A patient searches "spinal stenosis treatment near me." They land on your treatment page. They read about the procedure, the recovery time, maybe a surgeon bio. Before they scroll past the first paragraph, your Google Analytics tag fires.
That visit just left your building. It carried the page they viewed, their IP address, their device, and a Google identifier that can stitch their behavior across the web. You never signed a contract with Google that protects any of it.
You didn't sign one because Google won't offer it.
Read Google's Own Words
Most practices assume Google Analytics is safe because everyone uses it. Google's own documentation says otherwise, in plain language. Google states it does not offer Business Associate Agreements in connection with Analytics, and it makes no representations that the product satisfies HIPAA requirements.
Sit with that. The Business Associate Agreement is the document HIPAA requires before you hand protected health information to a vendor. No BAA means no permission structure. Google is telling you, in writing, that it will not be your business associate for this product. The responsibility for keeping PHI away from Google sits entirely with you.
The Part That Catches Practices Off Guard
Two kinds of pages create the exposure.
Authenticated pages are the obvious ones. Patient portals, appointment booking, intake forms, anything behind a login. Google says these are likely HIPAA-covered and tags should not run on them. Most practices get this right.
The second kind is where the trouble lives. Unauthenticated pages tied to the provision of health care can also be covered. That means a public condition page with no login at all. The HHS guidance on online tracking technologies treats a visit to a page about a specific health condition as a signal about that person's health. A tag on that page can move that signal to a third party. The page being public does not make the visit public.
So the condition pages, the treatment pages, the symptom explainers, the service lines that bring in your best patients are the exact pages most likely to leak.
Where the Burden Actually Lands
Google does not sort your pages for you. The documentation puts the work on the customer. You are expected to work with legal to identify which pages do not relate to health care delivery, and to keep tags off everything that does.
In practice, almost nobody does this. A developer installs GA4 site-wide during the build. It fires on every page from the homepage to the deepest procedure page. Nobody goes back and carves out the covered pages, because nobody told the developer those pages were different.
That is the gap.
“Site-wide analytics on a healthcare site is the default, and the default is the violation.”
What This Is Really About
People hear HIPAA and picture the Office for Civil Rights. OCR matters, and tracking technologies are squarely in its enforcement focus. But the faster exposure on a public condition page is often the FTC and state privacy law. The FTC has gone after health platforms for sharing browsing and health-seeking activity with advertising tools without consent. State laws add private rights of action that do not wait for a federal investigation. A plaintiff's firm does not need OCR to open a file. It needs a tag on a condition page and a patient who can show it ran.
What to Do This Week
Pull up your site and check what is firing. You do not need a forensics team to start.
- Check what is firing: Open any condition or treatment page, open your browser's developer tools, watch the network tab, and look for calls to Google Analytics as the page loads. If you see them, that page is sending visit data out.
- Map your covered pages: Anything behind a login, anything about a specific condition, treatment, or provider relationship. Treat those as PHI surfaces.
- Get the tags off the covered pages: Not just the homepage exemption. The pages that matter are the ones that describe care.
- Document the decision: If you choose to keep analytics on genuinely general pages, write down why those pages do not relate to care delivery. That record is what protects you if anyone asks.
The Bottom Line
Google handed you the disclaimer. No BAA, no HIPAA representations, your responsibility to keep PHI out. That is not a loophole to manage. It is a line that says your healthcare website was never covered by Google's compliance, because Google never claimed to provide any.
Read the source yourself. Google's "HIPAA and Google Analytics" help article spells it out (support.google.com/analytics/answer/13297105), and it points to the HHS guidance on online tracking technologies at hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking.
If you want to know exactly what your site is leaking and to whom, that is the scan we run first. A paid audit gives you the evidence, the page-by-page map, and a remediation plan you can hand to your developer. You find out what regulators and plaintiffs would find, before they look.