Loading
HIPAA Compliant Conversion Data for Google Ads
The Google tag comes off your pages, and Hippo sends your bookings, calls and forms to Google Ads from its server, with no protected health information. Keep running your campaigns and see which ones bring patients, in an account you own.
No annual contracts.
Transparent pricing.
We set it up for you.
Google Ads Is Not HIPAA Compliant by Default
Under HIPAA, sending PHI to a tracking vendor without patients' authorization requires a signed BAA with that vendor. Google offers BAAs for Local Services Ads and none for the Google Ads campaigns advertisers run on search, display and YouTube (as of 10/12/26).
What it sends
The Google tag ties conversions to a visitor
On your thank-you page, the tag reads the cookie it stored for the visitor or the ad click and sends it back to Google Ads with the conversion. Page addresses passed to Google(opens in a new tab) from forms and login pages can carry personal information too.
Enhanced conversions
Enhanced conversions are off limits for health
Conversions related to health can't be used for measurement in enhanced conversions(opens in a new tab), and with the setting on, the Google tag can pick up contact details a patient enters on your site, like an email or phone number, and send them to Google.
BAA scope
A Workspace BAA stops short of your campaigns
If your practice signed Google's BAA for Workspace, it covers the Workspace services on Google's list, and that list(opens in a new tab) does not include Google Ads.
How Hippo sends Google Ads your conversions
Your website
Book your appointment
Book now
Call us
Booking
Form
Number tap
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads
Booking
Form
Number tap
The Google tag comes off.
We take the Google tag and its conversion code off your pages and install Hippo on a subdomain of your domain. Tools you keep, like a scheduler or a payment form, keep their own code.
Hippo cleans the conversion.
When a patient who clicked your ad books, sends a form or calls, Hippo prevents protected health information from reaching Google Ads and gives the conversion a name that implies no condition, treatment or service.
Google Ads gets the conversion.
Hippo sends it from its server to the conversion actions we set up in your Google Ads account and keeps its own record of it by the campaign that produced it. Whoever runs your ads sees it arrive in Google Ads.
What Google Ads receives
Sent
Sent: the conversions you choose, with no protected health information
Hippo sends Google Ads only the conversions you allow, under neutral names. Hippo sends each one for the campaign that produced it. Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses, plus URL paths and anything typed into a form.
Held
Held until you allow it
An event Hippo doesn't recognize stays in Hippo, so a new form can't start sending to Google Ads on its own.
Kept
Kept in Hippo, under your BAA
Hippo stores what it records in its own storage under the BAA it signs with every customer, with a log of what Hippo sent Google Ads and what it removed first.
What health advertisers on Google Ads say
They can't tell what's working
Conversions say one thing, and the practice's schedule says another.
Google Ads says the lead volume is fine. Call tracking says calls are coming in. Forms are submitted. But the practice says “these leads are bad,” and when we dig in, some of it is real lead quality and some of it is front-desk process.
Healthcare PPC practitioner Right now you’re paying to guess.
Google Ads marketer Next, verify your offline conversion tracking is actually feeding back into Google Ads.
PPC practitioner A conversion can tell Google too much
Page details and hashed contact information that ride along with the conversion.
For example, the website metadata often includes drug names or health conditions that when paired with user info could constitute PHI and be Hipaa non-compliant.
Agency with healthcare clients I would not use this feature despite the data being hashed.
Agency owner I’m trying to wrap my head around everything to make sure it is set up from a strong foundational standpoint as well as avoid any lawsuits due to not properly protecting PII.
Owner opening an allergy clinic
Google Ads tracking lawsuits and settlements on health sites
Virginia Mason Medical Center(opens in a new tab)
$3.5 million
A patient alleged that code on the health system's website and patient portal disclosed medical information to third parties, including Facebook and Google. The court granted final approval(opens in a new tab) in April 2026, and for two years the settlement bars Google Ads and Google DoubleClick code on its web properties unless its web governance committee clears their use under HIPAA's de-identification standard and Virginia Mason names the tools on its site.
Fertility Centers of Illinois(opens in a new tab)
Proposed
A patient alleges that the Meta Pixel, Google Analytics and Google Ads on the fertility group's website sent patient information to Facebook and Google, and the group has agreed to a $375,000 settlement fund(opens in a new tab).
Hims & Hers(opens in a new tab)
Pending
The FTC, California and Utah allege that the company shared customers' health information with advertising platforms, and the complaint lists the Google Ads Pixel and the Google Ads S2S Pixel among the pixels Hims placed on its website.
Shady Grove Fertility(opens in a new tab)
Pending
A patient alleges that Google, Meta and Microsoft trackers on the clinic's webpages, including appointment scheduling, disclosed fertility information. The original complaint names Google Analytics and Google Ads. In September 2025 the court refused to throw out the case(opens in a new tab).
Oswego Health(opens in a new tab)
Pending
Patients allege that DoubleClick and Google Ads trackers on the health system's website and patient portals sent Google their searches for providers and treatments and their portal visits. The complaint(opens in a new tab) names no tracker on Oswego's sites other than Google's.
Soderstrom Dermatology Center(opens in a new tab)
Pending
Patients allege that tracking code on the dermatology practice's website sent their condition searches and booking information to Google, Meta and a call-tracking platform, and the complaint(opens in a new tab) lists Google Analytics, Google Ads and Signals among Google's tracking technologies.
All six involve Google Ads tracking code on the organization's own website.
See what your site sends to Google Ads(opens in a new tab)What you get
Google Ads conversions, by campaign
Bookings, calls and forms from your Google Ads campaigns, recorded in your Hippo account by the campaign that produced them, whatever Google Ads does with the conversion.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of what Hippo sent Google Ads and what it removed first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Conversion
Hippo
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is Google Ads HIPAA compliant?
Not by default. Google offers BAAs for Workspace, Cloud and Local Services Ads(opens in a new tab), and none for Analytics or for the Google Ads campaigns advertisers run on search, display and YouTube. Conversions related to health can't be used for measurement in enhanced conversions(opens in a new tab) or store sales uploads, and Google's data collection policy bars sending personally identifiable information(opens in a new tab) to Google through conversion tracking tags. Under HIPAA, a tracking vendor's promise to remove PHI after receiving it(opens in a new tab) is not enough. What the Google tag sends from your pages is your responsibility.
We signed the Google Workspace BAA. Will Google sign one for our ads?
Not for your search, display or YouTube campaigns. The services Google's Workspace BAA covers do not include Google Ads, and Google's Local Services Ads BAA excludes every other Google product(opens in a new tab). Under HIPAA, sending PHI to a tracking vendor without patients' authorization requires a signed BAA(opens in a new tab) with that vendor. The BAA you sign with Hippo covers Hippo. Google Ads is outside it, and Hippo controls only what it sends there: the conversions you choose, under neutral names, with no protected health information.
Can we keep enhanced conversions on if the email and phone number are hashed? Is the Google tag fine with them off?
Not for health conversions. Conversions related to health can't be used for measurement in enhanced conversions or store sales uploads, and with enhanced conversions on, the Google tag can pick up contact details a patient enters on your site(opens in a new tab), like an email or phone number, and send them to Google. Turning the setting off leaves the tag on your pages, storing an identifier for the visitor or the ad click and sending it back with each conversion(opens in a new tab). During setup we take the Google tag off and keep enhanced conversions off for Hippo's conversion actions, and Hippo sends Google Ads the conversions you choose, without an email or phone number.
If we already send conversions server-side, or through the Google Ads API, isn't that the compliant version?
Not by itself. Sending a conversion from a server changes the route and leaves what it carries as it was. Hippo sends from its server too, and prevents protected health information from reaching Google Ads: names, emails, phone numbers, dates of birth and IP addresses come off first, and each conversion carries a name that implies no condition, treatment or service.
Do we keep the Google tag?
No. We take the Google tag and its conversion code off your pages, and Hippo sends conversions to Google Ads from its server, so no ad pixel or Google tag runs on them. Tools you keep, like a scheduler or a payment form, keep their own code.
Our agency runs Google Ads and has no access to our DNS. Who sets this up?
We do. Whoever controls your domain adds a DNS record for your Hippo subdomain. We install Hippo, take the Google tag off, connect Hippo to your Google Ads account and set up its conversion actions, with enhanced conversions off for them. Your agency keeps running the campaigns and sees the conversions arrive in Google Ads.
Will a conversion count twice with the conversion actions already in our account?
Not between Hippo's conversion actions and the ones your Google tag fed. Google Ads removes duplicates only within one conversion action(opens in a new tab), so two actions that record the same booking in the same campaign can count it twice. During setup we make Hippo's conversion actions the primary ones for what it sends and set the actions your Google tag fed to secondary. With call reporting on, calls from the call button in your Google ads are counted by Google itself(opens in a new tab), on Google forwarding numbers. A tap on your site's number arrives from Hippo as its own conversion. On a walkthrough we go through which conversion actions your account counts.
Should we accept Google's call ads terms?
In the US, Google's call ads terms for the calls and messages your ads start ask advertisers that are, or advertise for, covered entities or business associates not to accept them(opens in a new tab) and to ask Google for exclusion from call monitoring and recording. Hippo has no part in Google's call terms. A call your call tracker records, or a booking confirmed in your scheduler, is sent to Google Ads by Hippo as a conversion for the campaign that started it, and taps on your site's number count too.
Does Hippo get our ads approved or replace LegitScript?
No. Online pharmacies and telemedicine providers must apply to Google(opens in a new tab) before advertising prescription drug services, and addiction services for drugs and alcohol can advertise in certain locations only if Google certifies them(opens in a new tab). Those decisions are Google's, and Hippo does not get ads approved or replace LegitScript. Once your ads run, Hippo records the bookings, calls and forms they bring, by campaign.
Can Hippo count conversions that happen after patients log in?
Yes. Hippo runs under your BAA, so it can record a booking or purchase completed in a logged-in area. Hippo sends Google Ads only the neutral conversion, with no protected health information, and no ad pixel or Google tag runs on those pages.
Should we talk to a lawyer about our Google Ads tracking?
Yes, if you want to know how these laws apply to your business. This page describes Google's terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by Google.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.