Google Analytics 4 (GA4) is Google's free analytics tool for websites, and most GA4 tutorials skip the question every practice has to answer first: where is it safe to run? This guide puts that question up front, then walks through setup for a practice website: key events for calls, forms, bookings and directions, the settings that reduce what GA4 collects, and the few reports worth reading each month.
"Google analytics 4" is searched 12,100 times a month in the US, with a keyword difficulty of 98, so the results are dominated by Google and large publishers. Narrower searches like "ga4 setup" (70) and "ga4 key events" (40) are where practice owners land (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What GA4 can and can't do for a practice
GA4 can:
- count visits to your public pages and show where they came from (Google search, your listing, ads, email);
- count actions you define, such as taps on your phone number or clicks to your booking tool;
- show which service pages bring people in and which ones lose them.
GA4 can't:
- tell you who became a patient (it never should);
- see calls dialed from your Google listing, a sign or memory;
- legally sit on every page of a practice website, because some pages involve patient information.
Treat GA4 as one input to measuring marketing ROI, not the whole answer.
Before you install: the HIPAA question
Google's own Help Center answers this plainly. As of October 2026, Google says it "makes no representations that Google Analytics satisfies HIPAA requirements" (opens in a new tab) and does not offer Business Associate Agreements for the service. It adds that authenticated pages are likely HIPAA-covered and should not carry Analytics tags, and that HIPAA-regulated customers may only use GA on pages that are not HIPAA-covered.
HHS's guidance on online tracking technologies (opens in a new tab) points the same way: tracking on login-protected pages generally has access to protected health information (PHI), and public pages where people schedule appointments or use a symptom checker can involve PHI too. A June 2024 court ruling vacated the part of that guidance about IP addresses on public pages about health conditions; HHS says it is evaluating next steps, and the rest stands.
The practical rule:
- Run GA4 on: home page, service pages, provider bios, blog, location and contact information.
- Keep GA4 off: patient portals, appointment-request and intake forms, online booking flows, form thank-you pages, and any page that displays patient information.
For the full analysis, read is Google Analytics HIPAA compliant. This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Setting up the property and data stream
Google's setup steps (opens in a new tab), adapted for a practice:
- Create an account at analytics.google.com in the practice's name, not your web designer's. Use a practice-owned Google account so you keep it if vendors change.
- Create a property. Set your time zone and currency, choose your industry and business size, accept the terms and the Data Processing Amendment.
- Add a web data stream. In Admin, under Data collection and modification, open Data streams, add a Web stream with your site's URL, and review enhanced measurement before you create it (see the settings section below).
- Install the Google tag. Paste the Measurement ID (it starts with "G-") into your website platform, or use Google Tag Manager. Configure it so the tag loads only on your public pages, not on forms, booking or portal pages.
- Check it works. Data can take up to 30 minutes to appear; open the Realtime report and visit your site.
Key events: calls, forms, bookings and directions
In GA4, an action you care about is a key event. Google's Help Center describes a key event as one that "measures an action that's particularly important to the success of your business," and says you can create Google Ads conversions from key events (opens in a new tab). Older tutorials use "conversions" for the same idea.
Set up four, carefully:
| Action | How to count it in GA4 | Notes |
|---|---|---|
| Call | Event when someone taps a link starting with tel: (a Google Tag Manager click trigger is the usual method) | Counts taps on public pages only |
| Booking | Event when someone clicks through to your scheduling tool | Don't put GA4 on the scheduler itself |
| Directions | Event when someone taps your map or directions link | Pair with listing directions |
| Form | Count submissions in your form system, not GA4 | Form pages are likely HIPAA-covered |
Then mark each event as a key event. Google's steps: in Admin, under Data display, open Events and click the star (opens in a new tab) next to the event, or create a new event with the "Mark as key event" toggle on. Marking applies from that point forward, and standard reports can take up to 24 hours to show it.
Illustrative example. A fictional orthopedic practice names its events phone_tap, booking_click and directions_tap. None carries a parameter beyond the page's public URL. Form submissions are counted in its HIPAA-compliant form system and added to the monthly report as a total.
Never send names, emails, phone numbers, dates of birth, conditions or appointment details to GA4 as event parameters or user properties. Google's enhanced measurement page itself says you must ensure no personally identifiable information is collected.
Settings that reduce what GA4 collects
Change these before you rely on the data:
- Enhanced measurement. Google lists what it collects automatically: page views, scrolls, outbound clicks, site search, video engagement, file downloads and form interactions (opens in a new tab). Turn off form interactions, and turn off site search if your search box could receive symptoms or conditions, since it reads search terms from the URL.
- Google signals. In Admin, under Data collection and modification, open Data Collection and switch off Google signals (opens in a new tab). It adds data about signed-in Google users with ad personalization on, which a practice doesn't need.
- Data retention. User- and event-level data can be kept for 2 or 14 months (opens in a new tab) on standard properties. Choose the shortest period that still covers your reporting needs.
- Consent. If you use a consent banner, consent mode (opens in a new tab) passes visitors' choices to Google; in the basic setup, Google tags are blocked until consent is granted. A banner is not a HIPAA authorization, per HHS, so it doesn't make tagging patient pages acceptable.
- No User-ID with patient identifiers. Don't connect GA4 to your patient records in any form.
On IP addresses, Google says that in GA4 "IP addresses are not logged or stored" (opens in a new tab). That reduces one risk; it doesn't make sensitive pages safe to tag.
For pixels from ad platforms, which carry more risk than analytics, see tracking pixels on medical websites.
Reports worth checking every month
Skip the dozens of default reports. Check these three in a few minutes:
- Traffic acquisition (Reports → Acquisition → Traffic acquisition). Google describes it as showing where new and returning users come from (opens in a new tab). Switch the dimension to Session source / medium, and add your key events as columns.
- Key events by source. In the same report, compare phone taps and booking clicks across Google search, your listing, ads and email. Tag your listing and ads with UTM parameters so these rows are reliable.
- Landing pages. Which service pages people arrive on, and which produce key events. A popular page with no taps or clicks needs a clearer call to action.
By default, GA4's attribution settings let both paid and organic channels receive credit in Analytics reports. Read attribution in GA4 before you compare channels.
Alternatives and complements to GA4
GA4 is free and familiar, but it's not your only option, and it's never enough on its own:
- Google Search Console shows the searches that surfaced your site and pages Google can't index; GA4 can't. See Google Search Console.
- Your Google Business Profile performance report counts listing calls, directions and website clicks.
- First-party analytics run by a vendor that signs a BAA can count actions on pages GA4 shouldn't touch.
- Your practice-management system remains the only source for completed new patients.
Medfy's Google reporting includes GA4 alongside Search Console and Business Profile in one view, and its first-party analytics counts calls, forms, bookings, directions and visits from AI assistants. To see what's installed on your site today, including tags on patient forms, start with a free marketing audit.
Frequently asked questions
Can a medical practice use Google Analytics 4?
Yes, on the right pages. Google says it does not sign Business Associate Agreements for Analytics and that HIPAA-regulated customers should use it only on pages that are not HIPAA-covered. That means public pages such as your home page, service pages and blog, but not patient portals, appointment forms, booking pages or anything showing patient information. Never send patient details as event data.
How do I track phone calls in GA4?
GA4 can't hear calls, but it can count taps on your phone number. Make the number a tel: link, create an event that fires when someone taps a link starting with tel:, usually through Google Tag Manager, and mark that event as a key event. Then read it by source in the Traffic acquisition report. Calls dialed from your Google listing need its own performance report.
What are key events in GA4?
Key events are the actions you mark as most important to your business, such as a tap on your phone number or a click to your booking tool. In Google's current Help Center, you mark an event as a key event with the star icon in Admin, and you can create Google Ads conversions from key events. Older tutorials call the same idea conversions.
Is GA4 HIPAA compliant?
Not in the sense practices hope. Google states it makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements for it. A practice can still use GA4 on public pages that don't involve patient information, while keeping it off forms, portals and booking flows. HHS guidance on online tracking explains why those pages carry risk.