Is Google Analytics HIPAA Compliant?
Written by Jessica Freeman, Web Designer and SEO Strategist since 2011 • Post Last Updated September 2026
Google Analytics is not HIPAA compliant on its own, and there is no setting that changes that. If you run a private practice and you have GA4 installed on your website, that sentence probably just made your stomach drop a little.
Tracking tools like Google Analytics can inadvertently collect protected health information through form fields, page URLs, and internal search terms, often without anyone touching a single line of code on purpose.
A patient searches “anxiety therapist near me” on your site’s search bar, or lands on a page called /services/eating-disorder-treatment, and that detail can travel to Google along with an identifier tied to their visit.
Google will not sign a Business Associate Agreement for standard Google Analytics, under any plan, including the enterprise-level GA4 360. A BAA is the contract that legally allows a vendor to touch protected health information on a covered entity’s behalf. Without one, sending PHI to that vendor is a violation, full stop, regardless of how careful your setup otherwise looks.
What makes website analytics a HIPAA risk in the first place?
Protected health information does not need anyone’s intention to end up in your analytics reports. It gets there through the basic mechanics of how a website works.
Page URLs are one of the biggest offenders. If your site structure includes paths like /appointment-confirmed?condition=depression or a blog category called /postpartum-anxiety, that string of text travels with every pageview event, whether or not a real name is attached. Form fields do the same thing when tracking scripts scrape input values, sometimes before a patient even hits submit.
Internal search bars are just as risky. Someone typing “medication for panic attacks” into your site search sends that exact phrase to Google as an event parameter.
Does Google Analytics count as a Business Associate under HIPAA?
A Business Associate is any vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. Under HIPAA, a covered entity cannot legally hand PHI to a vendor unless that vendor has signed a BAA agreeing to specific safeguards and reporting obligations, a requirement spelled out in 45 CFR § 164.504(e).
Google Analytics does not meet that bar, and Google’s own terms say so directly. The company states it does not intend for the service to create HIPAA obligations, makes no claim that it satisfies HIPAA requirements, and contractually forbids covered entities from sending PHI or personally identifiable information through the platform. There is a second layer to this, too: 45 CFR § 164.308(b) requires a covered entity to obtain satisfactory assurances, in the form of that same signed BAA, before letting any business associate touch PHI on its behalf in the first place.
Google Cloud Platform and Google Workspace will sign a BAA for tools like BigQuery, Cloud Storage, and Gmail. Google Analytics sits outside that healthcare-eligible umbrella entirely, even though it is made by the same company.
What happens if protected health information ends up in your analytics data?
In practice, this rarely looks like a dramatic hack. It looks like a routine audit, a vendor questionnaire, or a patient complaint that surfaces a data flow nobody had mapped, and once PHI is confirmed inside tracking data, that triggers the same breach notification and reporting obligations as any other unauthorized disclosure under HIPAA.
Kaiser Permanente settled a federal class action tied to tracking pixels on authenticated member portals for between $46 million and $47.5 million. Advocate Aurora Health settled for $12.225 million after browser-side scripts on patient portals and scheduling tools disclosed patient identities and appointment choices. GoodRx paid $1.5 million to the FTC under the Health Breach Notification Rule for sharing prescription and health interest data with ad networks.
Those are enterprise-scale numbers attached to enterprise-scale organizations, but the mechanism causing the exposure, a tracking script sitting somewhere it should not be, is identical to what runs on a lot of solo practice websites. Most of these situations are preventable with the right setup on the front end.
What are HIPAA compliant alternatives to Google Analytics?
General-purpose analytics platforms like Piwik PRO, Mixpanel, and Amplitude will execute a BAA under their standard or enterprise agreements, and they run on dedicated, access-controlled infrastructure built to handle sensitive data. Healthcare-specific platforms like Freshpaint go a step further, acting as a privacy gateway that automatically tokenizes PHI and enforces allowlists before anything reaches a downstream tool like GA4. A server-side Google Tag Manager setup, hosted on BAA-backed infrastructure like GCP or AWS, is a fourth option worth weighing against the two above.
You can also look into smaller companies like Ghost Metrics or Independent Analytics.
Here is how those four options stack up against each other:
| Option | Will sign a BAA? | Typical cost | Implementation difficulty |
|---|---|---|---|
| Google Analytics (standard) | No, under any plan tier | Free | Low, but that low bar is exactly the problem |
| Piwik PRO | Yes, on standard and enterprise terms | Mid-range, tiered by traffic and feature set | Moderate; similar setup curve to GA4 with a steeper learning phase |
| Freshpaint | Yes, purpose-built for healthcare | Mid-to-high, priced for compliance overhead | Moderate; largely handled through their gateway, less custom engineering |
| Server-side GTM on BAA infrastructure | Yes, through the hosting vendor’s BAA (GCP or AWS) | Variable; add cloud hosting and dev time on top of the tool itself | High; requires ongoing engineering maintenance and payload auditing |
Signing a BAA with one of these vendors means the vendor is now contractually and legally on the hook alongside you for how that data gets handled, stored, and protected. It shifts you from “hoping nothing sensitive leaks through” to having a documented, enforceable relationship with the tool touching your patient data.
Most of these tools have a steeper learning curve than GA4’s dashboard, and a few require more setup time than dragging a tracking snippet into your site header. What you gain is a legally defensible position and, in the case of tools like Freshpaint, cleaner data because PHI gets stripped before it ever reaches your reporting layer.
How can you configure Google Analytics to reduce HIPAA risk?
If a full platform switch is not realistic yet, there are configuration changes that cut your exposure. Turning off Enhanced Measurement’s form and site search tracking stops GA4 from automatically scraping input fields and search queries.
Restructuring your URLs so condition names, treatment types, and appointment details never appear in the path or query string removes one of the biggest identifiers Google’s Safe Harbor rule flags. Shortening data retention windows and disabling advertising features like Google Signals limits how long anything questionable sits in your account and how it gets cross-referenced with other identifiers.
None of this adds up to full compliance though. IP anonymization, for example, still lets Google’s servers receive the complete IP address before any truncation happens on the back end, and that initial ingestion is still an unauthorized disclosure without a BAA in place. Configuration reduces what can leak. It does not create the legal agreement that makes leaking acceptable in the first place.
Frequently asked questions
Does using Google Tag Manager instead of the native GA4 snippet change the compliance picture? No. Google Tag Manager is a deployment tool, not a compliance fix. It controls how scripts fire on your site, but it does not change whether Google Analytics will sign a BAA or what data ends up leaving your server. A server-side Tag Manager setup hosted on BAA-covered infrastructure can help de-identify data before it reaches Google, but a standard client-side GTM container carries the same risk as a standard GA4 snippet.
Do solo practitioners face the same risk as larger practices? Yes, and often with less of a safety net. HIPAA does not scale its requirements down for practice size. A solo therapist with a booking page and a blog carries the same statutory exposure as a hospital system, just without a compliance department watching for it. The upside is that a solo practice’s website is usually small enough to audit and fix in a matter of hours.
What should a practice do if it has been running standard Google Analytics for years? Start with an audit, not a panic. Map every page where PHI could realistically show up, whether it is in a URL, a form field, or a search term, then look at your historical data retention settings. From there you can decide whether to reconfigure GA4, route it through a de-identification layer, or migrate to a platform that signs a BAA. Years of exposure is a reason to move promptly, not a reason to assume the damage is already done and unfixable.
Are HIPAA compliant analytics tools significantly more expensive than Google Analytics? Google Analytics is free, so anything is technically more expensive by comparison. In real terms, tools like Piwik PRO and Freshpaint have pricing tiers built for small practices, not just hospital systems, and the cost usually lands well below what a single breach notification and remediation process would run.
Final thoughts
Compliance here is not a box you check once and forget. Retention settings drift, new form fields get added, a developer builds a new landing page with a condition name baked into the URL, and the risk profile shifts again. A periodic review is part of running a practice website, the same way you would periodically review anything else with patient information attached to it.
