How to Run Google Ads for a Healthcare Clinic HIPAA Compliantly

Q: Will Google sign a BAA for Google Ads?

No. Google HIPAA coverage is Cloud and Workspace only. Because there is no BAA, no PHI can reach Google Ads at all.

Last updated: August 10, 2026 · By Jason Garrett, Founder, Coast Studio. Not legal advice — review your setup with healthcare counsel. Full legal landscape: The State of HIPAA Tracking.

Google Ads works for clinics. The default install does not. Google signs no BAA for Google Ads, so the moment a conversion tag carries a condition, an appointment type, or a patient identifier to Google, you have disclosed PHI to a company that never agreed to protect it. The compliant clinic account strips PHI before it leaves your servers, targets on geography and intent instead of health behavior, and measures with scrubbed offline imports. This is the build.

What Google will and won't do

Google's HIPAA program covers Google Cloud and Workspace. It has never covered Google Ads. Google's own position is that advertisers must not send it health information, and its Personalized Advertising policy (updated in 2025) bars targeting built on sensitive health status. Neither of those makes the platform compliant — they put the burden on you. Treat Google Ads as a channel you can use only if PHI never reaches it.

Step 1: Map where PHI hides in a clinic funnel

PHI leaks in places that look harmless:

URLs like /services/std-testing/book — the path names the condition.
Page titles that a tag reads and forwards.
Conversion labels like psychiatry_intake or oncology_consult.
Form fields a tag scrapes on submit.
Call tracking that records or transcribes appointment reasons.

Any of these, joined to an identifier Google already holds, is a disclosure. Inventory them before you touch a campaign.

Step 2: Scrub conversion tracking server-side

The clinic version of conversion tracking sends Google a count, not a story.

Route conversions through your server — server-side GTM in your own cloud, under a BAA with your host — instead of firing the gtag pixel straight from condition pages. See GTM under HIPAA.
Use neutral conversion names. appointment_booked optimizes as well as dermatology_booked and reveals nothing.
Strip the payload: no health-revealing URLs, titles, or parameters. Event, timestamp, value.
Handle Enhanced Conversions with care. Enhanced Conversions hash and send customer data; on a clinic site the fact of the conversion can itself be PHI. Only send hashed identifiers for patients whose consent covers ad-platform sharing, and never tie them to a condition-specific event.
Prefer offline conversion import. Book the appointment in your system, strip it to a neutral "qualified lead" event, and import that to Google via a gclid you captured at click. Google learns a conversion happened, not who or why.

Step 3: Target without health signals

Clinics win Google Ads on intent and geography, not audience surveillance.

Search is your best channel — the searcher declares intent, and you never build an audience from health behavior.
Skip remarketing lists built from condition pages. The list definition encodes health status. If you remarket at all, build from low-risk pages (home, about, insurance) with consent gating.
No Customer Match from patient lists. Uploading patient emails to Google discloses PHI. A pre-care marketing list with ad-use consent is the only version that survives.
Target broad: service-area geography and age, not ZIP-precise or health-interest segments.

Step 4: Fix landing pages and forms

Keep the ad tag and the intake form apart. Ad tags may run on marketing pages; they must never run on a page where a patient enters a condition, books a specific service, or completes intake. Put intake behind a tag-free subdomain. Neutralize condition-specific URLs on any tagged page.

Step 5: Handle call tracking correctly

Most clinic leads are calls, and call tracking is where compliance quietly breaks. Use a call-tracking vendor on its healthcare plan under a signed BAA, keep recordings and transcripts out of any tool that lacks one, and import only a neutral "call converted" signal to Google — never the reason for the call. See call tracking under HIPAA.

Step 6: Write ads that pass review and keep counsel calm

Lead with access: "Same-week appointments. In network with major plans."
Keep condition-specific claims out of ad copy and sitelinks where the policy is strict.
Match ad specificity to a landing page you have cleared of tags and PHI-bearing URLs.
Keep LegitScript certification current for any campaign touching prescription services or addiction treatment — Google requires it.

Already running a standard clinic account?

Pull your conversion action list today and read every label and URL for condition names. Turn off condition-page remarketing lists. Then rebuild tracking server-side before you scale spend. Do the audit with counsel; a conversion label naming a diagnosis is the kind of thing that shows up in a complaint.

FAQ

Is Google Ads HIPAA compliant if I turn off remarketing? Turning off remarketing removes one leak, not all of them. Conversion labels, URLs, and Enhanced Conversions can still carry PHI. Compliance is the whole pipeline, not one setting.

Can I use Enhanced Conversions on a healthcare site? Only carefully. Send hashed identifiers just for consented patients and never attach them to a condition-specific conversion. When in doubt, use scrubbed offline import instead.

Will Google sign a BAA for Google Ads? No. Google's HIPAA coverage is Cloud and Workspace only. Because there is no BAA, no PHI can reach Google Ads at all.

Want the clinic account built right? This is a core Coast Studio build.