Google Analytics on medical practice websites after the HHS tracking bulletin

Google Analytics can be installed by pasting one tag into a site template. That is the problem. A tag in the template runs on each page that uses it, including the appointment request page, the patient portal login and the thank-you page after a symptom form. Google’s own help pages now tell health care organizations to keep the tag off pages that relate to the provision of care, and the HHS tracking bulletin explains why.

This guide covers what the Google Analytics terms and help pages say about personal and health information, what the HHS bulletin and the June 2024 court ruling mean for analytics, which pages to exclude, what Google’s own privacy settings do and do not solve, the server-side option HHS describes, and the FTC rules for health businesses outside HIPAA. For related topics, see our guides to tracking pixels on practice websites, cookie consent banners on medical websites, call tracking for medical practices and website contact forms and HIPAA.

The short version

• Google says it does not offer a business associate agreement for Google Analytics and makes no representation that it satisfies HIPAA requirements.
• Google tells HIPAA-regulated entities to use Analytics only on pages that are not HIPAA-covered, to keep tags off signed-in pages, and to work with counsel to decide which other pages relate to care.
• The HHS bulletin says tracking on signed-in pages, and on pages where someone books an appointment or enters symptoms, generally involves protected health information.
• A June 2024 court ruling vacated one part of the bulletin: the part about an IP address combined with a visit to a public page about a condition or provider. The rest stands.
• A cookie banner is not a HIPAA authorization, and a vendor’s promise to strip data after it arrives is not enough, according to the bulletin.
• Health businesses outside HIPAA still answer to the FTC for what their analytics share.

What Google’s terms and help pages say

Section 7 of the Google Analytics Terms of Service says the customer will not pass information to Google that Google could use or recognize as personally identifiable information, hashed or otherwise, except where a feature’s own terms permit it. It also requires a privacy policy that discloses the use of Google Analytics and of cookies or mobile identifiers to collect data.

The Analytics Help page Understanding PII in Google’s contracts and policies says Google reads PII as information that could be used on its own to directly identify, contact or precisely locate a person, such as email addresses, mailing addresses, phone numbers, precise locations, and full names or usernames. The same page says Google does not count pseudonymous cookie IDs, advertising IDs or IP addresses as PII. That is Google’s contract definition, not HIPAA’s. The page itself says data outside Google’s definition may still be personal data or personal information under other laws.

The Analytics Help page HIPAA and Google Analytics is direct. It says customers must not use Google Analytics in a way that creates HIPAA obligations for Google, and HIPAA-regulated entities must not expose to Google any data that may be considered protected health information, even if it is not PII under Google’s contracts. It says Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer business associate agreements for the service. It says authenticated pages are likely HIPAA-covered and should not carry Google Analytics tags, that unauthenticated pages related to the provision of health care services are more likely to be HIPAA-covered, and that customers should work with their legal team to identify pages that do not relate to care.

What the HHS bulletin says, and what the court changed

The HHS Office for Civil Rights bulletin on online tracking technologies treats analytics scripts as tracking technologies. It says tracking technologies on user-authenticated pages, such as a patient portal or telehealth platform, generally have access to protected health information. For unauthenticated pages, it says a visit to a page about job postings or visiting hours does not involve a disclosure of protected health information, but a user who makes an appointment or enters symptoms in an online tool is disclosing it, and the HIPAA Rules apply. It also says a portal login or registration page is generally unauthenticated, yet login or registration details entered there are protected health information if a tracking tool collects them.

The bulletin carries a note on American Hospital Association v. Becerra. On June 20, 2024, the US District Court for the Northern District of Texas vacated the bulletin to the extent it said HIPAA obligations are triggered when a technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS says it is evaluating its next steps. The guidance on signed-in pages, appointment booking, symptom tools, login and registration details, and mobile apps was not part of what the court vacated.

The bulletin also closes three workarounds. It says website banners that ask users to accept or reject tracking cookies are not a valid HIPAA authorization. It says it is not enough for a tracking vendor to agree to remove protected health information or de-identify it after receiving it. And it says a privacy policy notice alone does not permit a disclosure: the vendor needs a signed business associate agreement and a Privacy Rule permission, or the patient’s HIPAA authorization comes first. Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires.

Which pages to keep Google Analytics off

Read together, Google’s help page and the HHS bulletin point to a short list. We recommend keeping the Google Analytics tag off these pages entirely, not just filtering the data later:

• Patient portal pages and anything behind a sign-in, including telehealth pages.
• Portal login and registration pages, since the details typed there are protected health information if a tag collects them.
• Appointment request and online booking pages, and the confirmation page that follows.
• Symptom checkers, intake forms, health questionnaires and any page where a person enters health details.
• Bill pay and insurance verification pages tied to a patient account.
• Thank-you pages whose address or title names a service, condition or provider.

Pages such as the home page, office hours, directions, careers and general service descriptions are where the vacated part of the bulletin matters. The court removed HHS’s position on IP addresses and public condition pages, but Google’s own help page still says unauthenticated pages related to care are more likely HIPAA-covered and points to legal review. We recommend deciding page by page with counsel and writing the decision down.

One technical detail matters here. If the tag is loaded once in a shared template, it runs everywhere. Load it per page type, or use a rule in your tag setup that blocks it on the excluded paths, then check with your browser’s developer tools that no request to Google Analytics leaves those pages.

What Google’s settings do and do not solve

Google offers settings that reduce what reaches Analytics. They help with Google’s PII rule. None of them turns Google Analytics into a business associate.

• Page addresses and titles. The Best practices to avoid sending PII page says the basic tag collects each page’s URL and title, that PII can end up in them by accident, and that both the path and the parameters must be free of PII. Check whether your form system puts a name or email in the thank-you page URL.
• Campaign and event fields. The same page lists campaign parameters, custom dimensions, event fields and site search terms as places PII must not appear.
• Data redaction. The Data redaction page says Analytics can remove email addresses on a best-effort basis and remove URL query parameters you name, for web data only, and that it does not evaluate HTTP header values such as the referrer. It is a filter for mistakes, not a way to send health pages.
• Consent mode. The Data collection page says Analytics does not store the client ID cookie when analytics storage is turned off through consent mode. The HHS bulletin is clear that a banner choice is not a HIPAA authorization.
• Advertising features. The Advertising Features policy says that if you collect sensitive information as described in Google Ads sensitive category restrictions, you may not use Google Analytics to collect data for interest-based advertising. We recommend leaving Google signals, remarketing and ads personalization off on a practice site.
• Retention. The Data retention page lets you set user-level and event-level data to be deleted after 2 or 14 months in a standard property. We recommend the shortest period that still meets your reporting needs.

The EU, Switzerland, or UK-focused data and privacy page says Analytics does not log or store IP addresses from users in those regions and uses them only to derive coarse location. That statement covers those regions, not US visitors.

The server-side option HHS describes

The bulletin describes one route for organizations that want analytics data from pages that carry protected health information. If a tracking vendor will not sign a business associate agreement, a regulated entity can sign one with a different vendor, the bulletin’s example is a customer data platform, that de-identifies the tracking data and then passes only de-identified data to the vendor that will not sign. Without a business associate relationship, the bulletin says, protected health information cannot go to that vendor without each person’s authorization.

In practice, this means the browser sends events to a server under your business associate agreement instead of directly to Google, and that server removes identifiers before forwarding anything. De-identification has a legal meaning. Under 45 CFR 164.514(b), data is de-identified either when a qualified expert documents that the risk of identifying a person is very small, or when listed identifiers are removed and the entity has no actual knowledge that what remains could identify someone. The listed identifiers include names, geographic units smaller than a State with a narrow ZIP code exception, dates other than year, phone numbers, email addresses, device identifiers, web URLs, IP addresses and any other unique identifying number or code. A forwarding setup that keeps the page URL and a persistent visitor ID does not meet that list.

This route costs more and needs ongoing review. For a small practice, the simpler choice is to keep Google Analytics off care pages and measure bookings in the scheduling system, which already holds that data.

Health businesses outside HIPAA

A cash-pay wellness company, a supplement seller or a health app may not be a covered entity at all. The FTC Health Breach Notification Rule, 16 CFR part 318, applies to vendors of personal health records and PHR related entities that are not HIPAA covered entities or acting as business associates. Under 16 CFR 318.2, health care services or supplies include any online service such as a website, mobile application or internet-connected device that tracks conditions, symptoms, medications, fitness, sleep, diet and similar matters, and a breach of security includes an unauthorized disclosure, not only a hack.

Under 16 CFR 318.3, after discovering a breach, a vendor or PHR related entity must notify each affected individual and the FTC, and must notify prominent media outlets when 500 or more residents of a State or jurisdiction are involved. Separately, 15 USC 45(a)(1) declares unfair or deceptive acts or practices unlawful, which reaches a privacy policy that says health details are not shared while an analytics tag sends them. Our guides to the FTC Health Breach Notification Rule and consumer health data privacy laws cover these rules.

Questions to ask about your Google Analytics setup

• Is the tag loaded in a shared template, and if so, which pages does it actually run on?
• Does it fire on the portal login, registration, booking, intake or bill pay pages?
• Do any page URLs or titles include names, emails, conditions or provider names after a form is sent?
• Are Google signals, remarketing or ads personalization turned on?
• Which events and conversions do we send, and could any of them describe a person’s health?
• Has counsel reviewed which public pages relate to care, and is that decision written down?
• If we want data from care pages, is there a business associate agreement with the system that receives it first?
• Does our privacy policy describe our analytics accurately?

Use and avoid

• Use: a written list of pages where the tag runs and pages where it is blocked.
• Use: booking counts from the scheduling system rather than from analytics on the booking page.
• Use: neutral page titles and thank-you URLs with no names, conditions or provider names.
• Use: the shortest data retention period that meets your reporting needs.
• Use: a check in browser developer tools after each site change to confirm excluded pages send nothing.
• Avoid: Google Analytics tags on signed-in, booking, intake, symptom or bill pay pages.
• Avoid: treating a cookie banner as patient permission under HIPAA.
• Avoid: relying on data redaction or filters to clean up health pages after collection.
• Avoid: remarketing audiences built from visits to service or condition pages.

An illustration

This example is invented. [Practice name], a chiropractic practice in [city], has Google Analytics in its site template. A review with browser developer tools shows the tag firing on the online booking page, on the intake form and on a thank-you page whose address includes the patient’s first name and the reason for the visit. Remarketing is turned on.

The owner works through the setup with their web contact and their attorney. The tag comes off the booking, intake and portal pages through a rule in the tag setup. The form plugin is changed so the thank-you page address no longer carries any visitor details. Remarketing and Google signals are turned off and retention is set to 2 months. Booking counts now come from the scheduling system. The attorney reviews the remaining public pages, and the decision is recorded in a short document the practice keeps with its HIPAA policies.

Checklist

• Find each page where the Google Analytics tag runs, using the site template and browser developer tools.
• Block the tag on signed-in, login, registration, booking, intake, symptom and bill pay pages.
• Remove names, emails, conditions and provider names from page URLs and titles.
• Review campaign, event and custom fields for anything about a person’s health.
• Turn off Google signals, remarketing and ads personalization.
• Set data retention to the shortest period that works.
• Have counsel review the remaining public pages and write the decision down.
• Measure bookings and calls in systems already covered by a business associate agreement.
• Update the privacy policy so it describes your analytics accurately.
• Recheck after each site redesign, new form or new plugin.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For Google Analytics, that means mapping where the tag runs, blocking it on care pages, cleaning names and conditions out of page addresses and titles, and measuring results from systems that already hold the appointment. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. Read our guide to healthcare marketing rules for the wider picture.

Sources

• Google Analytics Terms of Service (last updated May 15, 2023)
• Analytics Help: HIPAA and Google Analytics (no date shown)
• Analytics Help: Best practices to avoid sending Personally Identifiable Information (PII) (no date shown)
• Analytics Help: Understanding PII in Google’s contracts and policies (no date shown)
• Analytics Help: Data redaction (no date shown)
• Analytics Help: Data collection (no date shown)
• Analytics Help: Data retention (no date shown)
• Analytics Help: EU, Switzerland, or UK-focused data and privacy (no date shown)
• Analytics Help: Policy requirements for Google Analytics Advertising Features (no date shown)
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024)
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules (paragraph (a))
• 45 CFR 164.514: Other requirements relating to uses and disclosures (paragraphs (a) and (b), de-identification)
• 16 CFR 318.2: Definitions
• 16 CFR 318.3: Breach notification requirement
• 15 USC 45: Unfair methods of competition unlawful; prevention by Commission

More in Practice websites, privacy and tracking