Loading
HIPAA Compliant Conversion Data for Contact Form 7
Hippo counts the submissions from your Contact Form 7 forms as conversions and sends them to Google Ads and Meta with no protected health information. Its script works on your page, so no Contact Form 7 add-on is needed, and you see which campaigns bring patients, in an account you own.
No annual contracts.
Transparent pricing.
We set it up for you.
Contact Form 7 Is Not HIPAA Compliant by Default
As of 10/13/26, Contact Form 7 publishes no HIPAA statement and no BAA offer. It emails submissions to the address you set, and what Google Ads and Meta learn from your form comes from code added to your site.
Page scripts
Code on the page gets every field
When a visitor sends the form, Contact Form 7 hands everything they typed(opens in a new tab) to any script on the page that listens for the submission. A snippet added to count the form as a conversion can read the name, the phone number and the message itself.
Redirect add-ons
The thank-you address can carry what was typed
A redirect add-on for Contact Form 7 can put what people typed into the address of the page they land on next. A Google tag on that page passes the address to Google(opens in a new tab), typed details included.
Tracking add-ons
The form's title can tell Meta the treatment
A tracking add-on can send Meta the title of the form with the event, so a form called "Dental implant consultation" names the treatment. Meta's terms bar data that includes or is based on health information(opens in a new tab).
How Hippo sends Google Ads and Meta your contact form conversions
Your website
Book your appointment
Book now
Call us
Form
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads and Meta
Form
The ad tags come off.
We remove the Google tag, the Meta (Facebook) Pixel and the code that reports your contact forms to Google Ads or Meta, and install Hippo on a subdomain of your domain with whoever looks after your WordPress site. Tools you keep, like a scheduler or a payment form, keep their own code.
Hippo counts the submission.
When a patient who clicked your ad sends one of the contact forms you chose, Hippo's script on your page counts the submission as a conversion.
Hippo cleans the conversion.
Hippo prevents protected health information from reaching Google Ads and Meta and gives each contact form conversion a name that implies no condition, treatment or service, whatever the form is titled.
Google Ads and Meta get the conversion.
Hippo sends it from its server and keeps its own record of it by the campaign that produced it. Whoever runs your ads sees it arrive in Google Ads and in Meta's Events Manager.
What Google Ads and Meta receive
Sent
Sent: conversions from the contact forms you choose, with no protected health information
Hippo sends Google Ads and Meta conversions only for the contact forms you allow, each under a neutral name. Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses, plus URL paths and anything typed into a form.
Held
Held until you allow it
An event Hippo doesn't recognize stays in Hippo, so a new contact form can't start sending to Google Ads or Meta on its own.
Kept
Kept in Hippo, under your BAA
Hippo stores what it records in its own storage under the BAA it signs with every customer, with a log of what Hippo sent Google Ads and Meta and what it removed first.
What health practices and their marketers say about contact forms
They can't tell what's working
Campaigns keep running, and nobody can tie the contact forms to them.
The key is making sure your conversions are tracking properly.
Marketer advising a therapist Where the answers go
The answers go to an inbox, a database or a sheet, and to any code on the page that listens for the form.
For now, the only interaction I need with potential clients is the contact widget and, ideally, the ability to email from the admin account. Both would need to comply with HIPAA guidelines.
Therapist who built the site Any tips on a HIPAA-compliant way to get data from a Contact Form 7 form into a Google Sheet?
WordPress site owner
Contact form data lawsuits and settlements on health sites
BetterHelp(opens in a new tab)
$7.8 million
The FTC charged that the online counseling service disclosed consumers' email addresses, IP addresses and health questionnaire information to Facebook, Snapchat, Criteo and Pinterest for advertising. The FTC finalized the order requiring that payment in July 2023.
Joyous(opens in a new tab)
$400,000
A patient alleged that the ketamine therapy service put the name each patient entered when booking into the address of the pages that followed, which reached Meta and Google. Joyous agreed to a $400,000 settlement fund(opens in a new tab), and the court granted final approval(opens in a new tab) on December 15, 2025.
Google and Meta (BlueChew site)(opens in a new tab)
Pending
Patients allege that Meta's and Google's tracking code on BlueChew's erectile dysfunction prescription site captured their names, dates of birth and email addresses as they filled in its medical profile questionnaire. In July 2026 the court refused to throw out the case(opens in a new tab) against both companies.
InVia Fertility Specialists(opens in a new tab)
Pending
A patient alleges, in the original complaint(opens in a new tab), that tracking tools on the fertility clinic's website told Meta and Google when patients submitted its appointment request forms.
None of them names Contact Form 7, and each concerns a form or questionnaire people filled in.
See what your site sends to Google and Meta(opens in a new tab)What you get
Contact form leads, by campaign
Hippo records each contact form lead it counts against the campaign that sent the visitor, in a record you own, whatever Google Ads and Meta do with the conversion.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of what Hippo sent Google Ads and Meta and what it removed first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is Contact Form 7 HIPAA compliant? Will it sign a BAA?
Contact Form 7 publishes no HIPAA statement and no BAA offer. With its default configuration, the plugin in itself writes no personal data to the database(opens in a new tab), and what people submit through it is collected by you(opens in a new tab), the site owner. Hippo signs a BAA with every customer and sends Google Ads and Meta your contact form conversions with no protected health information.
Do we need a Contact Form 7 plugin or add-on for Hippo?
No. Hippo's script counts the submission on your page, so no Contact Form 7 add-on or plugin is needed. Contact Form 7 sends no conversions to Google Ads or Meta on its own; that takes code added to your site, which comes off during setup. You choose which contact forms count, such as the consultation request while the careers form stays out, and Hippo sends Google Ads and Meta conversions only for those.
What happens to the Meta Pixel, the Google tag and the tracking add-on already on our site?
They come off. During setup we take off the code that reports your contact form to Google Ads or Meta, such as a pixel listener, a tracking add-on or the Google tag, so it and Hippo do not both report the same submission. Tracking code with no BAA behind it comes off the same way. Hippo puts no ad pixel or Google tag on your pages. Sending the same conversion from a server-side plugin changes the route and leaves what it carries as it was.
What do Google Ads and Meta receive from a contact form?
Hippo sends them a conversion for the contact forms you choose, under a name that implies no condition, treatment or service, as Meta's terms require(opens in a new tab) of event names. Hippo prevents protected health information from reaching Google Ads and Meta: names, emails, phone numbers, dates of birth and IP addresses come off first, and the conversion carries no URL path and nothing typed into the form. Google Ads and Meta are outside the BAA you sign with Hippo; Hippo controls only what it sends them.
Who sets this up, and what changes on our WordPress site?
We do, with whoever looks after your WordPress site. Whoever controls your domain adds a DNS record for your Hippo subdomain. We install Hippo on that subdomain, take the Google tag and the Meta Pixel off your pages and agree with you which contact forms count as conversions. If a redirect add-on puts what people typed into your thank-you address, we go through it with you during setup.
Our agency runs our ads. What do they see, and do we keep the record if we switch agencies?
Whoever runs your ads sees the conversions arrive in Google Ads and in Meta's Events Manager. Hippo also records each contact form lead it counts against the campaign that sent the visitor, in your own Hippo account, so the record stays with you if you change agencies.
Our contact form just emails us. Does Hippo touch that email?
No. Hippo does not touch the email Contact Form 7 sends you or your mail settings, and Contact Form 7 keeps emailing each message to the address you set(opens in a new tab). Each field you place in the email template is filled with what the visitor typed(opens in a new tab), so the email carries the message itself, and files a visitor uploads go out as attachments when you add them to the email. For the contact forms you choose, Hippo counts submissions on your page and sends Google Ads and Meta conversions with nothing typed into the form.
Does Hippo store our submissions or replace Flamingo? Does its BAA cover our inbox or host?
Hippo stores what it records in its own storage under your BAA, and it does not replace Flamingo. By default Contact Form 7 keeps no copy of a submission(opens in a new tab); Flamingo(opens in a new tab), a second plugin by the same author, saves the messages sent through your contact forms in your WordPress database. Hippo's BAA covers Hippo. A vendor that stores PHI for you, such as the host that keeps the Flamingo database, signs its own BAA.
Is a note telling visitors not to type health details enough?
Whether a note meets your obligations is a question for your attorney. A note on the form leaves other code on the page as it was: any script listening for the form still receives every field the visitor typed. Whatever a visitor types, Hippo sends Google Ads and Meta the same neutral conversion, with no URL path and nothing typed into the form.
Meta restricted our Lead event. Can contact form submissions still count?
Yes, in Hippo's record of your contact form leads by campaign. Meta can restrict a health site from sharing certain mid and lower funnel standard events(opens in a new tab), which is how a site can lose Lead or Schedule. Under a data restriction, custom events stay blocked until you review and confirm them. Hippo cannot lift a category Meta assigns or restore an event Meta blocks, and it never renames an event to get past a restriction; you can ask Meta to review(opens in a new tab) the category. Hippo keeps its record whatever Meta does with the event, and on a walkthrough we look at what your account can still send.
Should we talk to a lawyer about our contact form tracking?
Yes, if you want to know how these laws apply to your business. This page describes Contact Form 7's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by Contact Form 7.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.