How to Measure Ad ROAS Without Sending PHI to Ad Platforms

Last updated: August 10, 2026 · By Jason Garrett, Founder, Coast Studio. Not legal advice — review your setup with healthcare counsel. Full legal landscape: The State of HIPAA Tracking.

You can prove paid media works without telling Meta or Google who converted. The reflex — wire every purchase back to the platform at the user level — is exactly what sends PHI to companies that sign no BAA. Health advertisers measure a level up: scrubbed conversion counts for optimization, geo experiments for truth, and first-party attribution you own end to end. This is how to run that stack, and how to defend it to a CFO.

Why user-level attribution is the problem

User-level attribution needs a shared key — an identifier the platform can match to a person. On a health site, "this identified person converted on a page about this condition" is PHI the moment it leaves your walls. Neither GA4 nor the Meta pixel comes with a BAA, so the honest options are to stop sending the identifier or to stop sending the health context. Good measurement does both and loses almost nothing.

Layer 1: Scrubbed conversion signals for optimization

Platforms need a feedback signal to optimize delivery. Give them a clean one.

Server-side, PHI-stripped events through a gateway you control — event name, timestamp, value, nothing health-revealing. See Meta CAPI and Google Ads conversions.
Neutral event names so the schema itself discloses nothing.
Modeled conversions: both Meta and Google now model conversions from aggregate signal. Modeling is a feature here, not a loss — it optimizes without a per-user key.

This layer runs the auction. It is not your source of truth for whether the spend paid off.

Layer 2: Geo experiments for the truth

The cleanest read on incrementality touches no user data at all.

Split your service area into matched test and control regions.
Run the campaign in test only for a set window.
Compare total signups — from your own system — between the groups.

The lift is your incremental return. Nobody's identity leaves your infrastructure, and the answer survives a subpoena. Geo holdouts also settle the argument platform ROAS columns start: "would these patients have come anyway?" A holdout answers it; an attribution model assumes it away.

Layer 3: First-party attribution you own

Close the loop inside systems under your control and BAAs.

Capture the click ID (gclid, fbclid) at landing and store it with the lead in your own database, not the ad platform.
Add a self-reported field — "How did you hear about us?" — at signup. Crude, durable, and immune to signal loss.
Join spend to outcomes in your warehouse, under a BAA, and report blended CAC and channel contribution from there. Coast Studio builds this dashboard layer for health clients so the numbers live where PHI is allowed.

Layer 4: Marketing mix modeling at scale

Past a few hundred thousand in monthly spend, a marketing mix model reads channel contribution from aggregate spend and outcome data — no user-level tracking, no PHI. It answers the budget-allocation question across channels that per-click attribution was never allowed to answer for a health brand.

The CFO conversation

Finance leaders accept this faster than marketers fear. A geo-lift readout — "paid drove 312 incremental signups at a $47 blended CAC, measured against a holdout" — is more defensible than a platform ROAS column built on attribution the platform grades itself on. You trade a vanity number you could not legally source for a real one you can. That is a better meeting, not a worse one.

FAQ

Won't campaigns underperform without full conversion data? Rarely. Server-side scrubbed events plus platform modeling keep optimization running, and most health accounts see steady or better performance after the move because server events survive ad blockers and cookie decay.

Is modeled or aggregate data accurate enough to run a business on? For budget decisions, geo experiments and a mix model are more accurate than user-level attribution, which overcounts platform-claimed conversions. Use modeled data to steer delivery and experiments to steer budget.

Do I still need consent for any of this? Yes for anything that sends hashed identifiers, even scrubbed. Geo experiments and self-reported attribution need none, which is part of why they are the backbone.

Want a measurement stack that holds up under HIPAA? This is a core Coast Studio build.