for it.
• Open the tag container and read every variable a conversion tag sends. If any of them resolve to a form field, remove them.
• Submit a test form and watch the URL. Patient data in a query string or a thank-you path is the leak that no tag audit catches.
• Check whether enhanced conversions, customer match or offline imports are on. Assume off until signed off.
• List every audience the account uses and remove any built from condition or treatment pages.
• Find out where call recordings are stored and under what agreement.
• Confirm certification if the category is addiction treatment, online pharmacy or prescribing telehealth.

That list is deliberately boring, and it is also a one-day job on most accounts. An existing account worth auditing usually fails three or four items, and the fixes are configuration rather than rebuilds.

Where the Budget Actually Goes

One last point, because it is the thing that decides whether healthcare paid search works at all. These accounts live or die on the landing page, not the keyword list. A patient who clicks an ad for a procedure wants to know whether you treat their situation, what happens at the first appointment, whether you take their insurance, and how to book — and most practice sites answer the fourth question and none of the first three.

That is why PPC landing pages and healthcare UX do more for cost per appointment than bid adjustments ever will, and why it is worth settling how much to spend on Google Ads only after there is somewhere decent to send the click. The search terms report will then tell you what people are actually searching, which in healthcare is rarely the clinical term.

If you would rather have the policy, the tracking and the pages handled together, that is healthcare PPC — and for practices where the organic side matters as much, healthcare SEO covers the same ground for search results you do not pay for. Dental practices have their own version of this, with its own competitive maths, under dental PPC.