Is Google Analytics HIPAA Compliant? What Healthcare Websites Must Know (2026)

No. Google Analytics is not HIPAA compliant, and it sits outside the services Google's BAA covers. Google's own documentation explicitly states that Google Analytics should not be used to collect protected health information. There is no configuration, setting, or add-on that changes this. If your healthcare website runs Google Analytics and patients interact with it, you have a compliance problem.

Why Google Analytics Fails HIPAA Requirements

Under HIPAA, any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity must sign a Business Associate Agreement before handling that data. Google explicitly declines to sign a BAA for Google Analytics. That alone disqualifies it. But the structural problems go deeper:

PHI is prohibited in Google's Terms of Service. Google Analytics ToS forbid sending personally identifiable information to the platform. On a healthcare website, that restriction is nearly impossible to honor — the data GA collects by default (page URLs, IP addresses, device identifiers, geographic location, referral sources) becomes PHI the moment it is associated with a healthcare context.

Data is sent to Google's servers for Google's purposes. Google retains Analytics data on its own infrastructure and uses it across its product ecosystem. A covered entity cannot control how Google processes that data, which violates the minimum necessary standard.

Page URLs can constitute PHI, depending on the surface and what they carry. When a patient visits /appointments/depression-screening or /services/std-testing, the URL reveals health information. Combined with an IP address, you have an identifier linked to a health condition. That is PHI.

Preventing PHI from reaching Analytics takes deliberate configuration, not defaults. The nature of web analytics on a site that serves patients means behavioral data will inevitably intersect with health information. You cannot sanitize what you cannot predict.

What the 2024 ruling changed, and what it did not

In December 2022 OCR published a bulletin on tracking technologies, updated in March 2024. It is still the document everyone cites. It is also, in part, no longer operative, and most compliance writing has not caught up.

On 20 June 2024 the U.S. District Court for the Northern District of Texas vacated part of it. HHS carries the notice on the guidance page itself: the court vacated the bulletin "to the extent it provides that HIPAA obligations are triggered in 'circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers.'" HHS says it is evaluating next steps.

That is a narrow holding and it is worth being precise about, in both directions.

What was vacated. The theory that an IP address plus a visit to a public page about a condition or a provider is, on its own, enough to make the visit PHI. Under that theory a person reading your public page about knee replacements became a patient for HIPAA purposes because their IP address was in the request. That specific inference no longer carries.

What was not vacated. Everything else. HIPAA still applies where a tracking technology actually receives protected health information in context. The Privacy and Security Rules did not change, the bulletin's other content stands, and the vacatur says nothing about state privacy law, FTC authority under the Health Breach Notification Rule, or the wave of private class actions — several of which plead wiretapping and state-law theories that never depended on the bulletin at all.

What this does not mean. It does not mean Google Analytics is fine on healthcare websites. Google Analytics is not on Google's HIPAA Included Functionality list, so no Workspace BAA reaches it, and Google's Analytics terms independently require that you not pass Google information it could recognize as personally identifiable. Those two facts are unaffected by any court decision about OCR's bulletin.

Where your site actually stands, surface by surface

The mistake the vacated theory encouraged was treating a website as one thing. It is not. Analyze it by surface.

Public, unauthenticated pages. A service page, a blog post, a location page. This is the surface the ruling narrowed. A visitor reading about a condition is not thereby a patient, and IP-plus-page-visit is not by itself the trigger it was described as in 2022. Ordinary measurement here is a materially different risk proposition than it was portrayed as being.

Authenticated areas and patient portals. Untouched by the ruling and the clearest exposure on any healthcare site. Anyone behind a login has an established relationship with you, so page views, session identifiers and user IDs in that context describe an identified individual receiving care.

Forms, intake and appointment flows. Also untouched, and the place practices most often get hurt, because the data is submitted rather than merely browsed. A form field, a query string carrying a service or provider, a confirmation URL containing an appointment ID — these transmit information about a specific person, and analytics tags on those pages capture them.

Anywhere an identifier travels with health information. This is the real test, and it is what survives the ruling intact. It is not about which page. It is about whether what leaves the browser ties a person to their care. A user ID pushed into a GA4 event, an email in a query parameter, a page title containing a patient name — the surface does not matter if the payload identifies someone.

So the question to ask is not "do we run analytics." It is: on which surfaces, carrying what.

What Google Analytics Actually Collects

GA4 captures the following on every page load: IP addresses, full page URLs and navigation paths, device fingerprints (browser, OS, screen resolution, language), referral sources, and geographic location.

On a general-purpose website, this is standard measurement data. On a healthcare website, these data points combine to identify an individual and associate them with specific health information. A visitor's IP address + a page path like /conditions/diabetes-management + a referral from a health-related search query = PHI under HIPAA's definition. GA4 collects all of this automatically, with no way to selectively prevent the health-related data from reaching Google's servers.

Common Mistakes Healthcare Websites Make

These are the configurations that create the most exposure:

Running GA on appointment and scheduling pages. Selecting a provider, choosing a service type, picking a time — every scheduling interaction generates events that GA captures, and those events contain health-related data by nature.

Running GA inside the authenticated portal. This is the strongest case and the one the 2024 ruling leaves entirely intact: everyone behind the login is a known patient, so anything captured there describes an identified individual receiving care.

Collecting form submission events. GA4's enhanced measurement can capture form interactions, including field values. On an intake form, that means diagnostic information flowing to Google.

Relying on IP anonymization as a fix. Even without full IP logging, URL paths still reveal health information and device fingerprints still enable identification. IP anonymization addresses one data element while the PHI pathway remains open.

Using Google Tag Manager to fire multiple tracking pixels. GTM deploys dozens of third-party scripts — Meta Pixel, LinkedIn Insight, retargeting tags — all receiving the same behavioral data, each an additional third party receiving PHI without a BAA.

What You Can Do Instead

Compliant analytics exists. The options are fewer and less feature-rich than GA4, but they provide the traffic data you need without HIPAA exposure.

Self-hosted analytics. Plausible, Matomo, and Fathom all offer self-hosted deployments that keep data on your infrastructure — no third-party BAA needed.

Server-side analytics. Log-based analytics processed on your own servers never transmit visitor data to external parties and can provide page view counts, referral sources, and geographic data.

Consent-based models with proper disclosure. Some organizations implement analytics with explicit patient consent. However, consent does not substitute for a BAA. Even if a patient agrees to tracking, HIPAA still requires a BAA with any vendor that handles PHI. Consent addresses the patient relationship. The BAA addresses the vendor relationship. Both are required.

Where Website Analytics Fits in Your Compliance Program

Your website is a regulated surface. Most compliance programs focus on EHR access, email encryption, and staff training — and overlook the analytics scripts running on every page. That gap is exactly what HHS addressed in its 2022 bulletin. Analytics is one of the surfaces catalogued in which tools can hold patient information, and the answers differ sharply by category.

A complete compliance program accounts for every system that touches patient data, including your website's tracking technologies. Patient Protect monitors your full compliance state — including vendor configurations and data flow mapping — so gaps like uncontrolled tracking scripts are identified before they become enforcement actions.

Frequently Asked Questions

Is GA4 HIPAA compliant?

No. Google Analytics does not appear on Google's HIPAA Included Functionality list in any version, including GA4, so the Workspace BAA does not reach it. The Google Analytics Terms of Service separately require that you not pass, or permit a third party to pass, information Google could use or recognize as personally identifiable — which identifiable health information necessarily is. No configuration or setting changes this.

Can I use Google Analytics with patient consent?

Consent does not make Google Analytics HIPAA compliant. HIPAA requires a BAA with any vendor that handles PHI, and Google will not sign one for Analytics. Consent addresses the provider-patient relationship but does not eliminate the BAA requirement.

Does IP anonymization make Google Analytics HIPAA compliant?

No. IP anonymization removes one data element, but page URLs, device fingerprints, and navigation patterns on a healthcare website still constitute PHI. Anonymizing the IP does not prevent health-related behavioral data from reaching Google through other identifiers.

Is Google Tag Manager HIPAA compliant?

GTM enables the deployment of GA4, Meta Pixel, and other tracking scripts that receive visitor data from your healthcare website. If GTM fires tags that transmit PHI to third parties without BAAs, the compliance violation exists regardless of the delivery mechanism.

What about Google Analytics on non-patient-facing pages?

If a page contains no health information and patients cannot access it, the risk is lower. But GA4 runs site-wide by default and patients may visit any page. Most healthcare websites cannot cleanly separate patient-facing traffic. The safer approach is to assume every page is in scope.

Are there HIPAA-compliant analytics alternatives?

Yes. Self-hosted platforms like Plausible, Matomo, and Fathom keep all visitor data on your infrastructure, eliminating the third-party BAA requirement. Server-side log analysis is another option. The trade-off is reduced feature depth, but the compliance risk is eliminated.

---

Patient Protect tracks your full compliance state, including website and vendor configurations, starting at $39/month.