Loading
HIPAA Compliant Conversion Data for GoHighLevel
Keep HighLevel (GoHighLevel). A HighLevel workflow sends Hippo the forms and bookings you choose, and Hippo cleans each one before it sends Google Ads and Meta (Facebook) a conversion. You keep a record of which campaigns bring patients, whoever runs your ads.
No annual contracts.
Transparent pricing.
We set it up for you.
GoHighLevel Is Not HIPAA Compliant by Default
HighLevel accounts are not HIPAA compliant by default (as of 10/13/26). HighLevel signs a BAA through its HIPAA add-on, which applies to the whole agency, and HIPAA is then switched on in each sub-account that needs it.
BAA scope
HighLevel's BAA covers HighLevel
In a sub-account with HIPAA switched on, the add-on covers the HighLevel records that can hold protected health information, such as contacts, notes, form submissions, calendars and messages. Meta Ads offers no BAA, and Meta's terms(opens in a new tab) bar data that includes or is based on health information.
What it sends
HighLevel's Meta action can send the contact's email
HighLevel's Conversions API workflow action sends Meta an event when a form is submitted or an appointment is booked, and its field list includes the contact's email, first name, surname, IP address and browser details. Names, email addresses and IP addresses are among the identifiers HIPAA's de-identification standard lists(opens in a new tab).
Restriction
Meta can restrict a health site's events
Meta can restrict certain mid and lower funnel standard events(opens in a new tab) for a site in its health and wellness category. Event and conversion names count too: they must not reflect, imply or be based on health information, so a conversion named "ADHD evaluation booked" breaks Meta's rule on its own.
How Hippo sends Google Ads and Meta your HighLevel forms and bookings
Your website
Book your appointment
Book now
Call us
Booking
Form
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads and Meta
Booking
Form
We set it up.
We install Hippo on a subdomain of your domain. With whoever administers your HighLevel account, we put it in the tracking code of your HighLevel funnels and websites in place of the Meta Pixel and the Google tag. HighLevel's forms and calendars keep working on your pages.
A HighLevel workflow sends Hippo the booking.
A patient who clicked your ad books on your HighLevel calendar or sends a form. A webhook step, added during setup to the workflows that matter, sends Hippo the forms and bookings you choose.
Hippo cleans the conversion.
It passes on only the forms and bookings you choose, each under a name that implies no condition, treatment or service.
Google Ads and Meta get the conversion.
Hippo sends it from its server and keeps a record of it by the campaign that produced it. Whoever runs your ads sees the conversions arrive in Google Ads and in Meta's Events Manager.
HighLevel's own Google Ads, Google Analytics and Meta actions are switched off.
We turn them off in full during setup, in your sub-accounts and in any snapshots they are built from, so HighLevel and Hippo do not both report the same booking.
What Google Ads and Meta receive
Sent
Sent: the forms and bookings you choose
Hippo sends Google Ads and Meta a conversion under a neutral name for the forms and bookings you allow. On your pages, Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses, plus anything typed into a form. From HighLevel, the contact record, the calendar name, the tags and the pipeline stage are left out too.
Held
Held until you allow it
An event Hippo doesn't recognize stays in Hippo, so a new HighLevel form can't start sending to Google Ads or Meta on its own.
Kept
Kept in Hippo, under your BAA
Hippo stores what it records, contact details included, in its own storage under the BAA it signs with every customer, with a log of what Hippo sent Google Ads and Meta and what it removed first.
What health advertisers say about leads and conversions
They can't tell what's working
Leads land in HighLevel, and booked revenue tells a different story.
The disconnect I kept seeing was between what marketing was calling a conversion and what actually showed up as booked revenue in the system.
Marketer working with clinics We’re trying to figure out the best way to get accurate conversion data in Google Ads.
PPC freelancer, psychiatry client The add-on stops at HighLevel
HighLevel's BAA covers forms and contacts once HIPAA is on in their sub-account, and Meta Ads offers no BAA for the conversions that reach it.
We plan to run ads for ADHD therapy, and we use the HIPAA compliant version of HighLevel for our landing pages, form creation and CAPI.
Therapist, group practice owner
CRM and server-side tracking lawsuits and settlements on health sites
Duly Health and Care(opens in a new tab)
$1.88 million
Patients sued over a Meta pixel on the part of Duly's website they logged into to book appointments, and over Meta's Conversions API on the servers behind its website and patient portal. The court granted final approval(opens in a new tab) in April 2026.
BetterHelp(opens in a new tab)
$7.8 million
The FTC finalized an order requiring the online counseling service to pay, after charging that it disclosed consumers' email addresses, IP addresses and health questionnaire information to Facebook and other platforms for advertising.
Hims & Hers(opens in a new tab)
Pending
The FTC, California and Utah allege that Hims & Hers shared customers' health information with advertising platforms, including through the Meta Pixel and the Conversions API, which the complaint says connects an advertiser's server or internal software to Meta.
Pinnacle Fertility(opens in a new tab)
Pending
Patients allege in their complaint(opens in a new tab) that the fertility network sent their information to Meta and Google through tracking code on its websites, and used the Conversions API to send it from its own server directly to Facebook.
Axia Women's Health(opens in a new tab)
Pending
A user of the women's health system's website alleges in the complaint(opens in a new tab) that the site ran tracking code from a CRM platform and a marketing automation platform beside Google's, tying visitors' searches and provider clicks to contact records.
Each case names a server connection to Meta, consumers' email addresses sent to ad platforms, or a CRM platform's tracking code.
See what your site sends to Google Ads and Meta(opens in a new tab)What you get
HighLevel forms and bookings, by campaign
Hippo ties each form and booking HighLevel sends it to the campaign that produced it, even when the booking lands days after the click, whatever Google Ads and Meta do with the conversion.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of what Hippo sent Google Ads and Meta and what it removed first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is GoHighLevel HIPAA compliant?
Not by default(opens in a new tab). HighLevel signs a BAA through its HIPAA add-on(opens in a new tab), which applies to the whole agency(opens in a new tab), and HIPAA is then switched on in each sub-account(opens in a new tab) that needs it. Once HIPAA is on in a sub-account, it cannot be turned off, and the add-on itself cannot be canceled, refunded, removed or downgraded(opens in a new tab) after it is enabled.
We have HighLevel's HIPAA add-on. Doesn't that cover the conversions HighLevel sends to Meta and Google Ads?
Not for Meta or Google Ads. HighLevel's BAA covers HighLevel: in a sub-account with HIPAA switched on, the add-on covers the records that can hold PHI(opens in a new tab), such as contacts, form submissions and calendars. Under HIPAA, you may share PHI with a business associate only with that business associate's own assurance(opens in a new tab). Meta Ads offers no BAA, and Google offers BAAs for Workspace, Cloud and Local Services Ads(opens in a new tab), and none for Analytics or for the Google Ads campaigns advertisers run on search, display and YouTube. The BAA you sign with Hippo covers Hippo, and Hippo controls only what it sends Google Ads and Meta.
Does Hippo replace HighLevel or its HIPAA add-on?
No. Keep HighLevel. Your funnels, forms, calendars and contacts stay there, and under HIPAA, protected health information you keep in HighLevel needs HighLevel's BAA, which comes with its HIPAA add-on. During setup we switch off HighLevel's own Google Ads, Google Analytics and Meta actions, and a webhook step(opens in a new tab) in your workflows sends Hippo the forms and bookings you choose. Hippo puts no ad pixel or Google tag on your pages, and HighLevel's forms and calendars keep working on them.
HighLevel already sends conversions to Meta and Google Ads. Will a booking count twice, and what do we switch off?
Not from HighLevel and Hippo together. During setup we switch off HighLevel's own Google Ads, Google Analytics and Meta actions in your sub-accounts and in any snapshots they are built from, and take the Meta Pixel and the Google tag out of your HighLevel tracking code, so HighLevel and Hippo do not both report the same booking. That includes HighLevel's Conversions API action(opens in a new tab), with its lead events, and its Google Ads action(opens in a new tab). Without that switch a booking could count twice: Meta keeps two server events(opens in a new tab) for one conversion, and Google Ads removes duplicates only within one conversion action(opens in a new tab).
What does HighLevel's Conversions API action send Meta, and what do Google Ads and Meta get from Hippo?
HighLevel's Conversions API action lists the contact's email, first name, surname, IP address and browser details(opens in a new tab) among the fields it can send Meta. Hippo cleans each form and booking you choose before it sends Google Ads and Meta a conversion, tied to the campaign that produced it. The contact's form answers, calendar name, tags and pipeline stage are not part of it. The conversion's name implies no condition, treatment or service, and Meta's terms(opens in a new tab) bar event names that imply health information.
Our agency runs HighLevel and the ads, and we don't have DNS access. Who sets this up, and what changes in the sub-account?
We do. Whoever controls your domain adds a DNS record for your Hippo subdomain, and we install Hippo. With whoever administers your HighLevel account, we put Hippo in your HighLevel tracking code in place of the Meta Pixel and the Google tag, add a webhook step to the workflows that matter, and switch off HighLevel's own Google Ads, Google Analytics and Meta actions in the sub-accounts and in any snapshots they are built from. Your agency keeps running the campaigns and sees the conversions Hippo sends arrive in Google Ads and in Meta's Events Manager.
Who signs which BAA: the practice, the agency, HighLevel and Hippo?
In HighLevel's own setup(opens in a new tab), the practice is the covered entity, HighLevel and the agency are business associates, and the agency gives the practice a BAA of its own. Hippo signs a BAA with every customer, and that BAA covers what Hippo receives and keeps. On a walkthrough we go through who signs Hippo's BAA in your setup.
Meta restricted our Lead event or flagged our custom conversions. Can Hippo get them back?
No. Meta can restrict certain mid and lower funnel standard events for a site in its health and wellness category, and under a restriction, custom events stay blocked(opens in a new tab) until you review and confirm them. Hippo cannot lift a category Meta assigns or restore an event Meta blocks, and it never renames an event to get past a restriction. You can ask Meta to review(opens in a new tab) the category. Hippo sends the forms and bookings you choose under names that imply no condition, treatment or service, and records them by campaign, whatever Meta does with them.
HighLevel's Conversions API action is already server-side. Isn't that the safe version?
Not by itself. Sending a conversion from a server changes the route and leaves what it carries as it was. Website events sent through the Conversions API follow the same restrictions(opens in a new tab) as pixel events, and the FTC's complaint against Hims & Hers names the Conversions API beside the Meta Pixel. Hippo sends from its server too, and cleans what it sends first: names, emails, phone numbers, dates of birth and IP addresses come off, and each conversion carries a name that implies no condition, treatment or service.
Should we talk to a lawyer about our HighLevel tracking?
Yes, if you want to know how these laws apply to your business. This page describes HighLevel's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by HighLevel.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.