Loading
HIPAA Compliant Conversion Data for Gravity Forms
Hippo's script counts the Gravity Forms submissions you choose, and Hippo sends them to Google Ads and Meta as conversions with no protected health information. We take the Google tag and the Meta (Facebook) Pixel off your pages, and you see which campaigns bring patients, whoever runs your ads.
No annual contracts.
Transparent pricing.
We set it up for you.
Gravity Forms Is Not HIPAA Compliant by Default
As of 10/13/26, Gravity Forms will not sign a BAA, because it does not host or store your form data, and it points you to your website host or data services provider. By default it saves each entry in your WordPress database, with the submitter's IP address and the page address, and does not encrypt it in storage.
Page scripts
Tracking scripts read the form first
Third-party tracking scripts on a form page often capture what people submit directly from the browser(opens in a new tab) when someone clicks submit, before Gravity Forms has checked the submission. That can mean the name, phone number and reason for the visit, even from a submission Gravity Forms never saves.
Confirmations
Confirmations can write the answers into the URL
A Gravity Forms confirmation set to pass field data via a query string(opens in a new tab) puts what someone typed into the address of the next page. Web forms are a frequent way personal information ends up, by accident, in page addresses passed to Google.
Enhanced conversions
Enhanced conversions want the typed email
With enhanced conversions on, the Google tag can collect the email or phone number someone types into your form and upload it to Google. Conversions related to health are barred from measurement in enhanced conversions(opens in a new tab).
How Hippo sends Google Ads and Meta your Gravity Forms conversions
Your website
Book your appointment
Book now
Call us
Form
Hippo
Records events
Removes identifying information
Sends clean conversion data
Excluded from conversion events
Names
Conditions
IP addresses
Clean conversion events only
Google Ads and Meta
Form
We set it up.
We install Hippo on a subdomain of your domain with whoever runs your WordPress site. We take the Google tag and the Meta Pixel off your pages and switch off any plugin or snippet reporting your forms to Google Ads or Meta. Tools you keep, like a scheduler, keep their own code.
Hippo's script sees the submit.
A patient who clicked your ad fills in one of the forms you picked, such as an appointment request, and presses submit. Hippo's script on that page counts the submission as a conversion, with no Gravity Forms add-on in between.
Hippo sends the conversion with no protected health information.
Each conversion leaves Hippo under a name that implies no condition, treatment or service, even when the form itself is called something like "Weight loss consult."
The conversion lands in your ad accounts.
Hippo sends it from its server and keeps its own record of it by the campaign that brought the patient. Whoever runs your campaigns finds the form conversions in Google Ads and in Meta's Events Manager.
What Google Ads and Meta receive
Sent
Sent: conversions for the forms you pick, with no protected health information
Hippo sends Google Ads and Meta a conversion under a neutral name when someone submits one of the forms you allow, and nothing for the rest. Hippo waits for consent where it is required.
Excluded
Excluded from conversion events
Names, emails, phone numbers, dates of birth and IP addresses, plus URL paths, the form's title and anything typed into the form.
Held
Held until you allow it
Submissions from a form Hippo doesn't recognize wait in Hippo. A form someone adds to the site next month can't start sending to Google Ads or Meta on its own.
Kept
Kept in Hippo, under your BAA
Hippo keeps what it records in its own storage, under the BAA it signs with every customer, beside a log of what Hippo sent Google Ads and Meta and what it removed first.
What practices and their web teams say about forms
They can't tell what's working
Forms come in, and nobody can say which campaign sent them.
I have spent $600 or so and have got 10 to 15 forms.
Practice owner We recently set up proper conversion tracking (thank-you page + tag), but since we got no new leads, Google still has almost no conversion data.
Clinician running group practice ads As soon as our ad budget restarts, we get thousands of clicks under 'Counseling Services', and the form gets filled out, but it's all fake data.
Group practice owner Nobody checked what the form sends
The site and its forms get handed down, and the tags on them come along unchecked.
We have an old client on WordPress using Gravity Forms. It has come to our attention our website probably isn't HIPAA compliant at all.
Web agency with health client You, the person using it to build a website, will be responsible for making sure what you build on top of it is HIPAA compliant.
Former web developer Do not allow the client to pass this off to you, since you'll then be liable if something goes wrong.
Web developer
Form tracking lawsuits and settlements on health sites
San Diego Fertility Center(opens in a new tab)
$850,000
Patients alleged, in the second amended complaint(opens in a new tab), that the Meta Pixel on the fertility group's websites was set to send Facebook hashed values of what visitors entered, including their email, name and phone number, and a Lead event when they submitted the appointment form. The group settled, and the payments have been sent.
Workit Health(opens in a new tab)
$578,680
Patients alleged, in the complaint(opens in a new tab), that the Facebook Pixel on the virtual addiction treatment provider's website sent their intake-form answers about drug and alcohol use and self-harm to Facebook, with their first name, email address and phone number. The court granted final approval(opens in a new tab) on March 6, 2025.
Opencare(opens in a new tab)
Pending
Patients allege, in the second amended complaint(opens in a new tab), that Google received what visitors typed into the dental booking site's diagnostic form, down to the exact words a visitor wrote about a broken tooth. In August 2026 the court let their negligence and invasion of privacy claims proceed(opens in a new tab).
Nourish(opens in a new tab)
Pending
Patients allege, in the consolidated complaint(opens in a new tab), that Google's tracking tools on the telehealth dietitian service's website sent Google what they entered on its appointment form, including the appointment date and the dietitian's name. In April 2026 the court let the federal and California wiretap claims proceed(opens in a new tab).
Shady Grove Fertility(opens in a new tab)
Pending
Patients alleged, in the original complaint(opens in a new tab), that when someone asked for an appointment on the clinic's website, Google received the thank-you page, the appointment page before it and an event named for the appointment form, along with the visitor's Google client ID. In September 2025 the court refused to throw out the case(opens in a new tab).
Each case involves what a website form, or the page after it, sent to Google or Meta.
See what your site sends to Google Ads and Meta(opens in a new tab)What you get
Form submissions, by campaign
Hippo ties each Gravity Forms submission it counts to the campaign that produced it, in a record you own that stays with you whoever runs your ads.
Your numbers, in your account
An independent record of results in an account you own. If you change agencies, it stays with you.
Call tracking
Calls that start from an ad are counted as conversions alongside forms and bookings.
A record of what was sent
A log of what Hippo sent Google Ads and Meta and what it removed first.
Supported integrations
Hippo works with the ad platforms and website tools your practice already uses.
Pricing
1,000 visitors/month
$99/month
Month to month.
Start now, no demo call1,000 visitors/month2,000 visitors/month
$199/month
Month to month.
Start now, no demo call2,000 visitors/month10,000 visitors/month
$299/month
Month to month.
Start now, no demo call10,000 visitors/month
Every plan includes:
- BAA signed at checkout
- No setup fees
- Cancel anytime. No compliance add-on that locks you in the day you enable it.
Server-side conversion tracking under a BAA, at a price a practice can actually pay.
Frequently asked questions
Is Gravity Forms HIPAA compliant? Will it sign a BAA?
Gravity Forms will not sign a BAA(opens in a new tab), because it does not host or store your collected form data, and it points you to your website host or data services provider instead. It saves each entry in your WordPress database(opens in a new tab) and by default does not encrypt it(opens in a new tab) there. Even with the third-party add-ons it lists, it leaves the burden of proving compliance(opens in a new tab) with you. Hippo signs a BAA with every customer for what Hippo handles, including what it records in its own storage. For the forms you choose, Hippo sends Google Ads and Meta conversions with no protected health information.
Gravity Forms won't sign a BAA. Whose BAA covers our entries, and will Google or Meta sign one?
The BAA you sign with Hippo covers what Hippo handles. Your entries are saved in your WordPress database, so for them the question goes to the host that stores that database: under HIPAA, a cloud service that stores health information(opens in a new tab) for a covered entity is a business associate. Meta Ads offers no BAA, and Google offers BAAs for Workspace, Cloud and Local Services Ads, and none for Analytics or for the Google Ads campaigns advertisers run on search, display and YouTube. Neither platform is party to your BAA with Hippo, and Hippo controls only what it sends them: the form conversions you choose, with no protected health information.
Do we need a Gravity Forms add-on, or the Webhooks Add-On, for Hippo?
No. Hippo works from its own script on the page where your form appears, so nothing gets installed inside Gravity Forms, the Webhooks Add-On included. We choose with you which forms count, and Gravity Forms keeps saving entries to your WordPress database.
What do Google Ads and Meta get when someone submits one of our forms?
A conversion from Hippo's server, for the forms you chose, under a name that implies no condition, treatment or service. Hippo prevents protected health information from reaching Google Ads and Meta: names, emails, phone numbers, dates of birth and IP addresses come off first, and the conversion leaves without a URL path, the form's title or anything the person typed. Submissions from a form Hippo doesn't recognize wait in Hippo until you allow that form.
Do the Meta Pixel and the Google tag on our form pages see what people type?
They can. With automatic advanced matching on, the Meta Pixel looks for recognizable form fields(opens in a new tab), such as name and email, and sends them with the event. With enhanced conversions on, a Google tag can detect the contact details(opens in a new tab) someone typed into your form and upload them. Meta's terms(opens in a new tab) bar data that includes or is based on health information, event names included. We take both tags off your pages, and Hippo sends the form conversion from its server.
What happens to our pixel, the Google tag and the tracking plugins on the site?
We remove the Google tag and the Meta Pixel from your pages during setup, along with any Google tag a plugin adds to the form header. That includes the thank-you page, since web forms are a frequent source of personal information in page addresses passed to Google(opens in a new tab). We also switch off any plugin or snippet that reports your forms to Google Ads or Meta, so it and Hippo do not both report the same form, and tracking code with no BAA behind it goes the same way. A server-side plugin sending the same conversion changes the route and leaves what it carries as it was.
Our agency runs the ads and has no DNS access. Who sets it up?
We do, and your agency doesn't need DNS access: whoever manages your domain adds a DNS record, and we install Hippo on a subdomain of your domain with whoever runs your WordPress site. Together we pick the forms that count. Your agency keeps running the campaigns and sees the form conversions arrive in Google Ads and in Meta's Events Manager.
Does Hippo change our entries, our notification emails or what our add-ons send?
No, with one exception. Hippo leaves your entries and notification emails as they are. A Gravity Forms notification includes the submitted form content by default(opens in a new tab), and its Partial Entries Add-On, on a form where you turn it on, saves what people type before they submit(opens in a new tab), so those copies end up in inboxes and your WordPress database, outside Hippo. A vendor that handles PHI for you signs its own BAA. The exception is tracking: during setup we switch off any add-on or snippet that reports your forms to Google Ads or Meta, and any tracking code with no BAA behind it.
Which form submissions count as conversions?
The ones from forms you pick. An appointment request can count while a newsletter sign-up or a job application doesn't, and Hippo sends Google Ads and Meta conversions only for the forms on your list.
Meta restricted our Lead event. Can our form submissions still count?
In Hippo's record, yes. Meta can restrict certain mid and lower funnel standard events(opens in a new tab) for a health site's data source, so a form sent as Lead can be blocked, and under data restrictions custom events stay blocked(opens in a new tab) until you review and confirm them. Hippo cannot lift a restriction Meta places or restore an event Meta blocks, and it never renames an event to get around one. What Meta accepts is Meta's decision. Hippo sends Meta the form conversion under a neutral name and keeps its own record of your form submissions by campaign, whatever Meta blocks. On a walkthrough we look at what your account can still send.
Should we talk to a lawyer about tracking on our Gravity Forms pages?
Yes, if you want to know how these laws apply to your business. This page describes Gravity Forms' terms, laws and court cases for general information and is not legal advice. Hippo handles the tracking; an attorney can advise you on your obligations. Hippolytics is not affiliated with, endorsed by or sponsored by Gravity Forms.
Hippo by industry
Therapists & Group Practices
See which campaigns bring new clients.
Addiction Treatment & Recovery
Connect campaign spend to intake inquiries.
Ketamine Clinics
Measure consultation bookings by campaign.
Telehealth
Understand what drives online bookings.
Pharmacy
See which campaigns bring transfers and refills.
Mens Health
Compare acquisition across your campaigns.
Womens Health & Fertility
See which campaigns drive consultations.
Dental
Know your cost per booked patient.
Med Spas
See which promotions get booked.
Dermatology
Connect campaign spend to appointments.
Eye Care & LASIK
See which campaigns book consultations.
Imaging & Radiology
Measure calls and booking inquiries.
Primary Care & Multi Specialty Groups
See which campaigns bring new patients.
Urgent Care
See which campaigns bring walk-ins and online check-ins.
Labs & at Home Testing
Understand which campaigns drive inquiries.
Medicare & ACA Agencies
See which campaigns bring quote requests and calls.
Hospitals & Health Systems
Connect campaigns to appointment inquiries.
Consumer Apps & Devices
See which campaigns bring trials, subscriptions and orders.