Is Google Analytics HIPAA compliant? Website Tracking Guide for Medical and Dental Practices
By Capital Growth Studio · Published · 5 min read
This article explains what Google and HHS say about tracking tools on medical and dental websites. It also shows how a practice can measure its marketing without tracking patient pages.
HIPAA is a federal law that protects patient health information. A business associate agreement (BAA) is a contract that HIPAA requires. A practice signs it with each vendor that handles its patient information. A tag is code on a web page that sends visit data to a tracking tool, such as Google Analytics.
Google does not claim that Google Analytics is HIPAA compliant. As of October 2026, Google does not offer a BAA for Google Analytics. Google tells HIPAA-regulated customers to use Analytics only on pages that HIPAA does not cover.
Laws change, so check the current rules before you act (links at the end of this article).
Want help with your website analytics? Apply for a free consultation
What does HHS say about tracking tools?
The US Department of Health and Human Services (HHS) published a bulletin on online tracking. The bulletin says HIPAA-regulated practices may not use tracking tools to disclose patient information in ways HIPAA does not permit.
On June 20, 2024, a federal court in Texas vacated (set aside) part of the bulletin. That part applied HIPAA when tracking links an IP address to a public page about specific health conditions or providers. An IP address identifies a visitor's internet connection. The case is American Hospital Association v. Becerra.
HHS withdrew its appeal on August 29, 2024. As of October 20, 2026, the HHS page says that HHS "is evaluating its next steps."
Our guide to advertising Botox explains why Meta may limit tracking on health websites.
Which pages should not have tracking?
Google and HHS describe three kinds of practice pages:
| Page type | HHS bulletin | Google Analytics Help |
|---|---|---|
| Patient portal and other logged-in pages | Tracking there "generally" has access to patient information | Customers "should not set Google Analytics tags on those pages" |
| Booking or symptom pages without a login | Tracking may collect patient information, such as an email address or the reason for a visit | Pages "related to the provision of health care services" are "more likely to be HIPAA-covered" |
| Public pages: services, location, hours, blog | On many of these pages, tracking has no access to patient information | Work with your legal team to find pages that "do not relate to the provision of health care services" |
Your compliance advisor decides which pages fall in each row.
How can a practice still measure its marketing?
Your compliance advisor approves each step below.
- After every website change, list the tags on each page, including tags from plugins and booking widgets.
- Set your tag manager to run Analytics only on approved public pages. A tag manager controls which tags run on each page.
- Send online booking to your patient portal or scheduling software. Count booked visits there, not on the website.
- On public pages, count taps on your phone number and contact form submissions. Keep the contact form short, with no field for symptoms.
HHS describes one more route. A practice can use a vendor that signs a BAA, de-identifies the data and passes on only de-identified data. To de-identify data means to remove the details that identify a person.
As of October 2026, Freshpaint offers a BAA. Piwik PRO offers one on its paid Enterprise plan.
Where can you check the current rules?
Laws and regulations change, and amendments, court decisions or agency guidance can change how a rule applies. We checked the sources in this article on October 20, 2026. Before you act, read the current official text for each place where you work:
- Federal: HHS Office for Civil Rights, online tracking technologies bulletin
- Maryland: Md. Code, Health-General § 4-302 (confidentiality of medical records) and Maryland Online Data Privacy Act, Commercial Law § 14-4701 and following
- Virginia: Va. Code § 32.1-127.1:03 (health records privacy) and Virginia Consumer Data Protection Act, § 59.1-575 and following
- District of Columbia: D.C. Code § 28-3851 (definitions for the data breach notification law; personal information includes medical information)
If your business works in any other state, we strongly recommend that you check that state's current law and its latest amendments, because they may change how these rules apply to you.
Capital Growth Studio is not a law firm. This article is general information, not legal advice. For advice on your situation, speak with a licensed attorney.
Frequently asked questions
Does a cookie consent banner make tracking acceptable under HIPAA?
Not according to HHS. Its bulletin says a banner that asks visitors to accept or reject tracking is not a valid HIPAA authorization. Your compliance advisor decides what your website needs.
Does HIPAA apply to a med spa website?
The answer depends on whether HIPAA covers the med spa. Its compliance advisor answers that question. Outside HIPAA, the Federal Trade Commission (FTC) sued a telehealth company over tracking in July 2026.
