See Our Blogs

Google Analytics is risky on a behavioral health website because of how Google Analytics and HIPAA fit together: Google does not offer a business associate agreement for the product and tells HIPAA-regulated customers not to use it in ways that create HIPAA obligations for Google. Its default setup also records page addresses, page titles, and form activity.

What does Google say about using Google Analytics under HIPAA?

Google’s position is direct. Its help page on HIPAA and Google Analytics states that Google “does not offer Business Associate Agreements in connection with this service” and that customers “must refrain from using Google Analytics in any way that may create obligations under HIPAA for Google.” The same page says authenticated pages “are likely to be HIPAA-covered” and should not carry Google Analytics tags.

Google’s warning matters because these tools are everywhere on health websites. A peer-reviewed study by Rutgers Business School researchers, published in December 2025, examined US hospital websites from 2012 to 2023 and found that “66% of the sample employed pixel tracking,” and that third-party pixel use significantly increased data breach risk. The study covered hospitals, and the same analytics and advertising tags can run on any practice website.

Which Google Analytics fields create exposure on a practice website?

Google Analytics creates exposure through the fields it sends automatically on every page, plus optional features a practice or its web developer may have switched on years ago. Google documents the automatic ones in its lists of automatically collected events and parameters:

• Page URL and path, including query parameters such as ?service=adhd-testing
• Page title and the referring page
• Form start and submit events, with form names and destinations
• A cookie-based client ID that recognizes a returning browser
• User-ID, if enabled, which links activity across sessions and devices
• Google Signals, which associates data with signed-in Google users

Google says Google Analytics 4 does not log or store IP addresses, but the visitor’s browser still sends each event straight to Google. On a practice website, a URL like /anxiety-therapy/book combined with a returning-browser ID can describe why someone came.

What should a practice do instead?

A practice should start by finding every place Google Analytics runs, then remove it from patient portals, booking pages, intake forms, and any page where someone can be identified as seeking care. Many practices have never looked. Hilal Atasoy, an associate professor at Rutgers Business School who led the study, said: “Sometimes organizations may not even be questioning every single use of tracking pixels. It’s kind of part of the whole data analytics suite.”

Next, turn off Google Signals, leave User-ID off, and check URLs and page titles for condition names. For measurement that still feeds ad platforms, Beacon’s standard is a server-side setup, under a signed agreement with the tracking provider, that removes names, contact details, and health information, hashes the visitor’s IP address, and forwards only a generic conversion, as explained in What Is Server-Side Conversion Tracking and Why Does Healthcare Need It?

What does this answer not cover?

This answer describes how Google Analytics collects data and what Google says about HIPAA. It does not decide whether a particular website meets HIPAA or any other law. This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

The law on public pages is contested. HHS guidance on online tracking technologies was partly vacated by a federal court in Texas in June 2024, for public pages that connect an IP address to a visit about a health condition. The guidance still says tracking on user-authenticated pages “generally” has access to PHI, and it treats its appointment-booking example as a disclosure of PHI. FTC rules, state privacy laws, and 42 CFR Part 2 are outside this page’s scope.

Frequently asked questions

Can a practice keep Google Analytics on its blog?

Possibly. Google’s guidance says authenticated pages and pages related to providing care are likely to be HIPAA-covered and should not carry Google Analytics tags. A general blog post sits further from care than a booking page, but its URL, title, and cookie data still travel to Google. Beacon’s standard keeps tracking off booking, intake, and portal pages.

Does IP masking make Google Analytics safe?

IP masking alone does not solve the problem. Google says Google Analytics 4 already does not log or store IP addresses, yet page URLs, page titles, form events, and cookie identifiers still reach Google. The exposure on a practice website usually sits in those fields, not only in the IP address.

Are there analytics tools that sign a BAA?

Some analytics and tracking providers do sign business associate agreements. Read what the agreement covers, which data and services it applies to, and who else receives the data before relying on it. What Is a Business Associate Agreement and When Do You Need One? explains the basics.

The difference between client-side and server-side tracking is where website data is processed. Client-side tracking runs vendor code in the visitor’s browser and sends data straight to each vendor, such as Meta or Google. Server-side tracking sends events to a server first, where rules can remove identifying and health details before anything is forwarded.

How does client-side tracking work on a practice website?

Client-side tracking works by loading a vendor’s script, such as the Meta Pixel or a Google tag, in every visitor’s browser. When a page loads or a button is clicked, the browser sends that event directly to the vendor. The practice’s website never sees or edits that data, so whatever the tag collects is what the vendor receives.

Each additional tag adds another vendor. As Maria Zhang, a doctoral candidate at Rutgers Business School and co-author of a study on hospital pixel tracking, put it: “The problem with third-party pixel tracking is that hospitals are sharing patients’ information with so many vendors.”

Defaults decide most of what gets collected. A 2026 study for the ACM Internet Measurement Conference compared Meta Pixel configurations on about 18,000 health-related websites and a control group from 2017 to 2024. It found that features collecting button clicks, page metadata, and first-party cookie identifiers reached adoption rates of up to 98.4%, “largely driven by the Pixel’s default settings.”

How does server-side tracking work?

Server-side tracking moves the collection step off the visitor’s browser. The website sends events to a server container, and that server decides what goes to each ad or analytics platform. Google’s documentation says a server container “runs on a server that you control,” and that only the operator has access to the data “until you choose to send it elsewhere.”

For a behavioral health practice, that control point is where identifying details come out. Beacon’s server removes names, emails, phone numbers, and device or cookie identifiers, along with condition, service, and form detail and any page address that names a condition. The IP address is hashed, and only a generic conversion, such as “appointment request,” goes on.

Hashing is one layer, so contact details are removed outright. Staff in the FTC’s Office of Technology wrote in July 2024 that “hashes aren’t ‘anonymous’ and can still be used to identify users.” The mechanics for paid media are covered in what server-side conversion tracking is and why health practices need it.

How do client-side and server-side tracking compare side by side?

Client-side and server-side tracking can both report conversions, but they handle data very differently at each step. The table below compares the two setups on the points a practice owner or office manager is most likely to ask about first.

One caution belongs with the table. A server can forward identifying data as easily as it can remove it, so a poorly configured server moves the same exposure to a new location. The protection comes from the removal rules on it and the agreements with whoever runs it.

What does this comparison not cover?

This comparison explains how the two tracking methods move data. It does not decide whether a specific practice’s setup meets HIPAA, FTC rules, state privacy laws, or 42 CFR Part 2 for substance use disorder programs. This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

The status of tracking on public pages is contested. HHS guidance on online tracking technologies says tracking on user-authenticated pages “generally” has access to PHI, and in June 2024 a federal court in Texas vacated the part covering certain public pages. The guidance treats its appointment-booking example as a disclosure of PHI, and Beacon’s standard keeps tracking off booking, intake, and portal pages under either method.

Frequently asked questions

Does server-side tracking make a website HIPAA compliant?

No. Server-side tracking is a method of routing data, and HIPAA compliance remains the practice’s obligation as the covered entity. A server that forwards names, email addresses, full URLs, or health details, hashed or not, creates the same exposure as a browser pixel.

Can a practice run both methods at the same time?

Technically yes. Keeping the browser pixel alongside a server setup means the client-side data flow still exists. Beacon’s standard for client paid media is server-side conversion tracking in place of client-side ad pixels, under a signed business associate agreement with the tracking provider.

Who usually sets up server-side tracking?

A developer, an agency, or a tracking provider usually builds and maintains it, because it involves a server, tagging rules, and platform connections. The practice’s role is to approve which events are sent, confirm what is removed or hashed, and keep the signed agreements on file.

When a practice website leaks patient data, HIPAA places the primary obligation on the practice as the covered entity, even if an agency or web vendor built the site. Vendors that handle protected health information (PHI) are business associates with direct duties of their own, and those duties sit alongside the practice’s own obligations.

Who is the covered entity, and who is a business associate?

The covered entity is the practice, when it is a provider that HHS describes as transmitting information electronically in a standard transaction, such as insurance billing. A business associate is a vendor that creates, receives, maintains, or transmits PHI on the practice’s behalf. The HHS Office for Civil Rights (OCR) bulletin on online tracking says a tracking vendor “is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place.”

OCR’s July 2025 settlement with a behavioral health provider began with a website exposure caused by a technical mistake: a coding error in a discontinued patient portal pilot left discharge summaries for 35 people publicly accessible online. The provider paid $225,000 and agreed to a two-year corrective action plan.

“An accurate and thorough HIPAA risk analysis can minimize the exposure of ePHI from both malicious actors and inadvertent errors.” Paula M. Stannard, Director of the HHS Office for Civil Rights, in that settlement announcement

What does a business associate agreement transfer to the vendor?

A business associate agreement (BAA) sets the vendor’s permitted uses of PHI and its duty to protect and report. It adds a second party with obligations, and the practice’s own obligations stay in place. OCR’s fact sheet on business associate liability lists what vendors answer for directly, including “Impermissible uses and disclosures of PHI” and “Failure to provide breach notification to a covered entity or another business associate.”

The practice still has to act on what it knows. Under 45 CFR 164.504(e)(1)(ii), a covered entity that knew of a pattern of a vendor’s material breach is out of compliance unless it took reasonable steps to cure it or, if those failed, ended the contract where feasible.

Beacon’s earlier post, What Is a Business Associate Agreement and When Do You Need One?, covers when a BAA is required.

Who notifies patients when a vendor causes the leak?

The practice notifies patients, because HHS’s Breach Notification Rule summary places that duty on covered entities. They notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. They also notify the Secretary, and prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. Breaches affecting fewer than 500 people can be reported to the Secretary annually.

A business associate that has a breach must notify the covered entity without unreasonable delay and no later than 60 days from discovery. For a practice owner, the practical question is whether each website vendor would report a tracking problem quickly, and whether the contract says how fast.

What does this answer not cover?

This page describes how HIPAA divides responsibility between a practice, its agency, and its web vendors. It does not address who pays for a breach, whether a practice can recover costs from a vendor, or how insurance responds, which turn on contracts and state law.

This page also does not cover practices that are not HIPAA covered entities, substance use disorder programs under 42 CFR Part 2, or duties under FTC and state privacy laws, which can apply on separate terms. It does not assess any specific website or predict the outcome of any pending case. No vendor or tool makes a practice compliant; the obligation stays with the practice.

This page is general information about how HIPAA assigns responsibility for website data and what regulators have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

Is a web developer always a business associate?

Under HHS’s definition, a web developer is a business associate only if it creates, receives, maintains, or transmits PHI for the practice. A developer who builds a brochure site with no forms or tracking may not be. One who hosts intake forms or manages tags that capture patient information likely is.

Does a signed BAA protect the practice if the vendor makes a mistake?

A signed BAA gives the practice contractual promises and makes the vendor’s duties explicit. The practice’s obligations as covered entity remain, including breach notification to patients. Under 45 CFR 164.504(e), the practice must also act if it knows of a pattern of material breach by the vendor.

What should a practice ask its agency about website tracking?

Beacon’s working standard is to ask for a written list of every tag on the site, what each sends, and which pages it fires on. The agency should also confirm that tracking stays off booking, intake, and portal pages, exactly what reaches an ad platform and what is hashed or removed first, and which vendors have signed BAAs.

The case for treating these choices as the owner’s decision is made in The Tracking Code on Your Website Is a Legal Decision.

A practice should plan for January inquiries using its own records, because no reliable industry multiplier exists. Divide each past January’s inquiries by the monthly average from the September to November before it. Average those ratios across two or three years, then apply the result to this fall’s numbers. Finally, convert expected inquiries into booked first appointments and weekly slots.

Why is there no standard number for January inquiries?

There is no standard number for January inquiries because demand shifts from year to year and every practice’s mix is different. The American Psychiatric Association reported in January 2026 that 38% of Americans planned a mental health New Year’s resolution, up from 33% a year earlier. National intent moved five points in a single year, which is reason enough to treat last year’s January count as a starting point.

Local factors move the number further. Specialty, payer panels, age of clients, marketing spend and even a new competitor down the road all change how January lands. APA CEO and Medical Director Marketa M. Wills, M.D., M.B.A., noted in November 2024 that “mental health is often tested over the winter holidays,” but how much of that shows up at any one practice’s door can only be read from that practice’s own history.

What data does a practice need to size January?

A practice needs a monthly count of new inquiries for at least the last two Januaries and the September to November periods before them. An inquiry means one unique person asking about services, whether by phone, web form, email or text. Duplicates from the same person count once.

Phone calls are the easiest to undercount, so pull them from every source available. Google’s Business Profile performance report, for example, shows “the number of times a customer clicked on the call button” for any date range the practice sets. Keep booked first appointments in a separate column for the same months. Sorting inquiries by fit, as described in What Is a Qualified Lead in Behavioral Health?, makes the forecast more useful.

How do you calculate expected January inquiries?

To calculate expected January inquiries, find each year’s ratio of January to the prior fall, average the ratios, and multiply by this fall’s monthly average. The table below is an illustrative example with made-up numbers.

In this example the average ratio is 1.37. If this fall averages 64 inquiries a month, January planning should assume about 88. If last January booked 45% of inquiries, that is about 40 first appointments, or nine to ten a week. Run it in October with the months available, then again in early December with full November data.

What does this answer not cover?

This answer gives a method for forecasting a single practice’s January inquiries from that practice’s own records. It does not publish an industry-wide January multiplier, and the example numbers are illustrative only. A forecast is an estimate, and actual January volume can land above or below it.

The method works poorly for practices less than two years old, practices that added or lost several clinicians in the past year, or practices that changed marketing spend sharply between fall and January. In those cases, treat the result as a floor, compare it with the most recent months of inquiry data, and watch weekly counts closely in early January. It also does not cover how to staff, schedule or follow up on the volume once it arrives.

Frequently asked questions

What if a practice only has one January of data?

One January still gives a usable starting ratio, but treat it as rough. Compare it against any other signal available, such as last December’s call volume or website form submissions. Plan staffing for the high end of a reasonable range, then adjust in early January as actual weekly inquiry counts come in.

Should the forecast count inquiries or booked appointments?

The forecast should count both, in separate columns. Inquiries show how much demand reaches the practice. Booked first appointments show how much of that demand the practice absorbed. A January where inquiries rose and bookings stayed flat points to a capacity or follow-up problem inside the practice.

For turning the forecast into a staffing and scheduling plan, read How Should a Practice Prepare for the January Intake Spike?

Practices run out of availability in January because peak demand arrives when capacity is at its lowest. Clinician caseloads are already full from the fall, holiday time off removes slots, intake assessments bottleneck on a few people, and the insurance deductible reset shifts who books and who cancels. Each of these can be planned for, but only before January starts.

Why are clinician caseloads already full going into January?

Clinician caseloads are already full going into January because clients who started in the fall are still in active care, and few discharges happen over the holidays. Open slots drain steadily from September onward. By the first week of January, a clinician at a busy practice may have one or two openings, or none.

Hiring cannot close that gap quickly. A December 2025 workforce brief from the Health Resources and Services Administration projects that in 2038 the supply of mental health counselors will meet about 55% of demand under current conditions. The practical fix is to count open new-client slots per clinician in November, and to have clinicians review, as a clinical decision, which clients may be ready to reduce session frequency before the new year.

How do holiday time off and intake assessments limit January availability?

Holiday time off and intake assessments limit January availability by cutting the hours available at exactly the moment new clients call. Clinician PTO tends to cluster from mid-December through the first days of January. First assessments usually run longer than a standard session and are often limited to certain clinicians or to one intake coordinator’s schedule.

The new year also brings a fresh wave of callers. APA CEO and Medical Director Marketa M. Wills, M.D., M.B.A., said in December 2024, “A new year brings with it new opportunities but also renewed concerns about the very important issues that impact our lives.” The fix is a PTO rule set in the fall that staggers time off, plus assessment slots spread across more than one clinician for the first three weeks of January.

How does the insurance deductible reset affect January availability?

The insurance deductible reset affects January availability by changing what care costs clients at the start of the year. KFF’s 2025 Employer Health Benefits Survey found that 88% of workers with single coverage have a general annual deductible, averaging $1,886. For clients on those plans, that can mean paying the full contracted rate for sessions until the deductible is met, often in the first months of the year.

When that deductible resets on a calendar-year plan, some current clients may reduce frequency or cancel, which can open slots unevenly. New clients ask more cost questions, and a first appointment booked without verified benefits can turn into a late cancellation. The fix is benefits verification before the first session and a plain explanation of expected cost at booking, so the slots that exist are filled by clients who will keep them.

What does this answer not cover?

This answer covers the operational reasons a practice runs short of new-client openings in January. It does not give billing, insurance or legal advice, and deductible rules differ across employer plans, marketplace plans, Medicare and Medicaid. Some plans do not reset on January 1, and cash-pay practices do not face the deductible effect at all.

It also does not address clinical decisions about discharge, session frequency or level of care, which belong to licensed clinicians. The HRSA figures are national projections and say nothing about any one local market. Practices that run a deliberate waitlist, or programs that admit only by referral, may see different constraints. Nothing here promises a specific number of January openings, and every fix depends on consistent follow-through by the practice’s own staff.

Frequently asked questions

How many new-client slots should each clinician hold for January?

Beacon’s working standard is to set the number from the practice’s own January history rather than a national rule. Count how many first appointments each clinician took last January, compare that to current open slots, and protect the difference on the schedule in November, before existing clients fill it.

Should a practice start a waitlist when January availability runs out?

A waitlist only helps if it stays active. Each person on it needs a follow-up date and, where appropriate, referral options elsewhere. The longer the gap to a first session, the more people drop off, a pattern covered in How Long Should Someone Wait Between Booking and First Session?

For the full plan that ties these fixes together, read How Should a Practice Prepare for the January Intake Spike?

For most therapy practices, the busiest time of year for new clients is January. A smaller rise often comes in late August and September as school routines restart. December often brings cancellations and fewer first appointments, and summer can run slower. Any one practice finds its own answer by counting first appointments by month across two to three years.

What does a typical year look like on a therapy practice’s calendar?

A typical year on a therapy practice’s calendar has one clear peak, one clear lull and two softer swings. The table below shows that shape, and it is the pattern Beacon sees across the behavioral health practices it works with. Every practice should still test it against its own records before planning around it.

A quiet December on the schedule can still be a hard month for some clients. In the American Psychiatric Association’s November 2025 Healthy Minds Poll, 44% of adults said the holidays have a positive impact on mental health and 21% said negative. The month is emotionally mixed, and its busy social calendar squeezes out appointments.

Is summer always the slow season for therapy practices?

Summer is not the slow season for every therapy practice. A child and adolescent practice often tracks the school year, with families pausing in summer and returning in the fall. A practice near a college follows the academic calendar instead. Adult practices in vacation-heavy markets may see a dip that other practices never notice, while a practice with many teachers or school staff as clients may get busier once school lets out.

Seasonal mood patterns also run in both directions. NIH News in Health quoted University of Vermont psychologist Kelly Rohan: “The environmental triggers of SAD include shorter days for triggering winter-pattern SAD and excessive heat and humidity for prompting summer-pattern SAD.” Beacon makes no clinical claims here. For planning purposes, the clients a practice serves shape its calendar more than any national average does.

How can a practice find its own busiest period?

A practice can find its own busiest period by counting first appointments by month for the last 24 to 36 months, using dates from its EHR. Divide each month’s count by that year’s monthly average to get an index. A month that scores above 1.0 in every year is a reliable busy month.

For example, a practice with 600 first appointments in a year averages 50 a month. If January had 70, its index is 1.4, meaning 40% above average. Track inquiries separately from first appointments, because a month with many calls and few openings looks quiet in the EHR. Mark any month when a clinician left or joined so a staffing change is not mistaken for a seasonal pattern.

What does this answer not cover?

This answer describes the common operational calendar of outpatient therapy practices and a method for reading a practice’s own data. It does not cover inpatient, residential, intensive outpatient or crisis programs, which often follow admission patterns set by referral sources and payers. It makes no clinical claims about why individuals start or stop care.

The typical-year table reflects the pattern Beacon sees in its client practices. No published national benchmark confirms it, and some practices will not match it. It also does not explain the capacity reasons a practice runs short in January or how many inquiries to expect. A practice with fewer than two years of consistent records should treat any pattern it finds as provisional until another full year of records confirms or corrects it.

Frequently asked questions

Why do therapy cancellations rise in December?

December cancellations tend to rise because travel, school breaks, family events and year-end work crowd the calendar for clients and clinicians alike. A practice can size the effect by comparing December’s cancellation and no-show rates with other months, using the definitions in What Is a Typical No-Show Rate for Behavioral Health Practices?

How many years of data does a practice need to find its busy season?

Two to three years of intake records is enough for most practices to see a repeating pattern. One year can mislead, because a single clinician departure or marketing change can distort it. If the same months stand out across every year of data, the pattern is reliable enough to plan staffing around.

For how to turn that calendar into a plan, read How Should a Practice Prepare for the January Intake Spike?

Practices wait until January to prepare for January because fall feels calm and the problem stays invisible until the phones start ringing. By then it is too late for the fixes that matter most. Hiring, payer credentialing, schedule templates and holiday coverage all take weeks or months to put in place. For most practices, the real deadline is October.

What has to be decided before January starts?

Four decisions have to be made before January starts: whether to add clinical capacity, whether new clinicians will be credentialed with payers in time, how the schedule will hold new-client slots, and who covers the phones and calendar over the holidays. Each has a lead time longer than the few quiet days between Christmas and New Year’s.

Hiring is the slowest. The U.S. Bureau of Labor Statistics projects that employment of substance abuse, behavioral disorder, and mental health counselors will grow 18 percent from 2025 to 2035, with about 50,500 openings a year. Every practice hiring for January competes for the same people. Credentialing adds more time, and timelines vary by payer, so each payer’s current estimate should be requested before an offer is made.

Why does January planning keep getting pushed back?

January planning keeps getting pushed back because nothing in the fall forces it. The schedule looks manageable in October, and last January’s scramble has faded from memory. Planning also tends to be triggered by volume. When calls pile up, the practice reacts, but by that point hiring and credentialing can no longer help that month.

Prospective clients plan earlier than practices do. In the American Psychiatric Association’s December 2024 Healthy Minds Poll, a third of Americans said they were planning a mental health resolution for the new year. APA President Ramaswamy Viswanathan, M.D., said at the time, “It’s good to see many of us planning to focus on our mental health in 2025.” Many of those people start looking for help in early January, whether the practice planned or not.

What does an October planning deadline look like in practice?

An October planning deadline means each January decision has an owner and a date on the calendar this month. Beacon’s working standard for behavioral health practices breaks the work into three windows.

1. Early October: decide whether to add clinicians or hours, and open any job postings.
2. Mid to late October: set holiday PTO rules, name who answers new-inquiry calls from mid-December through mid-January, and start credentialing for anyone already hired.
3. November: build the January schedule template with protected new-client slots, and write the follow-up cadence the front desk will use.

The owner and office manager can work through all three windows with the tools the practice already has, in a few focused working sessions. The hard part is scheduling those sessions while October still feels quiet, because that quiet is exactly what makes the deadline easy to miss.

What does this answer not cover?

This answer covers the planning calendar for a practice’s intake capacity. It does not give hiring, employment law, licensing or payer contracting advice. Credentialing rules and timelines differ by payer and state, and a practice should confirm current requirements directly with each payer and licensing board.

The October deadline also may not apply to practices that are fully cash-pay, practices that already hold a waitlist they do not intend to reduce, or programs whose admissions are set by referral sources on their own calendars. Group practices with a dedicated operations team may already run this planning cycle. The workforce figures cited here are national projections and do not predict hiring conditions in any one city or specialty, where local supply of licensed clinicians can be tighter or looser.

Frequently asked questions

Is it too late to prepare for January if it is already November?

Much of the work can still be done in November. Schedule templates, holiday phone coverage and a written follow-up cadence can all be set that month. A new hire who needs payer credentialing is less likely to be seeing insured clients by January, so November planning should focus on using existing clinicians’ time well.

Who in a practice should own January planning?

Beacon’s working standard is that the practice owner makes the capacity decisions and the office manager owns the schedule, phone coverage and follow-up plan. When nobody’s name is attached to a task, it waits. One shared document with owners and dates keeps October decisions from drifting into December.

The full case for treating January as a system test is in January Is Coming Whether Your System Is Ready or Not.

Practices miss out on January demand because their intake systems are built for an average month. Calls rise in the first weeks of the year while phones, calendar and follow-up stay the same size. Inquiries reach voicemail, find no open new-client slots, or get one callback and nothing more. Sizing those three systems for January closes the gap.

How does new demand reach practices in January?

New demand reaches practices in January in a short, concentrated burst. The American Psychiatric Association’s December 2024 Healthy Minds Poll found that 33% of Americans planned a mental health New Year’s resolution for 2025, and 31% of that group planned to see a therapist. Those intentions do not spread evenly across the year. They cluster in the weeks right after the holidays.

For example, a practice that handles 40 new inquiries in a typical month has no special process for the week that brings 20 of them in five days. The same front desk, the same callback habits and the same schedule template now have to absorb a volume they were never sized for. Some share of that volume goes somewhere else.

Where do January inquiries get lost inside a practice?

January inquiries get lost at three points inside a practice: the first phone call, the calendar and the follow-up. Beacon has observed across behavioral health practices that a first call reaching voicemail is common, and that a single callback attempt often gets logged as “contacted” even when no one reached the person. A Beacon audit of one client’s inquiries found leads that were never returned at all.

Timing adds pressure. APA President Theresa Miskimen Rivera, M.D., said the holidays are “a time of year that can be fraught with stress for some, driven by various circumstances such as finances, family relations, and grief.” Some of that stress follows people into January. A person who worked up the nerve to call and heard a full voicemail box may not call a second time.

What fixes the gap between January demand and a practice’s capacity?

A written January plan for each of the three leak points fixes most of the gap between demand and capacity. The table below shows where each one breaks and what repairs it.

Speed sits underneath all three. Beacon’s published standard, explained in How Fast Should a Practice Respond to a New Inquiry?, is a response within five minutes, three minutes ideal. In January that standard is harder to hold and matters more, because a prospective client who waits an hour may have called another practice by then.

What does this answer not cover?

This answer covers the operational gap between inquiries arriving and inquiries being booked. It does not cover clinical triage, crisis response, level-of-care decisions or how a clinician should assess a new client. Those decisions belong to licensed clinical staff and to the practice’s own policies.

It also does not apply in the same way to practices that keep a deliberate waitlist, programs that admit only by referral, or practices that already have more January inquiries than clinicians can ethically take on. In those cases the fix may be a clear referral path rather than more intake slots. Nothing here guarantees a specific number of booked clients; results depend on each practice’s market, staffing and payer mix, and on how consistently the plan is followed once January starts.

Frequently asked questions

Should a practice spend more on ads in January?

More ad spend in January only helps if the practice can answer, schedule and follow up with the extra inquiries. Beacon’s working standard is to confirm phone coverage, held intake slots and a follow-up cadence first. Adding volume to a system that is already dropping calls raises cost per booked client.

How many follow-up attempts should a practice make for a new inquiry?

Each practice should set its own written follow-up rhythm with its clinical leadership. Beacon’s suggested starting point is four or five contacts over about five business days, starting within minutes and using text or email only where the person agreed to those channels. An inquiry counts as contacted only when a staff member reached the person.

The bigger picture of why January tests every part of a practice’s system is laid out in January Is Coming Whether Your System Is Ready or Not.

A behavioral health practice can run paid ads, but compliance depends less on the ads than on the data that flows from the website and CRM back to ad platforms. Keyword-targeted search ads are generally workable. Remarketing to past visitors, uploading client lists, and sending identifiable health information to ad platforms are where risk concentrates.

Where does HIPAA risk show up in paid advertising for behavioral health?

HIPAA risk in paid advertising shows up mainly in tracking technology, meaning the pixels, tags, and scripts on a practice’s website that send information about visitors back to ad platforms and analytics vendors. The ad itself is rarely the problem.

The U.S. Department of Health and Human Services addresses this in its guidance on online tracking technologies. HHS states that individually identifiable health information collected on a regulated entity’s website generally counts as protected health information, even when the person has no existing relationship with the practice.

On June 20, 2024, a federal court vacated part of that guidance, specifically the portion treating an IP address combined with a visit to certain unauthenticated public web pages as enough to trigger HIPAA. The rest of the guidance remains posted, and the ruling left open exactly when tracking on public pages triggers HIPAA obligations. Pages where someone schedules an appointment or describes their situation remain the areas of greatest concern.

What do Google’s policies restrict for mental health advertising?

Google’s policies restrict how mental health advertisers can target people, independent of HIPAA. Its health in personalized advertising policy lists counseling services for mental health issues, including depression, anxiety, and addiction, among the health categories it covers.

For those ads, Google does not allow advertiser-curated audiences, including Customer Match, the advertiser’s own data segments, audience expansion, and lookalike segments, because those lists may contain sensitive signals. Predefined Google audiences, such as in-market and affinity segments, remain available because Google excludes sensitive signals from them.

Addiction treatment has an added requirement. LegitScript states that its addiction treatment certification is required to run addiction treatment ads on platforms including Google, Meta, Microsoft Advertising, and Nextdoor, in the United States and Canada. A treatment center without that certification generally cannot run those ads at all, regardless of how its tracking is configured.

What does a compliant paid advertising setup include?

A compliant paid advertising setup sends ad platforms only the minimum information needed for measurement, keeps protected health information inside systems approved to hold it, and is reviewed by the practice’s compliance or legal team before launch.

In practice, that usually means auditing every tag and script on the website, removing tracking from pages where people schedule or describe their needs, and using generic conversion event names. Vendors that receive protected health information need a business associate agreement, covered in Beacon’s page on what a business associate agreement is and when a practice needs one.

Hashing contact details before upload does not resolve the question on its own. [STEPHANIE LAST NAME, TITLE] at Beacon Media + Marketing explains the reason in one line: “The fact that something is hashed doesn’t erase the context around it.” Her article on how to send lead quality back to your ad platforms covers what can and cannot leave a practice’s CRM.

What this page does not cover

This page is not legal advice and does not determine whether any specific practice, website, or advertising setup complies with HIPAA. That determination depends on the practice’s systems, vendors, and agreements, and belongs to its compliance or legal counsel.

It does not cover state privacy and consumer health data laws in detail. Several states regulate health-related data more broadly than HIPAA, and some of those laws apply to organizations HIPAA does not reach. It also does not cover the Federal Trade Commission’s rules for health apps and companies outside HIPAA.

It does not review specific platforms, tag managers, or deidentification vendors, and it does not address Meta, Microsoft Advertising, or other ad platforms’ policies in detail. Each platform maintains its own health advertising rules, and those rules change often enough that the platform’s current policy pages should be checked directly before any campaign launches.

Frequently asked questions

Can a therapy practice use Google remarketing? Google’s health in personalized advertising policy does not allow advertiser-curated audiences, such as remarketing lists built from site visitors or Customer Match uploads, for ads about mental health counseling. Therapy practices can still run keyword-targeted search ads and can use Google’s predefined audiences, which exclude sensitive signals.

Is hashing client data enough to make ad uploads HIPAA compliant? Hashing alone does not make an upload compliant. Hashing changes how an email address or phone number looks, but the context it is paired with, such as an event showing someone sought behavioral health care, can still make it protected health information. Google’s customer data policies also restrict health-related conversions in enhanced conversions.

Can addiction treatment centers advertise on Google? Addiction treatment centers can advertise on Google once they hold LegitScript addiction treatment certification, which LegitScript states is required for addiction treatment ads on Google, Meta, Microsoft Advertising, and Nextdoor in the United States and Canada. Without certification, those ads are generally not permitted to run.

This page is general information about advertising and privacy practices and is not legal or compliance advice. Practices should consult qualified legal counsel about their specific obligations.

An offline conversion event in Google Ads is an outcome that happens after an ad click and away from the website, such as a lead being qualified or a first appointment being scheduled, that is imported back into Google Ads and matched to the original click. It lets the ad platform learn from results a form submission alone cannot show.

How does Google Ads match an offline conversion to an ad click?

Google Ads matches an offline conversion to an ad click through an identifier captured when the person first clicks the ad, most often the Google Click ID, or GCLID. Auto-tagging adds the GCLID to the landing page address, and the practice’s form or CRM stores it with the new lead record.

Later, when the lead reaches a meaningful milestone, the practice or its marketing partner imports a record that ties that GCLID to a named conversion action and the time it happened, with an optional value. Google then credits the original click with the later outcome.

Timing matters. Google’s help documentation states that it retains the GCLID for only 90 days, so a conversion must be imported within 90 days of the click (Google Ads Help, accessed October 2026). Enhanced conversions for leads, which match on hashed contact details instead of the click ID, allow 63 days. A milestone that usually takes longer than that cannot be imported this way.

What changed about offline conversion imports in 2026?

The main 2026 change is where offline conversion data enters Google. Google’s documentation states that starting June 15, 2026, offline conversion imports and enhanced conversions for leads uploads move to the Data Manager API and are blocked in the Google Ads API.

For a behavioral health practice, the practical effect depends on how conversions were being imported. Practices uploading a spreadsheet by hand, or using a supported connection such as a CRM integration managed inside Google Ads, may see little difference. Practices relying on a custom integration or third-party tool built on the older Google Ads API needed that connection updated to keep imports running.

Any practice that was importing offline conversions before June 2026 should confirm with whoever maintains the integration that imports are still arriving. A connection that fails quietly looks like a month with no qualified leads, and the platform stops learning.

Which offline events should a behavioral health practice import?

A behavioral health practice should import the earliest milestone that reliably signals a good fit, usually a qualified lead or a scheduled first session, and should describe it with a generic event name. The goal is a signal that is meaningful enough to improve targeting and frequent enough for the platform to learn from.

“Became a client” is often too rare in a small practice to give an ad platform enough data, while “any form fill” teaches it nothing new. A milestone in between usually works best. The event name should reveal nothing about a condition or service.

Google’s customer data policies also state that conversions related to sensitive categories, including health or medical information, can’t be used for measurement in enhanced conversions. [STEPHANIE LAST NAME, TITLE] at Beacon Media + Marketing sums up the concept: “An offline conversion is simply an event that happens after the initial online conversion.” Her article on how to send lead quality back to your ad platforms walks through the full workflow and what should never leave a practice’s CRM.

What this page does not cover

This page is not a step-by-step setup guide. Import methods, required fields, and interface steps change as Google updates its tools, and the current instructions in Google Ads Help should be followed for any specific setup.

It does not cover offline conversion features on other platforms, including Meta, Microsoft Advertising, or LinkedIn, which use different identifiers, time windows, and policies. It does not address how to grade leads inside a CRM, which is covered in Beacon’s material on qualified lead definitions and CRM fields.

It also does not determine whether any particular data a practice holds is protected health information, or whether a given workflow is permitted under HIPAA or state privacy law. Those questions depend on the practice’s systems and obligations and should be reviewed by its compliance or legal team before any offline conversion workflow goes live.

Frequently asked questions

Do offline conversions in Google Ads require a CRM? Offline conversions require some system that stores the click identifier with each lead and records what happened to that lead later. A CRM is the most common choice. A spreadsheet can work at very low volume, but it tends to break down once several people are updating lead records each week.

Can offline conversions be uploaded to Google Ads manually? Yes. Google Ads accepts manual file uploads as well as scheduled imports and connected integrations. Manual uploads suit practices with low volume or those testing a new conversion action. Scheduled or connected imports are more reliable over time, because a missed manual upload means the platform goes without that month’s signal.

How long does a practice have to import an offline conversion? Google retains the click identifier for 90 days, so conversions matched by GCLID must be imported within 90 days of the click. Enhanced conversions for leads allow 63 days. Milestones that typically take longer than those windows need an earlier event as the imported conversion.

This page is general information about advertising technology and is not legal or compliance advice.