Skip to content
Google Analytics is risky on a behavioral health website because of how Google Analytics and HIPAA fit together: Google does not offer a business associate agreement for the product and tells HIPAA-regulated customers not to use it in ways that create HIPAA obligations for Google. Its default setup also records page addresses, page titles, and form activity.
What does Google say about using Google Analytics under HIPAA?
Google’s position is direct. Its help page on HIPAA and Google Analytics states that Google “does not offer Business Associate Agreements in connection with this service” and that customers “must refrain from using Google Analytics in any way that may create obligations under HIPAA for Google.” The same page says authenticated pages “are likely to be HIPAA-covered” and should not carry Google Analytics tags.
Google’s warning matters because these tools are everywhere on health websites. A peer-reviewed study by Rutgers Business School researchers, published in December 2025, examined US hospital websites from 2012 to 2023 and found that “66% of the sample employed pixel tracking,” and that third-party pixel use significantly increased data breach risk. The study covered hospitals, and the same analytics and advertising tags can run on any practice website.
Which Google Analytics fields create exposure on a practice website?
Google Analytics creates exposure through the fields it sends automatically on every page, plus optional features a practice or its web developer may have switched on years ago. Google documents the automatic ones in its lists of automatically collected events and parameters:
- Page URL and path, including query parameters such as ?service=adhd-testing
- Page title and the referring page
- Form start and submit events, with form names and destinations
- A cookie-based client ID that recognizes a returning browser
- User-ID, if enabled, which links activity across sessions and devices
- Google Signals, which associates data with signed-in Google users
Google says Google Analytics 4 does not log or store IP addresses, but the visitor’s browser still sends each event straight to Google. On a practice website, a URL like /anxiety-therapy/book combined with a returning-browser ID can describe why someone came.
What should a practice do instead?
A practice should start by finding every place Google Analytics runs, then remove it from patient portals, booking pages, intake forms, and any page where someone can be identified as seeking care. Many practices have never looked. Hilal Atasoy, an associate professor at Rutgers Business School who led the study, said: “Sometimes organizations may not even be questioning every single use of tracking pixels. It’s kind of part of the whole data analytics suite.”
Next, turn off Google Signals, leave User-ID off, and check URLs and page titles for condition names. For measurement that still feeds ad platforms, Beacon’s standard is a server-side setup, under a signed agreement with the tracking provider, that removes names, contact details, and health information, hashes the visitor’s IP address, and forwards only a generic conversion, as explained in What Is Server-Side Conversion Tracking and Why Does Healthcare Need It?
What does this answer not cover?
This answer describes how Google Analytics collects data and what Google says about HIPAA. It does not decide whether a particular website meets HIPAA or any other law. This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
The law on public pages is contested. HHS guidance on online tracking technologies was partly vacated by a federal court in Texas in June 2024, for public pages that connect an IP address to a visit about a health condition. The guidance still says tracking on user-authenticated pages “generally” has access to PHI, and it treats its appointment-booking example as a disclosure of PHI. FTC rules, state privacy laws, and 42 CFR Part 2 are outside this page’s scope.
Frequently asked questions
Can a practice keep Google Analytics on its blog?
Possibly. Google’s guidance says authenticated pages and pages related to providing care are likely to be HIPAA-covered and should not carry Google Analytics tags. A general blog post sits further from care than a booking page, but its URL, title, and cookie data still travel to Google. Beacon’s standard keeps tracking off booking, intake, and portal pages.
Does IP masking make Google Analytics safe?
IP masking alone does not solve the problem. Google says Google Analytics 4 already does not log or store IP addresses, yet page URLs, page titles, form events, and cookie identifiers still reach Google. The exposure on a practice website usually sits in those fields, not only in the IP address.
Are there analytics tools that sign a BAA?
Some analytics and tracking providers do sign business associate agreements. Read what the agreement covers, which data and services it applies to, and who else receives the data before relying on it. What Is a Business Associate Agreement and When Do You Need One? explains the basics.