UTM parameters: tag your links so you know what brings patients

What UTM parameters are

A UTM-tagged link looks like this (on an illustrative domain):

https://www.example-practice.com/?utm_source=google&utm_medium=organic&utm_campaign=gbp-website

Everything after the ? is labels. The page loads normally; your analytics reads the labels and files the visit under that source. Calls, forms and bookings that follow can then be credited to it.

Without tags, many visits arrive as "direct" or get lumped into broad buckets. That's the gap UTM tracking closes, and it's a building block of marketing attribution and of measuring marketing ROI.

The five parameters and when to use each

Google Analytics Help lists the campaign URL parameters (opens in a new tab) it reads. The classic five:

Google says you "should always use utm_source, utm_medium, and utm_campaign," and that missing parameters produce "(not set)" values in reports. It also strongly recommends utm_id (a campaign ID) and utm_source_platform (the platform directing the traffic). Two newer ones, utm_creative_format and utm_marketing_tactic, exist but Google says they aren't currently reported in Analytics, so skip them.

Google Ads doesn't need UTM tags. Auto-tagging (opens in a new tab) adds a click ID (GCLID) to ad clicks automatically and is on by default for new accounts; Google says GA4 prioritizes auto-tagging over manual tags.

The links every practice should tag

Follow these steps once, then reuse the links.

1. Google Business Profile website link. The most valuable tag a practice can add, because listing visits otherwise blend into Google search. https://www.example-practice.com/?utm_source=google&utm_medium=organic&utm_campaign=gbp-website
2. Google Business Profile appointment link, if you use one. Give it its own campaign value. https://www.example-practice.com/book/?utm_source=google&utm_medium=organic&utm_campaign=gbp-appointment
3. Meta ads. Add the tags in the ad's URL parameters field, or on the destination URL. https://www.example-practice.com/new-patients/?utm_source=facebook&utm_medium=paid-social&utm_campaign=2026-11-new-patients&utm_content=carousel-a
4. Your newsletter or email links. https://www.example-practice.com/blog/fall-hours/?utm_source=newsletter&utm_medium=email&utm_campaign=2026-11-newsletter
5. Directory profiles you control (specialty directories, insurer directories): utm_source=directory-name&utm_medium=referral.
6. Printed QR codes on cards or signage: utm_source=qr&utm_medium=print&utm_campaign=front-desk-card.

Why those mediums? GA4's default channel group (opens in a new tab) puts a medium of exactly "organic" into Organic Search, "email" into Email, "referral" into Referral, and a social source with a medium starting "paid" into Paid Social. Matching those rules keeps your channel reports tidy.

Google's listing guidelines don't address tracking parameters; they do ban URLs that redirect users to landing pages (opens in a new tab). A tag on your own page's address isn't a redirect. To see what the listing reports on its side, track Business Profile clicks in its performance report.

A naming convention you can keep

Write the rules down and stick them next to whoever edits links:

• Lowercase only. Mixed capitals ("Facebook" vs "facebook") can split one source into two rows in reports.
• Hyphens, not spaces. new-patients, not new patients.
• Fixed source names: google, facebook, instagram, newsletter, qr, and each directory's short name.
• Fixed mediums: organic, paid-social, email, referral, print.
• Campaigns start with the year and month for anything time-bound: 2026-11-new-patients. Evergreen placements get a plain name: gbp-website.
• Neutral campaign names. Describe your marketing (an offer, a month, a placement), not a patient or a condition.
• One shared sheet listing every tagged link, where it lives and when it was created.

Seeing UTM data in GA4

GA4 files tagged visits automatically. To find UTM data in GA4:

1. Open Reports → Acquisition → Traffic acquisition. Google's help describes this Traffic acquisition report (opens in a new tab) as showing where new and returning users come from.
2. Change the table's dimension to Session source / medium to see google / organic, facebook / paid-social and so on.
3. Switch to Session campaign to compare gbp-website with gbp-appointment.
4. Add your key events (calls, bookings) as columns to see which tagged links produced actions.

New tags can take up to a day to appear in standard reports; the Realtime report shows them sooner.

Medfy's first-party analytics attributes visits and actions (calls, forms, bookings and directions) by source on your own site; tagged Business Profile links make that attribution clearer.

What never to put in a URL

URLs travel. They're stored in analytics, server logs, browser history and, when a pixel is present, sent to ad platforms. HHS's guidance on online tracking technologies (opens in a new tab) warns that tracking tools on pages where patients schedule appointments or log in can receive protected health information, and that vendors who receive it need a Business Associate Agreement.

Never put these in a URL or a UTM value:

• names, email addresses or phone numbers;
• dates of birth, insurance member IDs or account numbers;
• conditions, symptoms or reasons for visit;
• appointment dates, times or provider-plus-patient combinations;
• anything a patient typed into a form.

Common mistakes that leak or muddle data:

• Forms that submit with GET, which put field values into the address bar. Forms should submit with POST.
• Thank-you pages that echo details in the URL, like ?name=…&service=….
• Tagging internal links between your own pages, which muddles the original source of the visit.
• Inconsistent spelling, which splits one source into three rows.

Not sure what counts? See what counts as PHI. This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

A free marketing audit checks your site's tracking setup, including pixels on patient forms.

Frequently asked questions

What are UTM parameters used for?

UTM parameters are short labels added to the end of a link that tell your analytics where a visit came from, such as your Google listing, a Meta ad or your newsletter. When someone clicks the tagged link, the labels travel with the visit, so calls, forms and bookings that follow can be credited to the right source instead of showing up as direct or unknown traffic.

Should I add UTM tags to my Google Business Profile link?

Yes. Without a tag, visits from your listing usually blend into ordinary Google search traffic, so you can't see how many patients the listing itself sends to your website. Add a tag such as utm_source=google, utm_medium=organic and utm_campaign=gbp-website to the website link, and a separate campaign value to the appointment link if you use one.

Do UTM parameters affect Google rankings?

They are not a ranking tool. UTM parameters only label visits for your analytics; they don't tell Google anything about the quality of your page. Use them on links you place elsewhere, such as listings, ads and emails, not on links between pages of your own site, and keep your site's canonical tags pointing to the clean version of each page.

Can UTM parameters create HIPAA problems?

They can if you put patient information in them. URLs, including their parameters, are collected by analytics tools, server logs and sometimes ad platforms. Never include names, emails, phone numbers, conditions or appointment details in a URL or a UTM value. Tag links with the source, medium and campaign only, using neutral campaign names that describe your marketing, not your patients.