HIPAA-aware Google Ads conversion tracking means measuring appointments and qualified inquiries without sending protected health information to Google through pixels, tags, or URL parameters. HHS OCR has published guidance on online tracking technologies used by HIPAA covered entities and business associates. In practice: use conversion events on generic thank-you pages, avoid diagnosis or treatment details in query strings, do not remarket from condition-specific page visits, and have counsel review the actual tag map. Treat it as education, not legal advice. Catalyze Care’s paid ads management fee is published at $2,500/month (media separate).

In one sentenceTrack the appointment request, not the diagnosis, and keep PHI out of pixels and URLs.

What OCR actually flagged

HHS OCR’s bulletin on online tracking technologies explains that pixels, tags, and similar tools can involve PHI when they connect an individual to a health-related page or record. Covered entities and business associates remain responsible for how tracking technologies on their sites disclose information. Pair that with HHS marketing guidance under the Privacy Rule when communications use PHI.

Source: HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

Source: HHS, Marketing (HIPAA Privacy Rule).

Practical rules for Google Ads conversions

  1. Fire conversions on generic pages. “Thanks, we received your appointment request” is different from a patient-portal event or a form that captures a diagnosis.
  2. No PHI in URLs. Do not append condition, medication, or member ID to the thank-you URL that the tag reads.
  3. Describe the service, not the reader’s condition in ads and keywords where policy allows. Follow Google’s healthcare and medicines policy and any certification requirements.
  4. Skip condition-based remarketing pools built from clinical page visits.
  5. Inventory every tag (Ads, Analytics, call tracking, chat) before assuming “the agency handled HIPAA.”

Source: Google Ads, Healthcare and medicines policy.

Broader pixel context: HIPAA marketing pixels and tracking. Channel guide: paid ads for healthcare practices, explained. Service: paid ads. Service overview: paid ads for healthcare practices. Compliance checklist: healthcare paid ads compliance checklist 2026 (includes call conversions longer than 60 seconds).

What Catalyze Care does (and does not claim)

We set up conversion measurement aimed at appointments and outreach outcomes without diagnosis-level pixels on thank-you pages, and we do not use restricted health-condition targeting. We do not claim an HHS “marketing agency certification.” OCR does not operate one for agencies to badge. Practices should involve their own counsel and privacy officer for BAAs and tag reviews.

FTC note for apps and non-covered entities

If you operate a health app or similar product outside classic covered-entity rules, the FTC’s Health Breach Notification Rule may still apply. Do not assume “we’re not a covered entity” means tracking is unconstrained.

Source: FTC, Complying with the FTC’s Health Breach Notification Rule.

Sources

FAQ

Can I put a Google Ads pixel on every page of a patient portal?

Generally treat portals and pages that reveal clinical context as high risk. Prefer conversion events on public, generic appointment-request thank-you pages. Have counsel review your tag map against OCR guidance. This is not legal advice.

What must never appear in the conversion URL?

Diagnoses, medications, member IDs, or other identifiers that could make the click or page view PHI. Keep thank-you URLs generic.

How does this relate to Catalyze Care paid ads?

Paid ads management is published at $2,500/month (media separate). Tracking is set up to measure appointments without diagnosis-level pixels. Media spend is billed separately by the ad platforms, with a 3-month minimum.