Google does not offer a Business Associate Agreement (BAA) for Google Analytics, and it says so in its own help documentation. So, is Google Analytics HIPAA compliant? No. Google makes no claim that the service satisfies HIPAA requirements and explicitly tells regulated healthcare organizations not to use it in ways that expose protected health information (PHI) to Google, so it belongs only on pages that do not involve PHI.
That creates a practical challenge for telehealth marketing teams that rely on Google Analytics 4 to understand website traffic, campaign performance, and conversions. The distinction between Google Tag Manager and GA4 matters for implementation, but neither familiarity with the tools nor a carefully configured analytics dashboard settles the privacy question. The decision starts with what information a tag collects and whether Google can receive it.
Is Google Analytics HIPAA Compliant? Google and HHS Side by Side
Google's official HIPAA and Google Analytics guidance and the Department of Health and Human Services' online tracking guidance approach the issue from different directions.
Google explains the limits it places on customers using its product. HHS explains what HIPAA requires when regulated organizations disclose patient information through tracking technologies.
| Google says | HHS says |
|---|
| Business associate agreements: Google Analytics is not offered with a BAA, and Google does not represent that it satisfies HIPAA. | Business associate agreements: Tracking vendors handling PHI as business associates require appropriate BAAs, and the underlying disclosure must be permitted. |
| Logged-in pages: Healthcare customers should not place Google Analytics tags on authenticated pages likely to be covered by HIPAA. | Logged-in pages: Authenticated patient pages generally have access to PHI, making tracking disclosures subject to HIPAA requirements. |
| Pages about getting care: Unauthenticated pages connected to healthcare services may be HIPAA-covered and should not carry GA tags when they involve PHI. | Pages about getting care: Booking and symptom tools may disclose PHI when tracking collects identifying information connected to healthcare services. |
| Consent banners: Google's HIPAA help page does not address whether a cookie banner satisfies HIPAA authorization requirements. | Consent banners: An ordinary banner offering visitors the choice to accept or reject tracking does not constitute a valid HIPAA authorization. |
The two sources agree on the essential point: a tracking technology cannot be treated as acceptable for patient information merely because it is widely used on commercial websites.
Regulators have named the tool directly. In July 2023, the FTC and HHS sent a joint letter to approximately 130 hospital systems and telehealth providers warning about tracking technologies, citing the Meta/Facebook pixel and Google Analytics as examples.
A BAA is also more than a general promise to protect data. HHS's business associate guidance explains that covered entities generally need contractual assurances when outside organizations perform services involving PHI on their behalf.
Because Google does not provide that agreement for Analytics, a healthcare team should not design a workflow that depends on sending PHI to the service.
This is where privacy-aware measurement becomes an operational requirement, not a preference. A tag's purpose may be ordinary performance reporting, but the data it transmits determines whether the arrangement is appropriate.
Pages Where GA Can Stay
Google does not tell every HIPAA-regulated organization to stop using Analytics across its entire website.
Instead, its published guidance instructs regulated customers to limit Analytics to pages that are not HIPAA-covered and to avoid collecting or exposing PHI through the service.
That leaves room for certain marketing and corporate website activities, provided the organization has evaluated the pages and the data collected.
The table below sorts common telehealth page types by how Google's and HHS's guidance applies. Treat it as the starting point for the legal review Google recommends, not a replacement for it.
| Page type | GA tag | Why |
|---|
| Homepage, blog, and company pages | Can stay after review | General information; confirm no forms or widgets send health details |
| Careers and press pages | Can stay after review | Check application forms and embedded tools |
| Condition or treatment landing pages | Review first | URLs, form events, and clicks can reveal what care a visitor is seeking |
| Eligibility quizzes and intake forms | Leave untagged | They collect health answers tied to identifiers |
| Appointment booking | Leave untagged | A requested service is linked to identifying details |
| Login and registration pages | Leave untagged | HHS treats credentials and registration details entered there as individually identifiable health information |
| Patient portal and account pages | Leave untagged | Google says authenticated pages are likely HIPAA-covered and should not carry GA tags |
| Order and prescription confirmation pages | Leave untagged | Page titles and URLs can name the treatment ordered |
General Business Pages May Be Candidates
An organization might consider using Google Analytics on pages covering company announcements, careers, press coverage, or other general corporate information.
However, those are examples for legal review, not categories Google has declared universally safe.
A careers page could contain a form collecting applicant details. A corporate page could contain embedded widgets or other technology that changes what gets transmitted. The actual configuration matters.
The organization should establish that the page and its tracking events do not expose PHI or other information prohibited under Google's Analytics policies.
Google specifically advises customers to work with their legal teams to identify pages unrelated to healthcare services.
That means keeping GA on a company-information page is a decision supported by a documented assessment, not an assumption that every public page is unrestricted.
What About Ordinary Landing Pages?
Marketing teams may want to understand what to measure across their campaigns, including visits, navigation, and conversion interest.
But a landing page promoting a medical service is not necessarily equivalent to a general business page.
Its forms, events, URLs, and interactions may reveal that someone is seeking healthcare. Google's guidance warns regulated organizations away from Analytics tags on HIPAA-covered pages related to providing healthcare services.
A single misplaced tag shows how that happens. GA4 records the page URL with every page view, including any query parameters a quiz or form adds, so a tag firing on the wrong page can send details like these:
| What GA receives | Risky setup | Safer setup |
|---|
| Page URL | /quiz/results?condition=hair-loss&email=jane@example.com | /get-started, with no query parameters |
| Event | quiz_answer with "current_medication: finasteride" | start_quiz, with no answers attached |
| Page title | "Jane, your hair loss plan is ready" | "Get started" |
| User ID | The patient's email address or account ID | None set |
Keeping GA off quiz and intake pages prevents the risky column entirely. The safer column describes what a reviewed page that stays tagged should send.
For pages that stay tagged after legal review, tracking whether a form was submitted rather than what was entered keeps field values out of GA.
A June 2024 federal court order narrowed a specific part of HHS's tracking guidance involving IP addresses and visits to public webpages about particular conditions or providers. The ruling did not make every healthcare landing page suitable for unrestricted tracking. OCR withdrew its appeal of that order in August 2024, so the vacatur stands.
For Google Analytics, the practical boundary remains Google's own instruction: do not use the service in a way that gives Google access to PHI.
What Teams Use Instead
Removing Google Analytics from clinical pages does not mean a telehealth business must abandon measurement.
It means the reporting method should match the information being analyzed.
Analytics With an Appropriate Vendor Agreement
Where an organization needs third-party analytics involving PHI, it can evaluate vendors willing to enter into appropriate business associate agreements.
An executed BAA is necessary when the vendor qualifies as a business associate, but the organization must also determine whether the intended use and disclosure are permitted under HIPAA.
The vendor's contractual coverage, data handling, and technical safeguards all matter.
Reporting From the Care Platform
Once someone begins a medical questionnaire or enters a clinical environment, many important operational questions concern the care workflow itself.
For example, a team may want to know how often patients complete intake, whether particular questions confuse, or where eligible patients drop off.
Those questions can potentially be answered from reporting within the clinical platform instead of sending identifiable questionnaire events to an external marketing analytics service.
Bask Health's builder includes analytics that Bask describes as providing HIPAA-compliant insights into patient responses. Its questionnaire tools can help teams evaluate intake engagement and question clarity within the platform. This lets teams understand patient intake behavior without treating Google Analytics tags on clinical forms as the default reporting method.
Aggregated Business Reporting
A telehealth business may also combine appropriate operational reports to understand total orders, campaign-level performance, and overall conversion patterns.
Bask Health's platform documentation lists analytics, cohort tracking, and marketing attribution among its features, which brands can review alongside GA when they need order-level trends.
The goal is to make business decisions using information that does not require transmitting identifiable patient details through page-level analytics tags.
Aggregated reporting still requires care. Small groups, detailed segmentation, or records that can be linked back to individuals may create privacy concerns.
Teams should determine which metrics are necessary, where the underlying data originates, and whether the resulting reports can be used without disclosing PHI to an unauthorized recipient.
The Page List Your Lawyer Needs
Google's advice is straightforward: healthcare customers should work with their legal teams to identify pages unrelated to providing healthcare services.
For a telehealth operator, that review becomes easier when marketing, engineering, and compliance teams start from the same inventory.
The inventory should identify every website page or template that currently loads Google Analytics, including tags activated indirectly through other scripts.
For each page, record whether visitors must authenticate, whether the page collects health-related information, and whether any tracking event could reveal something about an individual's medical care.
Also note whether the page includes appointment scheduling, eligibility questions, symptom questionnaires, or links to a patient account.
Review the site's Google Tag Manager implementation to understand where tags are configured and what triggers them. The inventory should reflect what actually runs on the website, not simply which tags the team intended to deploy.
That review applies to platform connections too. Bask Health's integrations page lists Google Analytics among its analytics connections, so a brand that switches it on through Bask should decide at setup which pages it runs on, rather than after the tag is live.
Include the information that events transmit, such as page addresses, event parameters, identifiers, and form-related values.
The resulting document should make it possible to distinguish general corporate measurement from tracking that reaches clinical information. It should also flag pages that need immediate review because they may expose patient data.
Hand that page-by-page inventory, including tag behavior and data destinations, to legal counsel before deciding where Google Analytics remains appropriate.
FAQs
Can Google Be HIPAA Compliant?
Some Google Workspace services may be used under Google's applicable HIPAA Business Associate Agreement, subject to their eligibility and appropriate safeguards.
Google Analytics is different. Google expressly states that it does not offer a BAA for Analytics and does not represent that the service satisfies HIPAA requirements.
Coverage for another Google product does not extend automatically to Google Analytics.
Is GA4 HIPAA Compliant?
Google Analytics 4 is part of Google Analytics, so Google's published HIPAA position applies.
Google does not offer a BAA for the service and instructs HIPAA-regulated customers not to use it in ways that expose PHI.
A particular GA4 configuration does not change Google's stated contractual position.
Does Removing IP Addresses Make GA HIPAA Compliant?
No. Google's HIPAA guidance does not say that removing IP addresses makes Google Analytics compliant or suitable for collecting PHI. Google's help documentation also notes that "in Google Analytics 4, IP masking is not necessary since IP addresses are not logged or stored," so stripping them changes little.
An IP address is only one possible element of information transmitted through analytics. Identifiers, event parameters, page interactions, and other data may also matter.
Understanding whether information qualifies as PHI requires evaluating its context and the organization handling it.
Google still offers no BAA for Analytics, regardless of how it handles IP addresses.
References
- Google. (n.d.). HIPAA and Google Analytics. https://support.google.com/analytics/answer/13297105?hl=en
- Google. (n.d.). IP masking in Universal Analytics [Legacy]. https://support.google.com/analytics/answer/2763052?hl=en
- U.S. Department of Health and Human Services. (2024). Use of online tracking technologies by HIPAA covered entities and business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
- U.S. Department of Health and Human Services. (n.d.). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
- Federal Trade Commission. (2023). FTC and HHS warn hospital systems and telehealth providers about privacy and security risks from online tracking technologies. https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-hhs-warn-hospital-systems-telehealth-providers-about-privacy-security-risks-online-tracking
