Loading
Know which ads bring transfers and refills, without telling Google or Meta what anyone takes.
Hippo is HIPAA-compliant ad tracking for independent, compounding and online pharmacies. It counts the transfers, refill requests, new patients and calls your ads produce, in an account you own, and keeps patient identities and medication names out of what Google and Meta receive.
No annual contracts.
Transparent pricing.
We set it up for you.
A pharmacy patient starts as a transfer request, and the page it happens on names the prescription
In pharmacy the conversion and the health data are the same page. A transfer form asks for a name, date of birth, current pharmacy and often the drug. A refill link carries the prescription number. A product page and its checkout put the medication in the URL. Much of the rest happens by phone.
Google treats a site that takes refills or transfers as an online pharmacy, and Meta names pharmacies in its health category. The tags an agency installed on those pages send the page and an identifier to both. What the account counts as a conversion, and what that conversion carries, decides whether the numbers mean anything.
What is worth counting:
- a prescription transfer request
- a refill request
- a new patient account
- a call from an ad
What isn't:
- clicks
- page views
- followers
A campaign can fill a feed with likes and never move a prescription.
Here is the sum, with example numbers.
The sum, with example numbers
- Ad spend a month
- $1,500
- Transfer requests
- 30
- Cost per request
- $50
- Requests that become filled prescriptions
- two in three
- A transferred patient costs
- about $75
Example figures. Put in your own. Each line needs a count you trust, and the last one needs the campaign it came from.
Try the sum with your own numbers. If the transfers are not tied to campaigns, that is the gap Hippo closes. It records the transfer, the refill request and the call, ties each to the campaign that produced it, and sends the conversion to Google and Meta without the name, date of birth, phone number, IP address or medication.
What pharmacy owners and their marketers say
They need to know what's working
Owners on thin margins, told to demand campaign numbers from whoever runs the ads.
my main goal was to keep the lights on, take care of my patients, and make sure my team is taken care of.
Pharmacy owner Word to the wise, if you're paying for marketing services, you always want to make sure that they can and will provide campaign analytics for you, because if they can't measure it and report it, the job just isn't complete.
Marketing director, pharmacy cooperative Your dedicated lead tracking phone line will give you the ability to track any incoming traffic that is generated from your ads
Pharmacy software vendor 
They're new to paid ads
Organic reach is gone, and certification comes before the first campaign.
Unfortunately, today it's nearly impossible to find sustainable success on social media without investing in advertising.
Pharmacy marketing columnist LegitScript certification may be required for Facebook and Instagram ads. Certification must be completed by the pharmacy.
Pharmacy marketing agency The previous agency could not get its Google Ads running due to repeated Healthcare and Medicines policy disapprovals.
Agency, on a compounding pharmacy's store
Google and Meta both name pharmacies, and that shapes what you can measure
Google's healthcare policy names online pharmacies first(opens in a new tab) among the businesses it restricts, and in the United States it defines the pharmacy that needs accreditation as one whose site accepts refills, transfers or new prescriptions. Since October 2025 drug names may appear in ads, but keyword-targeting them needs certification(opens in a new tab). Campaigns built on drug terms cannot use your own audience lists(opens in a new tab), prescription conversions cannot be measured with enhanced conversions(opens in a new tab) or uploads, and Google does not offer a BAA for Google Analytics(opens in a new tab).
Hippo changes none of that. It does not certify a pharmacy, change ad approval or audience rules, add words, keywords or claims to your site, or change ad copy. It measures what happens after the click.
Meta
Meta requires online pharmacies to be certified with LegitScript(opens in a new tab) and then authorized before they promote prescription drugs, though over-the-counter products may be promoted to adults(opens in a new tab). Separately, Meta sorts data sources into categories, and its health and wellness category names a pharmacy(opens in a new tab) as an example. That category can block lower-funnel events(opens in a new tab), blocks custom events until they are reviewed(opens in a new tab), and you cannot change the category Meta assigns(opens in a new tab).
Meta's rules name prescription and over-the-counter medication(opens in a new tab) among the information it must not receive, the rule covers the names of your events(opens in a new tab), and its core setup strips anything in a URL after the domain(opens in a new tab). A refill event that names the drug breaks it. Meta states that its own filters are no substitute for yours(opens in a new tab).
An event name, before and after
"Semaglutide refill request"Breaks Meta's terms
A neutral event nameWhat Hippo sends
Sent without the patient's
- name
- date of birth
- phone number
- IP address
- medication
With audiences closed off and lower-funnel events restricted, the events that still flow are what steer bidding. Hippo sends the transfer and the refill request under neutral names with nothing that names the medication or identifies the patient, and keeps a log of conversions by campaign that is yours whatever Meta blocks.
Sources: Google, Healthcare and medicines(opens in a new tab) · Google, Restricted drug terms(opens in a new tab) · Google, Restricted drug terms in personalized advertising(opens in a new tab) · Google, Customer data policies(opens in a new tab) · Google, HIPAA and Google Analytics(opens in a new tab) · Meta, Drugs and pharmaceuticals(opens in a new tab) · Meta, Data source categories(opens in a new tab) · Meta, Data sharing restrictions(opens in a new tab) · Meta, About prohibited information(opens in a new tab) · Meta, Core setup(opens in a new tab). As of 10/7/26.
HIPAA covers every pharmacy that bills insurance, and the cases here reached further
Federal
Where HIPAA applies
CMS names pharmacies among the providers who are covered(opens in a new tab) when they submit claims electronically. HHS says tracking on a page that permits individuals to schedule appointments(opens in a new tab) can reach PHI, that tracking on logged-in pages can reach prescription information, billing information(opens in a new tab) and more, and that a tracking vendor receiving it is a business associate, and a BAA is required(opens in a new tab).
Federal
FTC Act and the Health Breach Notification Rule
For a cash-only pharmacy or a discount platform outside HIPAA, the FTC is the regulator. Its first action under the rule was against a prescription discount platform(opens in a new tab) that shared users' medications with Facebook and Google.
Federal
Federal Wiretap Act
$10,000It allows statutory damages of $10,000(opens in a new tab) per plaintiff, and it is among the claims that went forward against a warehouse chain's pharmacy pages in 2024.
State
California
$5,000The state's privacy law(opens in a new tab) sets $5,000 per violation with no proof of harm, and its medical confidentiality law adds nominal damages of $1,000(opens in a new tab) and applies to a licensed pharmacy whether or not it bills insurance.
State
Washington
The My Health My Data Act(opens in a new tab) covers health data HIPAA does not, which includes the over-the-counter shopper and the cash patient. Washington's Attorney General sent a warehouse chain civil investigative demands in 2024, in connection with the pixel claims over its pharmacy pages.
Enforcement in Pharmacy
GoodRx(opens in a new tab)
$1.5 million
The prescription discount platform shared users' prescription medications and health conditions with Facebook, Google and other ad companies, and showed a seal suggesting it complied with HIPAA. It paid a $1.5 million civil penalty(opens in a new tab), the first under the Health Breach Notification Rule, and the court entered the order(opens in a new tab) in February 2023. It is barred from sharing health data for advertising.
Costco(opens in a new tab)
Pending
Patients allege that the Meta pixel and other trackers on Costco's pharmacy pages sent what they did there, ordering prescriptions, requesting refills and signing up for mail order, to third parties. Costco reports(opens in a new tab) that in November 2024 the court denied its motion to dismiss in substantial part, and that Washington's Attorney General sent it civil investigative demands. The case is pending and the claims are allegations.
Express Scripts(opens in a new tab)
Pending
A patient who filled prescriptions through Express Scripts' online pharmacy alleges that the company configured the Meta pixel on its website and app so that Meta intercepted users' health information. In June 2026 the court let the federal and California wiretap claims proceed(opens in a new tab) as to health information, after a medical-privacy claim had already survived. The case is pending and the claims are allegations.
What the cases have in common:
The pages were where people filled prescriptions.
Refill, mail-order and prescription search pages, an online pharmacy, and a discount coupon.
The tools were ordinary.
The Meta pixel, Google's tags and the analytics on a store.
HIPAA was not needed.
The FTC and state and federal wiretap law reached them.
The laws behind these cases reach any pharmacy whose pages a patient in California or Washington uses, and the FTC's reach is nationwide.
See what your transfer and refill pages send to Google and Meta →(opens in a new tab)How Hippo works
Your website
Book your appointment
Book now
Call us
Booking
Call
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google / Meta
Booking
Call
Remove the pixels that send PHI.
Take the Google and Meta pixels off your site.
Paste one snippet.
Hippo records visits, bookings, and calls, then removes patient names, health details, and IP addresses from the conversion events sent to Google and Meta.
Send clean conversions back to Google and Meta.
Google and Meta receive conversion signals they can use to optimize your campaigns. Patient names, health details, and IP addresses stay out of those events.
With your pharmacy system, your refill app and your phone line untouched. Hippo runs on your own domain and records the transfer request, the refill click and the call. Your pharmacy system, your vendor's refill portal and your checkout stay as they are; what changes is what leaves the page. If an agency or a wholesaler program runs your ads, they keep running them, and you keep the data and the accounts.
The refill portal and patient accounts stay out of Google and Meta entirely. Hippo keeps ad tags off logged-in pages and sends nothing from them.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
What you get
Transfers and refills, by campaign
See which campaigns led to consult requests and bookings, and what each one cost.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of every event that went to Google and Meta and what was removed from it first.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month(opens in a new tab)2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month(opens in a new tab)10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month(opens in a new tab)
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
We take refills and transfers on our website. Are we an online pharmacy to Google?
Yes, by Google's definition. In the United States, Google's healthcare policy(opens in a new tab) describes LegitScript's internet pharmacy certification as available to websites that accept refills, transfers or new prescriptions, and requires LegitScript, NABP accreditation or a .pharmacy domain plus Google's own certification. Certification is between you, the accreditor and Google; Hippo does not change it.
Do we need LegitScript?
For Meta, yes, if you promote prescription drugs or prescription services: Meta requires LegitScript certification(opens in a new tab) and then its own authorization, and NABP does not count there. For Google, LegitScript, NABP or a .pharmacy domain, plus Google's certification. Over-the-counter products can be promoted on Meta to adults without authorization.
Can we put drug names in our ads now?
Since Google's October 2025 update, drug names may appear in ads and on landing pages without certification, but keyword-targeting them needs it(opens in a new tab), and online pharmacies need certification regardless. Drug-term campaigns also lose your own audience lists(opens in a new tab), which leaves the conversion signal from your site as the main thing the campaign learns from.
Our refill app and portal come from our pharmacy software vendor. Isn't that covered?
The vendor's portal is covered by the vendor's agreement with you, for what the vendor does. The ad tags on your website, on your transfer form, your product pages and the pages that link to the portal, are yours. HHS says tracking on logged-in pages can reach prescription information(opens in a new tab). Hippo works on your site's pages and leaves the refill system as it is.
Meta put our pixel in health and wellness. Can we get out?
Meta's definition names a pharmacy(opens in a new tab) as an example, and you cannot change a category Meta assigns(opens in a new tab), though you can ask for a review. Under it Meta may strip everything in a URL after the domain and restrict specific mid- and lower-funnel events(opens in a new tab). Hippo sends events with no medication, no URL path and no identifiers, which is the shape Meta asks for. Which events Meta allows is Meta's decision.
Our agency installed the Meta pixel. Is that a problem?
Pharmacy agencies often install it as a free extra. On a transfer form, a product page or a refill link, the pixel sends the page address and an identifier to Meta, and the Costco claims are about exactly that. Your agency keeps running the campaigns; Hippo replaces what the pixel sends with an event that carries no medication and nothing that identifies the patient, under a BAA.
We're a cash-only compounding pharmacy. Does HIPAA apply?
HIPAA covers a pharmacy that sends standard transactions, such as insurance claims, electronically; one that never does may be outside it. The FTC's GoodRx order(opens in a new tab), a $1.5 million penalty for sharing prescription information with Facebook and Google, did not use HIPAA, and Washington's My Health My Data Act(opens in a new tab) covers health data HIPAA does not.
The lawsuits are against chains. We're an independent.
The claims are defined by what the pages did, not by the size of the company: refill and mail-order pages at a warehouse chain, product searches at drugstores. The federal and California wiretap statutes carry damages without proof of harm, $10,000(opens in a new tab) and $5,000 per violation(opens in a new tab), and California's reaches any site with California visitors.
Our refill pages are behind a login. Doesn't that protect us?
No. HHS says tracking on logged-in pages generally has access to PHI, including prescription information(opens in a new tab). Hippo keeps ad tags off logged-in pages and sends nothing from them; it counts the transfer and the refill request from your public pages.
We have a cookie banner. Is that enough?
Not on its own. HHS says a cookie banner is not a valid HIPAA authorization(opens in a new tab), and a banner does not change what the pixel carries once it fires, such as a drug name in a URL or a product in a checkout event. Hippo waits for consent where it is required and removes identifiers and the medication before anything reaches Google or Meta.
We sell over-the-counter products online. Is that health data?
To Meta, yes: its prohibited list includes prescription and over-the-counter medication(opens in a new tab). A 2023 KFF Health News investigation(opens in a new tab) found drugstore sites sending items such as Plan B and HIV tests to ad platforms. Hippo counts the sale for the campaign without the product name.
Should we talk to a lawyer about the tracking on our website?
Yes, if you want to know how these laws apply to your pharmacy. This page describes laws, policies and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations.
Other industries
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.