Is Google Analytics HIPAA Safe? No, and Here's the Fix

No. Google's own support documentation says it makes no representations that Google Analytics satisfies HIPAA requirements, and that Google will not sign a Business Associate Agreement for it, standard or 360, GA4 or the retired Universal Analytics. That is not a rumor or a third-party summary. It is Google's stated policy, in Google's own words. Here is exactly what that means for a therapy, psychiatric, or medical practice website, and the architecture we actually use instead.

What Google actually says

Google's own HIPAA and Google Analytics support page states it plainly: "Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." The same page tells HIPAA-regulated entities to refrain from exposing any data that may be considered protected health information, to keep tags off authenticated pages, which it describes as likely to be HIPAA-covered, and to keep tags off unauthenticated pages related to the provision of healthcare. It tells customers to work with their own legal counsel to decide which pages qualify.

Source: Google Analytics Help, "HIPAA and Google Analytics," accessed 2026-08-21

GA4 and Universal Analytics: same answer

Universal Analytics was retired in 2023 and GA4 is what every site runs now, ours included. The policy did not change with the migration. GA4 is not designed to receive PHI, and Google's position applies to it exactly as it applied to the old property type. Neither version can be made safe by a settings change alone. The fix has to happen upstream of the tool, in what the site sends it, not inside the tool's dashboard.

Why this actually matters: two real settlements

This is not a hypothetical risk. The Federal Trade Commission has settled enforcement actions against two mental health platforms over tracking tools that sent health-adjacent data to advertising platforms.

Sources: FTC press releases, March 2, 2023 (BetterHelp proposed order, finalized July 14, 2023) and April 15, 2024 (Cerebral)

Neither case was an HHS or OCR action. Both were the Federal Trade Commission, acting under its general authority over unfair and deceptive practices. In the Cerebral matter the FTC also charged violations of two separate statutes covering online cancellation and substance use disorder treatment services. That distinction matters for what comes next.

The HHS guidance is real, and partly vacated

In December 2022, HHS's Office for Civil Rights issued a bulletin saying tracking technologies on a provider's public, unauthenticated pages could still transmit protected health information depending on the visitor's reason for being there. OCR revised that bulletin on March 18, 2024, conceding that a visit unrelated to the person's own health does not qualify while keeping the test tied to the visitor's reason for being there. On June 20, 2024, a federal judge in the Northern District of Texas vacated that specific piece of the guidance, holding that treating an IP address plus a visit to a public webpage as protected health information exceeded HHS's authority under HIPAA.

Source: American Hospital Association v. Becerra, N.D. Tex., ruling June 20, 2024

What the vacatur removed was one specific theory about unauthenticated pages. It did not touch the rest of HIPAA's Privacy and Security Rules, it did not touch Google's own refusal to sign a BAA for Analytics, and it did not touch the FTC's separate authority, which is exactly what reached BetterHelp and Cerebral. A practice that reads the June 2024 ruling as "tracking is fine now" is reading past the two settlements sitting on either side of it.

What we actually build

We run Google Analytics 4 on the practice sites we build, and we configure it to keep condition and service detail out of what it receives. Page paths that would otherwise carry a specific service or condition slug are replaced before the event is sent, query strings are stripped, and Google Signals and ad personalization are turned off. That is how Adult & Child Counseling and Psychiatric Center and New Leaf Mental Health run analytics today. We do not place Meta, TikTok, or LinkedIn tags on a healthcare practice's site, for the same reason Cerebral is now paying a settlement over having done exactly that.

The bigger control sits upstream of analytics entirely. Neither practice site has a form. There is no input field for a patient to fill in, so no script on the page, ours or Google's, ever receives anything a patient typed. Full detail on that architecture, including what changes when a practice does want a form, is at our BAA policy page.

If your practice needs more than analytics

Some practices need patient intake, secure messaging, or appointment reminders running on the site itself, not just a marketing page that links out. That is a different engagement than the analytics question above, because it means a signed Business Associate Agreement covering the systems that actually hold PHI. We do not have that packaged as a published product today, and we would rather say that plainly than describe something we cannot yet deliver. What we can tell any practice asking is the architecture we already run for two live clients, and where the line sits between what stays on our infrastructure and what belongs on yours: read it in full at /baa.

Frequently asked questions

Is Google Analytics safe to use on a healthcare practice website?

Only if protected health information never reaches it. Google's own support documentation says it makes no representations that Google Analytics satisfies HIPAA requirements, and that Google will not sign a Business Associate Agreement for it. The safe pattern is keeping the tool off any authenticated page, stripping condition and service detail from what it receives, and never sending it a symptom, diagnosis, or insurance field. NovraScale is not a law firm and nothing here has been applied to your practice's facts.

How do I configure Google Analytics for a healthcare practice?

Replace any condition or service slug in the page path before the event fires, strip query strings, turn off Google Signals and ad personalization, and keep the tool off authenticated pages entirely. That is the exact configuration running on Adult & Child Counseling and Psychiatric Center and New Leaf Mental Health today.

Is GA4 different from Universal Analytics for this?

No. Universal Analytics was retired in 2023 and GA4 replaced it, but Google's refusal to sign a Business Associate Agreement applies to both the same way. The migration changed the product, not the policy.

What about the rest of a therapy practice's website?

Analytics is one surface among several. Intake forms, scheduling tools, and patient messaging are the higher-risk ones, and the fix for all of them is the same principle: keep protected health information off any system that has not signed a Business Associate Agreement to handle it. We wrote the full architecture we use for mental health clients, including why neither of our live builds has a form at all, at /baa.

Does NovraScale sign a Business Associate Agreement?

On a standard engagement, no, because we build the site so protected health information never reaches any system we operate. Whether that architecture satisfies your practice's own compliance obligations is a determination for you and your counsel to make, not us. Full detail is at /baa.