Last updated: October 27, 2026 · By Alex Sandev, Founder of HiveSourced. This is general information, not legal advice.
Short answer: Google does not say Google Analytics meets HIPAA requirements, and it asks HIPAA-regulated customers not to send it protected health information. For a typical therapist marketing site, that usually means keeping tracking off anything that touches client information, and thinking hard before adding it to booking or login pages. Here is how to sort out what is safe, with the sources.
Key takeaways
- Google states that it makes no representation that Google Analytics satisfies HIPAA requirements.
- Google also says pages behind a login are likely to be HIPAA-covered and should not carry Google Analytics tags.
- A court ruling in June 2024 narrowed the HHS tracking bulletin for public pages, but it did not turn Google Analytics into a HIPAA-compliant service.
- The safest setup is analytics on public pages only and none on portals, intake forms or booking steps. See our HIPAA email and forms guide.
Is Google Analytics HIPAA compliant?
Google addresses this on its own help page, HIPAA and Google Analytics. In plain terms, it says customers must not use Google Analytics in a way that creates HIPAA obligations for Google, must not expose protected health information (PHI) to Google, and that Google makes no representation that the product satisfies HIPAA requirements. It adds that authenticated pages are likely to be HIPAA-covered and should not carry Google Analytics tags.
So the question is less “is Google Analytics compliant?” and more “what data am I sending it?” A visit to your public About page is a different thing from a client logging in to see appointment details.
What did HHS say about tracking technologies?
The HHS Office for Civil Rights (OCR) published a bulletin on online tracking technologies in December 2022 and updated it in 2024. It is on the HHS site as Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. It covers tools such as analytics scripts and advertising pixels, and it treats them as a HIPAA question when they collect PHI.
A key point is that OCR said covered entities need a business associate agreement (BAA) with a vendor that handles PHI for them. Google does not offer a BAA for Google Analytics, as its help page above makes clear, so PHI should not go there.
What changed with the June 2024 court ruling?
On June 20, 2024, the U.S. District Court for the Northern District of Texas decided American Hospital Association v. Becerra. The court vacated parts of the bulletin, including the view that an IP address collected on an unauthenticated public page can count as individually identifiable health information. HHS OCR withdrew its appeal on August 29, 2024.
What this means for a therapist: the ruling eased the concern about basic traffic data on public pages. It did not change Google’s own terms, and it did not say that sending PHI to Google Analytics is fine. Rules and guidance can change, so check the current HHS page before you decide.
Which pages on a therapist site carry the most risk?
| Page type | What it may reveal | Safer approach |
|---|---|---|
| Home, About, blog | General interest in your practice | Analytics is common here. Disclose it in your privacy policy. |
| Service pages | A visitor looking at a specific concern | Keep event tracking basic. Avoid sending page names that describe a diagnosis with identifiers. |
| Contact and intake forms | Names, emails and symptoms | Do not send form field values to analytics or ad pixels. |
| Booking steps | Appointment time and client identity | Keep analytics off the scheduling tool, or use the tool’s own reporting. |
| Client portal or login pages | PHI | No Google Analytics tags, per Google’s own guidance. |
What about the Meta Pixel and other ad pixels?
The same reasoning applies, and the stakes can be higher because ad pixels are built to match visitors to profiles. Do not place an ad pixel on pages where a visitor shares health details, and do not pass form answers to it. Keep ad pixels off forms and booking pages, and ask your ad platform what data its pixel collects.
Which tools add trackers to a therapy site without you noticing?
Most trackers are not added on purpose. They arrive with a plugin, an embed or a third-party widget, so a site owner can believe analytics is off when it is not. Look for these first:
- Tag managers. Google Tag Manager can load several tools at once, so check what is inside the container, not just that it exists.
- Heatmaps and session recordings. These can capture what a visitor types or clicks, which makes them a poor fit for forms.
- Chat widgets. A live chat box can collect names and messages and pass them to a vendor.
- Video and map embeds. A YouTube or map embed can set cookies as soon as the page loads.
- Booking and payment tools. Scheduling pages often have their own analytics, and your own site tags should not follow clients into them.
What should your privacy policy say about analytics?
Say what you collect, why, and who receives it, in plain words. A short paragraph is enough: that you use analytics on public pages to see how many people visit and which pages they read, that you do not send form contents to analytics tools, and how a visitor can contact you with questions. If you change your tools, update the policy the same day. A privacy policy does not make a risky setup safe, but a missing or inaccurate one makes it worse.
When should you ask a professional?
If you run a larger practice, use ad pixels, or have a client portal, ask a privacy attorney or compliance consultant to review your setup. HiveSourced builds the website and can document what is installed, but we do not give legal advice. The HHS tracking technologies page and Google’s HIPAA and Google Analytics help page are the two sources to bring to that conversation.
How do you set up analytics more safely?
- List every tracking script on your site, including ones added by plugins, booking tools and embedded forms.
- Remove analytics and ad pixels from forms, booking steps and any login area.
- Never put names, emails or symptoms into page URLs or event names.
- Turn off features you do not use, such as advertising features and user-level data.
- Describe your analytics in your privacy policy in plain language.
- Review the list twice a year and after any plugin change.
If you want a privacy-focused alternative, some therapists choose a tool that does not use cookies or profiles. Check the vendor’s own HIPAA statement before you rely on it, since a tool’s marketing page is not a contract.
How does HiveSourced handle this?
Every HiveSourced build includes a HIPAA-compliant contact form, Google Analytics and Search Console setup, and a conversation about which pages should be tracked. Your practice stays responsible for how it handles client information. See custom websites for therapists and pricing, or read the common website mistakes that cost inquiries.
Frequently asked questions
Is Google Analytics 4 HIPAA compliant?
Google says it makes no representation that Google Analytics satisfies HIPAA requirements and asks HIPAA-regulated customers not to expose PHI to it. Treat it as a tool for public, non-PHI pages only.
Can I use Google Analytics on my therapy website at all?
Many practices do on public pages such as the home page and blog, while keeping it off forms, booking steps and portals. Confirm with your own advisor, and mention it in your privacy policy.
Does Google sign a business associate agreement for Google Analytics?
Not for Google Analytics, according to its own help page, which asks customers not to expose PHI to the product. Some other Google products are handled under separate agreements, so check each one.
Did the 2024 court ruling make tracking pixels safe?
No. The court vacated parts of the HHS bulletin about public pages, but Google’s terms still apply and sending PHI to a vendor without a BAA can still be a problem.
Should I remove analytics from my contact page?
Basic page-view data is a judgment call. Never send what a visitor types into a form, and keep ad pixels off that page.
Where can I get help checking my site?
Tell us about your practice on the contact page and we will talk through what is installed and what to change.
