Loading
Know which ads bring new patients and members, without telling Google or Meta who joined.
Hippo is compliant ad tracking for primary care practices, direct primary care and multi-specialty groups. It counts the appointments, membership enrollments and calls your ads produce, in an account you own, and keeps patient identities and conditions out of what Google and Meta receive.
No annual contracts.
Transparent pricing.
We set it up for you.
A primary care patient starts as an appointment or a membership, and both usually finish in someone else's software
Most practices start advertising when they open, add a clinician or launch a membership program, and the first months decide whether the panel fills. For a practice that bills insurance, the conversion is the booked new-patient appointment. For a direct primary care or concierge practice, it is the membership enrollment, often after a "meet the doctor" call.
The appointment usually finishes in your EHR's patient portal or scheduler, the enrollment on your membership platform's signup page, and many patients still call. What the account counts as a conversion decides whether the numbers mean anything.
What is worth counting:
- a new-patient appointment booked
- a membership enrollment
- a call from an ad that books a visit
- a "meet the doctor" call for a membership practice
What isn't:
- clicks
- signup starts
- page views
A campaign can fill the calendar with existing patients and leave the panel where it was.
Here is the sum, with example numbers.
The sum, with example numbers
- Ad spend a month
- $1,500
- New members or new-patient bookings
- 15
- Cost per booking or enrollment
- $100
- That stay past the first three months
- nine in ten
- A new patient who stays costs
- about $110
Example figures. Put in your own. Each line needs a count you trust, and the last one needs the campaign it came from.
Try the sum with your own numbers. If the new patients and members are not tied to campaigns, that is the gap Hippo closes. It records the call, the appointment and the enrollment, ties each to the campaign that produced it, and sends the conversion to Google and Meta without the name, email, phone number, IP address, doctor or condition.
What primary care physicians and their marketers say
They can't tell what's working
Months of ads, a handful of patients, and no line from the campaign to the panel.
has been advertising on google and facebook/ insta exclusively... However she has only gotten like 4-5 patients in that time
Family member of a direct primary care physician I could have the best pitch, but if a lead does not convert to a customer- it is not always that the pitch is lacking.
Direct primary care physician-owner Did you allocate funds for hiring a firm or individual, or take on the responsibility yourself via social media and/or word of mouth? What has been successful for you?
Nurse practitioner, small practice 
They worry about the tracking itself
Marketers who know the rule and a stack that breaks it without anyone noticing.
Google's official stance is that PHI is categorically prohibited to send to Ads/Analytics services, but it's very easy for a marketing firm to unwittingly do.
Consultant for a pediatric practice Conversion matching quality isn't a fun challenge either. We've landed at 'the practice will have to do that themselves to avoid the privacy obstacles'.
Consultant for a pediatric practice I cannot accept the call and messaging terms due to being a HIPAA covered entity... My support tickets die in the void that is google support and I get ghosted
In-house marketer, healthcare group
Google and Meta treat a primary care site as health content, and that shapes what you can measure
Primary care ads need no certification, but pages about physical health conditions(opens in a new tab), such as diabetes care or weight management, are a sensitive health category, so you cannot use your own audience lists(opens in a new tab) for them: no Customer Match, no remarketing lists, no lookalikes. Health conversions cannot be measured with enhanced conversions(opens in a new tab) or offline uploads, and Google does not offer a BAA for Google Analytics(opens in a new tab). Its one BAA is for Local Services Ads(opens in a new tab), where the lead is a call counted in Google's own dashboard.
Hippo changes none of that. It does not change ad approval or audience rules, adds no words, keywords or claims to your site, and changes no ad copy. It measures what happens after the click.
Meta
Meta sorts data sources into categories, and a site with a patient portal(opens in a new tab) is a named example of the health and wellness one. That category can block lower-funnel events(opens in a new tab) such as Lead and Schedule, blocks custom events until they are reviewed(opens in a new tab), flags a custom conversion that names a condition(opens in a new tab), and you cannot change the category Meta assigns(opens in a new tab).
Meta's rules name medical procedures, treatments and testing(opens in a new tab) among the information it must not receive, the rule covers the names of your events(opens in a new tab), and its core setup strips anything in a URL after the domain(opens in a new tab). An event called "diabetes visit booked" breaks it. Meta states that its own filters are no substitute for yours(opens in a new tab).
An event name, before and after
"diabetes visit booked"Breaks Meta's terms
A neutral event nameWhat Hippo sends
Sent without the patient's
- name
- phone number
- IP address
- doctor
With audiences closed off and lower-funnel events restricted, the events that still flow are what steer bidding. Hippo sends them under neutral names that carry no condition, no doctor and nothing that identifies the patient, and keeps a log of new patients and members by campaign that is yours whatever Meta blocks.
Sources: Google, Health in personalized advertising(opens in a new tab) · Google, Personalized advertising(opens in a new tab) · Google, Customer data policies(opens in a new tab) · Google, HIPAA and Google Analytics(opens in a new tab) · Google, Business Associate Agreements for Local Services(opens in a new tab) · Meta, Data source categories(opens in a new tab) · Meta, Data sharing restrictions(opens in a new tab) · Meta, Restrictions on custom conversions(opens in a new tab) · Meta, About prohibited information(opens in a new tab) · Meta, Core setup(opens in a new tab). As of 10/7/26.
Where HIPAA applies, and the wiretap and medical-privacy laws that apply anyway
Federal
Where HIPAA applies
A practice that submits claims electronically(opens in a new tab) is a covered entity. HHS names the pages that matter: tracking on a page that permits individuals to schedule appointments(opens in a new tab) can reach PHI, tracking on a patient portal's logged-in pages(opens in a new tab) generally does, and a tracking vendor receiving it is a business associate, and a BAA is required(opens in a new tab). A direct primary care practice that bills no plan may sit outside HIPAA; the laws below do not depend on it.
Federal
Federal Wiretap Act
$10,000It allows statutory damages of $10,000 per plaintiff, and no proof of harm. It is the claim that survived against a regional multi-specialty group over a logged-in scheduling page, before the group paid $1.88 million.
State
California
$5,000The state's privacy law(opens in a new tab) sets $5,000 per violation with no proof of harm, and its medical confidentiality law adds nominal damages of $1,000(opens in a new tab) and applies to any licensed physician, whether or not the practice bills insurance. The American Academy of Pediatrics has warned practices about demand letters(opens in a new tab) under the first.
State
Washington
The My Health My Data Act(opens in a new tab) covers health data HIPAA does not, which for a membership practice that bills no plan can be all of it, including the visitor who read your membership page and never joined.
Enforcement in Primary Care
Riverside Medical Clinic(opens in a new tab)
$1.75 million
Riverside Medical Clinic, a California group offering primary and outpatient care, settled claims that the Meta Pixel on its website sent visitors' information to Facebook. The settlement established a $1.75 million fund(opens in a new tab), and the court granted final approval(opens in a new tab) in August 2024.
Duly Health and Care(opens in a new tab)
$1.88 million
Duly Health and Care, an Illinois multi-specialty group, had the Meta Pixel on a logged-in scheduling page and a server-side connection to Meta. After the federal wiretap and negligence claims survived, Duly agreed to a $1,880,000 settlement fund(opens in a new tab), and payments have been issued(opens in a new tab).
Atrius Health(opens in a new tab)
Pending
A patient alleges that Atrius Health(opens in a new tab), a Massachusetts multi-specialty group, ran the Meta Pixel, Google Analytics and other trackers on its website. The case is paused while an appeals court decides a related question. The claims are allegations.
What the cases have in common:
The pages were where patients booked.
The appointment request, the doctor search and the logged-in scheduler.
The tools were ordinary.
The Meta Pixel and Google Analytics, and in one case a server-side connection to Meta. Server-side is not a defense.
The defendants were regional groups.
Medical groups, not national systems, and the pediatric association's warning reaches single practices.
The federal Wiretap Act reaches any practice with a booking or enrollment page, and California and Washington add their own damages.
See what your booking page sends to Google and Meta →(opens in a new tab)How Hippo works
Your website
Book your appointment
Book now
Call us
Booking
Call
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google / Meta
Booking
Call
Remove the pixels that send PHI.
Take the Google and Meta pixels off your site.
Paste one snippet.
Hippo records visits, bookings, and calls, then removes patient names, health details, and IP addresses from the conversion events sent to Google and Meta.
Send clean conversions back to Google and Meta.
Google and Meta receive conversion signals they can use to optimize your campaigns. Patient names, health details, and IP addresses stay out of those events.
With your EHR, your scheduler and your membership platform untouched. Hippo runs on your own domain and records the call, the appointment and the enrollment. Your patient portal, your scheduler and your membership signup stay as they are; what changes is what leaves the page. If an agency runs your ads, they keep their reporting and you keep the data and the accounts.
When the appointment finishes in your EHR's portal or the enrollment on your membership platform's page, Hippo counts it through its scheduling and signup connections, so a booking made off your site still lands on the campaign that produced it.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
What you get
New patients and members, by campaign
See which campaigns led to consult requests and bookings, and what each one cost.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of every event that went to Google and Meta and what was removed from it first.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month(opens in a new tab)2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month(opens in a new tab)10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month(opens in a new tab)
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
We're a direct primary care practice and don't bill insurance. Does any of this apply to us?
HIPAA covers a provider that submits standard transactions such as claims electronically(opens in a new tab); a direct primary care practice that does neither, itself or through a vendor, may not be a covered entity. The laws behind the money paid in primary care do not depend on that: Riverside Medical Clinic settled under California's wiretap and medical-privacy laws, and Duly's surviving claim was under the federal Wiretap Act. Washington's health-data law covers exactly the data HIPAA does not.
Our members enroll on our membership platform's signup page. Can that be tracked?
Yes, and it is the page to be careful with. Membership platforms let practices paste tracking code onto their signup pages, where members enter their name, contact details, often insurance and their choice of doctor. A pixel there tells Meta that a named person is joining your practice. Hippo counts the enrollment by campaign and sends Google and Meta an enrollment event with the identifiers, the doctor and the membership ID removed.
Our new patients book in the EHR's patient portal. Can you count those bookings?
Yes. Portal schedulers run on the EHR vendor's site or inside a frame on yours, where your page's tags cannot see the confirmation. Hippo counts the click and the call from your pages and the completed booking through its scheduling connections, so the campaign report shows appointments, enrollments and calls together.
Our patient portal is on the same website as our marketing pages. Does that matter?
Yes. HHS says tracking on a patient portal's logged-in pages(opens in a new tab) generally has access to PHI, and that part of its guidance still stands. Duly's pixel sat on a logged-in scheduling page, and that is where the federal wiretap claim survived. Hippo keeps ad tags off logged-in pages and sends nothing from them, so the portal stays out of what Google and Meta receive.
Meta cut our appointment and lead events. Can Hippo get them back?
No. Hippo cannot lift a category Meta has assigned, and you cannot change it(opens in a new tab) either; under the health and wellness category Meta blocks specific mid- and lower-funnel events(opens in a new tab). What a compliant feed changes is what still flows: a booking sent with no condition or doctor in the name, no URL path and nothing that identifies the patient, and a log of new patients by campaign that is yours whatever Meta blocks.
Our agency runs the ads. Who installs this, and who owns the data?
We install it for you on a subdomain of your own domain; the agency keeps running the campaigns and sees the same conversions in Google Ads and Meta. The account, the conversions and the log are yours, whichever agency you work with next year.
The lawsuits are against big health systems. We're one practice.
The settled cases in primary care are regional medical groups, not national systems: Riverside Medical Clinic paid $1.75 million and Duly $1.88 million. The American Academy of Pediatrics has warned its member practices(opens in a new tab) about demand letters under California's privacy law over analytics tools and advertising pixels, and says practices nationwide are targeted if California residents use their sites.
Our booking page has a Find-a-Doctor search. Is that a problem?
It can be. The cases in this industry name exactly these pages: searching for a doctor, booking an appointment and the scheduler behind it. A doctor's name or specialty in an event tells an ad platform what the visitor came for. Hippo strips the doctor, the specialty and the search terms from the event before anything leaves.
We added a weight-management program. Does that change anything?
Yes, in two places. Google treats health conditions(opens in a new tab) as a sensitive category, which removes customer lists and remarketing for those campaigns and bars those conversions from enhanced conversions. Meta flags custom conversions that reference a condition(opens in a new tab) and bans condition words in event names and URLs. Advertising a prescription drug needs separate platform certification, which Hippo does not handle; Hippo keeps the program name out of the events it sends.
We have a cookie banner. Isn't that consent?
Not for what the booking page sends. HHS says a cookie banner is not a HIPAA authorization(opens in a new tab), and the wiretap claims turn on what the page disclosed, which a banner does not change. Hippo waits for consent where it is required and removes identifiers before anything reaches Google or Meta.
Should we talk to a lawyer about the tracking on our website?
Yes, if you want to know how these laws apply to your practice. This page describes laws, policies and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations.
Other industries
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.