On this page
Healthcare marketing teams need to know which campaigns produce consultations, but the details that make those consultations meaningful are often clinical. This guide describes a measurement design that separates campaign attribution from clinical context, so ad platforms and analytics tools receive only what they need.
Why this is a measurement design problem
The legal boundaries belong to counsel, but the measurement choices belong to the marketing and analytics team, and they are where most risk is created. HHS’s Office for Civil Rights has published guidance on online tracking technologies for HIPAA covered entities and business associates. Its central point is that HIPAA applies when information collected through tracking technologies, or disclosed to tracking vendors, includes protected health information (PHI). The guidance says that disclosing PHI to tracking vendors for marketing without a HIPAA-compliant authorization is impermissible, and it addresses user-authenticated pages such as patient portals, unauthenticated pages, and mobile apps.
Part of that guidance is no longer in effect. On June 20, 2024, the U.S. District Court for the Northern District of Texas, in American Hospital Association v. Becerra, vacated the portion stating that HIPAA obligations are triggered when tracking connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS said it is evaluating next steps. The rest of the bulletin is still published, including its sections on authenticated pages and mobile apps, so read the current text rather than older summaries. Where HIPAA does not apply, the bulletin itself points to the FTC Act and the FTC’s Health Breach Notification Rule, and state privacy laws can apply too, so treat this guide as a starting point for the design and let counsel set the boundaries.
Keep clinical detail out of the payloads
The simplest rule is to keep clinical context out of anything that leaves your control: URLs, page titles, event names, and event parameters sent to ad platforms and analytics tools. A path or title can reveal what a person was looking at even without a name attached. Google says it does not offer a business associate agreement for Google Analytics and that HIPAA-regulated entities must not expose PHI to it, so check its current help page before assuming any configuration is acceptable.
| Data element | OK in ad or analytics platforms? | Safer alternative |
|---|---|---|
| Condition-specific page URL or title | Generally no. A path or title that names a condition can reveal health information. | Generalize the path to a service category, use a neutral page identifier, and review with counsel. |
| Appointment reason or service line tied to a person | No | Keep it in the EHR or CRM only, and report a generic booked-consultation event instead. |
| Ad click ID, such as gclid | Typically used for matching, so review with counsel before it leaves the form flow. | Store it on the intake record at submit, and send it only where counsel has approved. |
| Hashed email sent for conversion matching | Requires counsel review and an authorization analysis before any use. | Send a generic conversion event with no contact data unless counsel approves matching. |
| UTM campaign, source, and medium values | Lower risk as campaign labels, but on booking and intake pages the same request can carry PHI, so review those flows with counsel. | Restrict them to campaign labels, with no free-text fields. |
| Generic conversion event, such as “qualified consultation” | Only with counsel sign-off. A cookie banner choice is not a HIPAA authorization. | Send no diagnosis, service detail, or patient identifier with it. |
Measure campaign to booked consultation without the clinical record
The business still needs to know which campaigns produce booked consultations and patients. The pattern that works is to split the job. The intake system or CRM holds the clinical and identity context under its own controls, while the reporting warehouse holds campaign and outcome counts. Ad platforms and analytics tools receive the minimum signal they need, if any.
- Capture UTMs and click IDs on the form page, before any navigation that could drop them.
- Write them onto the intake record at submit, next to the consultation request, rather than into a page URL.
- Keep appointment reasons and clinical notes in the EHR or CRM, under its access controls.
- Join campaign to booked and attended outcomes in your warehouse, using a stable record ID rather than names.
- Decide with counsel which conversion events, if any, go back to ad platforms, and send only generic ones.
Patient portals and authenticated areas
Patient portals and any logged-in area should be treated as a separate measurement surface. HHS says tracking on authenticated pages generally has access to PHI, and that a tracking vendor receiving PHI needs a business associate agreement (BAA) and an applicable Privacy Rule permission, or the individual’s HIPAA-compliant authorization. The most conservative design keeps third-party ad pixels out of portals entirely and measures portal use with tools your compliance team has reviewed. Public pages need care too. HHS’s own example is an appointment request on a clinic’s website that sends the appointment details and the visitor’s IP address to a tracking vendor, which makes that vendor a business associate that needs a BAA. Treat booking and intake pages like the portal, and review the paths and titles of other public pages so that none of them reveals a patient’s condition or appointment.
Consent and vendor review
Consent management belongs in front of every non-essential tag. Document what each choice enables, then check that tags actually respect it when the page loads, not only what the banner says. Do not treat the banner as the HIPAA answer: HHS states that banners asking visitors to accept or reject tracking are not a valid HIPAA authorization. For each analytics or ad vendor, confirm whether they will sign a business associate agreement where PHI could be involved, and read their current terms rather than relying on a sales conversation.
Before a release, run the checks in the tracking QA checklist before launch, and add healthcare-specific items for page titles, URL paths, form fields, and portal tags. Server-side layers can strip or generalize fields before anything reaches a vendor. That is different from a vendor promising to remove PHI after it arrives, which HHS says is not sufficient. Server-side setup is covered in the server-side tag management guide. For context on how healthcare teams approach this work, see the healthcare analytics overview, our case studies, and digital analytics services. If you want a review of your current payloads, book a tracking audit: bring the page list, the form fields, and the tags that fire on your portal, and we will go through what should stay out of each payload.
Frequently asked questions
Does a tracking pixel on a healthcare site violate HIPAA?
It depends on what the tag collects, where it runs, and who receives the data. HHS OCR guidance says HIPAA applies when tracking technologies collect or disclose PHI to tracking vendors, and that disclosing PHI to a vendor for marketing without a HIPAA-compliant authorization is impermissible. Pixels on patient portals and other authenticated areas deserve the closest review. Ask privacy counsel to look at your specific setup.
Can a healthcare site send data to Google Analytics?
Google says it makes no representation that Google Analytics satisfies HIPAA, does not offer a business associate agreement for it, and that HIPAA-regulated entities must not expose PHI to Google through it. Check its current help page for the exact language, since it can change. Design the setup so that page paths, page titles, and events carry no clinical or identifying detail.
How do you measure healthcare ad conversions without sending patient data?
Capture campaign parameters and ad click IDs at form submit, store them with the intake record, and report campaign to booked to attended in your own warehouse. Send ad platforms only conversion signals that counsel has approved, with no diagnosis, service detail, or patient identifier attached. A cookie banner is not a HIPAA authorization, so banner consent alone does not clear a disclosure.
Can MetricMaven help set up healthcare tracking without patient data?
Yes. We review page titles, URL paths, form fields, and tags, map which data elements stay out of ad and analytics payloads, and set up the intake and reporting flow around them. Decisions about legal requirements stay with your counsel and compliance team.