Last verified: October 2026, against Google's own help center. General information, not legal advice — confirm with your compliance officer or attorney.
Is Google Analytics HIPAA compliant? Google's own answer is that it doesn't promise HIPAA compliance and won't sign a business associate agreement (BAA) for it, so GA4 must never receive protected health information (PHI). That doesn't mean ripping it out. It means deciding which pages GA4 may see and setting it up so nothing identifying slips into reports.
Short answer: what Google says about HIPAA and Google Analytics
Short answer (verified October 2026): In its HIPAA and Google Analytics (opens in a new tab) article, Google says it "makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." HIPAA-regulated customers "may only use Google Analytics on pages that are not HIPAA-covered," and "Authenticated pages are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages."
The article goes one step further for public pages: "Unauthenticated pages that are related to the provision of health care services, including as described in the HHS bulletin, are more likely to be HIPAA-covered." It tells customers to work with their legal team to identify the pages that don't relate to providing health care.
Google Cloud's BAA is a different contract. Its HIPAA page (opens in a new tab) lists the Cloud and Workspace products the BAA covers, such as Gmail, Drive and BigQuery. Google Analytics isn't among them.
The HHS bulletin Google mentions was partly vacated by a federal court in 2024; our guide to tracking pixels and HHS guidance explains what still stands.
When analytics data becomes PHI on a practice website
Analytics data turns into PHI when it ties an identifiable person to their health or their care at your practice. On a typical practice site, that happens in a few predictable ways:
- The URL or page title names care. "/appointment-confirmed?type=colonoscopy" or a page title like "Your intake form, Maria."
- Event parameters carry form content. A custom event that records the dropdown value "reason for visit: anxiety."
- The page sits behind a login. Patient portals and bill-pay pages are authenticated, which Google flags as likely HIPAA-covered.
- Identifiers ride along. HIPAA's de-identification list in 45 CFR 164.514(b)(2) (opens in a new tab) includes IP addresses, URLs and "any other unique identifying number, characteristic, or code," and analytics tools collect several of those by design.
Whether an IP address on its own is PHI is a narrower question; see is an IP address PHI.
Google's PII best-practices article (opens in a new tab) warns that "PII is often inadvertently sent in these URLs and titles," and that visitors type personal details into search boxes and form fields. On a medical site, that same leak usually carries health context too.
Pages and events to keep out of GA4
| Keep GA4 off | Why |
|---|---|
| Patient portal, bill pay, any login page | Authenticated; Google says likely HIPAA-covered |
| Intake, contact and appointment-request forms | Field values and "reason for visit" can enter events |
| Booking widgets and confirmation pages | Appointment type and clinician appear in URLs and events |
| Thank-you pages that name a service | The URL itself describes care |
| Site search results | Queries like "?q=hiv+test" are captured in page location |
Treat condition- and service-specific pages as a judgment call for your legal team, given Google's statement that health-service pages are "more likely to be HIPAA-covered."
A safer GA4 setup for a medical practice
- Exclude pages in Tag Manager. Change the GA4 tag's trigger from "All Pages" to a list that excludes the pages above. In Google Tag Manager, check each tag and trigger.
- Keep PHI out of URLs and titles. Ask your developer to use neutral confirmation URLs ("/thank-you") and generic page titles.
- Send no form content in events. Track "form_submitted" as a bare event, with no field values.
- Turn on data redaction. In GA4: Admin > Data collection and modification > Data streams > your web stream > Redact data. It removes likely email addresses and the URL query parameters you list. Google calls the email check "best-effort," and it doesn't cover data sent through Measurement Protocol or Data Import (GA4 data redaction (opens in a new tab)).
- Review Google signals. Admin > Data collection and modification > Data collection > "Enable Google signals data collection." Google signals enriches reports with data from signed-in Google users who have Ads Personalization on (Google signals (opens in a new tab)). Most practices should leave it off, and review any links between GA4 and their ad accounts.
- Shorten retention. Admin > Data settings > Data retention offers 2 or 14 months for standard properties (data retention (opens in a new tab)). Pick the shortest period your reporting needs.
- Add a consent banner that reflects your privacy policy and the state laws you're subject to.
- Audit quarterly and after every site change, using the steps in the tracking-pixels guide.
For the full configuration, see our walkthrough on setting up GA4. Session replay tools pose a bigger risk than GA4 because they record what visitors type and click; read session recording tools and HIPAA before installing one.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Analytics vendors that sign a BAA: what to check
Searches for "hipaa compliant analytics" (40 a month) and "google analytics hipaa" (30 a month) come from practices weighing a switch (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). A BAA-signing tool makes sense when you need behavior data from pages GA4 shouldn't see. Ask in writing:
- BAA: Will you sign one on our plan, and does it cover all data the tool collects?
- Data location: Which country and cloud region stores the data?
- Retention: How long is raw event data kept, and can we shorten it?
- Collection method: Is data collected server-side, and are IP addresses stored or truncated?
- Access: Who at the vendor can see our data, and is access logged?
- Exports: Does any data flow on to ad platforms or other third parties?
A BAA is necessary but not sufficient. The tool still needs the same page exclusions and minimum-necessary configuration.
What to measure instead: calls, forms, bookings and directions
Most practices don't need page-level behavior from sensitive pages. They need to know which channels produce patients. Four counts answer that question:
- Calls from click-to-call taps
- Form submissions, counted without their contents
- Booking clicks that hand off to your scheduling tool
- Direction requests from your site or Business Profile
Pass those to ad platforms only as aggregate, generic conversions; our guide to Google Ads conversion tracking covers the setup.
Medfy's first-party website analytics count calls, forms, bookings, directions and visits from AI assistants, and its Google reporting shows Search Console, Google Analytics and Business Profile in one view. Form submissions go to an access-controlled patient inbox, patient information is stored in separate, encrypted HIPAA databases, and ad platforms never receive patient data. Read how Medfy handles patient data, see the wider HIPAA marketing rules, or run a free marketing audit to see what your site's tags expose today.
Frequently asked questions
Does Google sign a BAA for Google Analytics?
No. Google's help article on HIPAA and Google Analytics says Google 'makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service.' Google Cloud's BAA is a separate agreement covering a listed set of Cloud and Workspace products, and Google Analytics isn't on that list. Confirm what your contracts cover with your compliance officer or attorney.
Can I use GA4 on my practice website at all?
Yes, on pages that aren't HIPAA-covered. Google says HIPAA-regulated customers may use Analytics only on such pages and should keep tags off authenticated pages and pages related to the provision of health care services. In practice that usually means general pages like the home page and about page, with forms, booking and portal pages excluded. Classify each page with your compliance officer or attorney.
Is GA4 safe on pages without forms?
Safer, not automatically safe. A page without a form can still relate to health care services, such as a page about a specific treatment, or carry a search query or appointment type in its URL. Google says unauthenticated pages related to health care services are more likely to be HIPAA-covered. Keep PHI out of URLs and titles, turn on data redaction, and get sign-off from your compliance officer or attorney.
What analytics can a HIPAA covered entity use?
Any tool, as long as PHI stays out of it or the vendor signs a BAA covering what it collects. The options are GA4 limited to non-covered pages, an analytics vendor that signs a BAA, or first-party analytics run by a business associate under a BAA. Ask each vendor about the BAA, data location, retention and server-side collection. Confirm the choice with your compliance officer or attorney.