GA4 Healthcare Setup: A HIPAA-Aware Guide for Clinics

Clinic administrator configuring analytics on laptop

A default GA4 install on a clinic or pharmacy website is a liability, not a reporting tool. Google does not sign a Business Associate Agreement for Google Analytics, so nobody but you is responsible for making sure patient information never reaches its servers. The good news: you can still get clean, useful numbers on calls, forms and appointment requests. You just have to configure GA4 on purpose, not accept what the installer hands you.

This guide walks through the setup the way we would do it for an independent practice: decide what you track, scrub the data before it leaves, turn off what you don’t need, and audit it on a schedule.

Klyrmedia

Make Healthcare Analytics More Privacy-Aware

Klyrmedia helps healthcare providers with HIPAA-compliant websites and digital marketing tailored to clinics, practices, and independent pharmacies.

Explore healthcare marketing

TL;DR

GA4 is not a HIPAA-compliant service by default, and there is no BAA to lean on. Compliance is your job, and it is ongoing, not a one-time checkbox.
The biggest leaks are URLs, form fields and Enhanced Measurement. Strip identifiers from URLs, track form submissions (never contents), and switch off automatic events you don’t need.
Filter your own team and agency traffic, set data retention deliberately, and keep logged-in patient portals out of GA4 entirely.
Server-side tagging is the strongest control for sensitive sites, because it lets you strip data before Google ever sees it.
Get your compliance officer or healthcare attorney to sign off on the final design. This article is not legal advice.

Why healthcare sites can’t treat GA4 like a retail site
Before you touch GA4: decide what you actually need to measure
Step-by-step GA4 setup for a clinic or practice
When you need server-side tagging
A monthly audit routine that takes 30 minutes
What good GA4 reporting looks like for a small practice
Our take: measure less, govern it better
Want this built right the first time?
FAQ
Sources

Why healthcare sites can’t treat GA4 like a retail site

A store that leaks a shopping cart has a conversion problem. A clinic that leaks an appointment type next to an IP address may have a privacy problem.

The U.S. Department of Health and Human Services expects regulated entities to follow the HIPAA Privacy, Security and Breach Notification Rules when they use online tracking technologies. In July 2023, HHS and the FTC sent warning letters to hospital systems and telehealth providers specifically citing tools like Google Analytics and Meta Pixel.

Now the nuance, because the rules moved. On June 20, 2024, a federal court in Texas vacated part of that HHS guidance, the part that treated an IP address plus a visit to a public, unauthenticated page about a health condition as triggering HIPAA by itself. That’s a real change. It is not a green light.

Three things still hold:

Logged-in pages (patient portals, telehealth, appointment management) remain the highest-risk area for tracking technologies.
Anything that ties a person to a health detail, like a name, email, date of birth, appointment ID or condition inside a URL or event, is a problem however it got there.
State privacy laws and FTC enforcement don’t care about the Texas ruling.

We covered how this plays out for providers in our write-up of the June 2026 Google Analytics compliance ruling. Read it alongside this guide, and talk to counsel about where your practice sits.

The practical takeaway: assume the strict reading when you configure, and you’ll be fine under either.

Before you touch GA4: decide what you actually need to measure

Most practices install GA4, stare at 40 reports, and use none of them. Start from the questions the owner or practice manager really asks:

How many new patient calls did the website generate last month?
Which pages and traffic sources produce appointment requests?
Are our Google Ads paying for themselves?
Do people on phones drop off the booking form?

Notice what’s missing: who those people were. You don’t need that. You need counts, sources and paths. Everything in the setup below follows from that rule: measure actions, never identities.

Write down your key events before configuring anything. For a typical independent pharmacy or clinic:

Key event	What it tells you	What it must never include
Click-to-call (tel: link)	Phone demand from the site	The caller’s number
Appointment form submitted	Booking intent	Any form field values
Refill request started	Pharmacy engagement	Rx numbers, medication names
Directions click	Local foot-traffic intent	User location detail
Contact form submitted	General inquiries	Message text

If an event name or parameter would reveal a diagnosis, a medication or a person, rename it or drop it.

Step-by-step GA4 setup for a clinic or practice

1. Create the property and data stream

Create a GA4 property under a Google account your practice owns, not a former employee’s or a freelancer’s personal login. Then add a web data stream. Google’s own walkthrough for creating a property, adding a data stream and installing the code is the reference for the mechanics.

Two housekeeping notes. Use role-based access so you can remove people cleanly when staff or vendors change. And keep a written list of every person and agency with access. You’ll need it for the internal traffic step too.

2. Turn off Enhanced Measurement, then add back only what you need

Enhanced Measurement is the switch that makes GA4 feel easy. It also automatically collects page views, scrolls, outbound clicks, site search, video engagement and file downloads. On a healthcare site, site search terms and URL query strings can carry exactly the information you’re trying to protect.

The guidance from healthcare analytics practitioners is to disable Enhanced Measurement and re-enable only necessary, non-identifiable events such as phone clicks and form submissions. We agree.

In practice:

Go to Admin > Data streams > your web stream > Enhanced measurement.
Turn it off, or at minimum turn off site search, form interactions and file downloads.
Build the events you listed above manually, through Google Tag Manager or your site’s code.

It’s more work. It’s also the difference between knowing what GA4 collects and hoping.

3. Stop patient data leaking through URLs

This is the leak we see most. A booking confirmation page at /thank-you?name=Jane&appointmentid=4821&condition=... just handed identifiers to Google, along with the page URL.

There are two layers to the fix.

Layer one: strip parameters. GA4 lets you exclude query parameters from page URLs. A practitioner checklist suggests listing parameters such as name, email, phone, date of birth, appointment ID, patient ID, condition and insurance ID so GA4 drops them before processing. Treat that as a starting list and add whatever your own forms and scheduling tools generate.

Layer two: fix the source. Stripping is a safety net. The better answer is redesigning the site so URLs never contain PHI in the first place, and submitting forms with POST requests instead of putting values in the address bar. Experts describe this as changing how data is exposed in the browser, and it’s the part that doesn’t depend on a filter working forever.

Also check:

Page titles. A title like “Jane Smith - Appointment Confirmed” is data too.
Referrer URLs from third-party schedulers or portals.
Internal site search result URLs.

If your site was built without this in mind, it’s a web build issue, not an analytics issue. Our HIPAA compliant website workflow lays out how we structure pages and forms so this problem doesn’t start.

4. Track form submissions without capturing form contents

The event is “a form was submitted.” That’s it. Not what was typed.

If you use Google Tag Manager, set up a trigger on the successful submission or the thank-you page view, and make sure nothing reads field values into variables. A safe event looks like this in concept: event name form_submission, a generic form_type like new_patient or refill, and a page path with no parameters. Nothing else.

For forms that collect health information, the stronger design is to have your server send a sanitized event to GA4 containing only aggregate metadata. More on that in the server-side section.

5. Handle phone calls carefully

For a lot of practices, the phone is the conversion. Counting tel: link clicks in GA4 is fine, because you record the click and not the call. But the moment you add dynamic number insertion or call recording, you’re handling conversations that may contain PHI, and a BAA with that vendor is non-negotiable. We wrote up exactly what to check in HIPAA compliant call tracking: BAA and §164.312 checks.

6. Filter internal traffic, including your agency

Your front desk checks the website all day. Your marketing vendor does too. Without filters, that traffic inflates sessions and conversions and makes your patient acquisition cost look better than it is.

Practitioners recommend manually filtering every internal IP address, including staff and agency access. The steps:

In Admin > Data streams > Configure tag settings > Define internal traffic, add each office, pharmacy and agency IP range.
Create a data filter for internal traffic, test it in testing mode, then switch it to active.
Re-check whenever your ISP changes your IP or a new vendor starts.

Dirty data isn’t only noisy. A guide written for clinics warns that unfiltered internal traffic inflates conversions and skews acquisition ROI. That’s a Dubai-focused piece, but this problem has nothing to do with geography.

7. Set data retention on purpose

GA4’s default retention for event-level data is short. One healthcare setup guide notes that many owners forget to move retention from the 2-month default to 14 months, which means you can’t do reliable year-over-year comparisons.

Here’s the honest tradeoff, because the advice differs. Longer retention helps you see seasonality (flu season, back-to-school physicals, open enrollment). Shorter retention limits how long a mistake sits in your property if something slips through. Another practitioner checklist recommends the 2-month minimum and exporting what you need elsewhere under proper controls.

Our take: if your event design is clean and audited, choose 14 months in Admin > Data settings > Data retention, and turn off “reset user data on new activity” if you want a harder cap. If you aren’t sure your data is clean, start short, fix the leaks, then extend. Standard reports aggregate data and aren’t affected by this setting, but custom explorations are.

8. Keep patient portals and logged-in areas out

HHS has been clear that user-authenticated pages, like a patient portal or telehealth platform, are where tracking technologies need the most scrutiny. Our default: no GA4 tag on authenticated pages at all. Measure the marketing site, not the patient’s private experience. If your business needs portal analytics, use a vendor that will sign a BAA and have your attorney review it.

9. Connect Google Ads with care

Importing GA4 conversions into Google Ads is how you learn which campaigns produce calls and bookings. It’s also another data flow. Pass only the non-identifying conversion events from your list. Don’t build remarketing audiences from visits to condition-specific or treatment-specific pages without a clear sign-off. If you run paid search, our Healthcare PPC service is built around those guardrails.

When you need server-side tagging

A normal GA4 tag runs in the visitor’s browser and sends data straight to Google. Server-side tagging inserts a server you control in between. Your server receives the event, removes or hashes what shouldn’t leave, and forwards only the cleaned version.

That’s why it’s described as a compliance firewall: only stripped, aggregated data reaches Google, instead of the raw data a browser tag captures. The same source points out a side benefit. Because you filter at the server, you also get cleaner numbers, with less ad-blocker interference and bot traffic.

It’s worth considering when:

Your site has forms that collect health details.
You use several third-party scripts and can’t audit all of them.
You run significant ad spend and need reliable conversion data.
Your compliance team wants a single enforcement point.

It isn’t free. You’ll host a tagging server (cloud hosting costs apply), maintain it, and still need to design what gets stripped. And let’s be blunt: server-side tagging doesn’t make GA4 HIPAA-compliant on its own. It reduces what you send. It doesn’t create a BAA.

A monthly audit routine that takes 30 minutes

The most dangerous myth we hear is that anonymizing is a setup task. HHS and Google’s own terms put the responsibility squarely on the practice, and that responsibility doesn’t end at launch. Once a month:

Open Reports > Engagement > Pages and screens and scan page paths for anything that looks like a name, email, ID or condition.
Check event parameters in DebugView after any website or form change.
Review who has GA4 and Tag Manager access. Remove anyone who left.
Confirm the internal-traffic filter is still active.
After any new plugin, scheduler or landing page, re-test the whole booking path.

If you export to BigQuery, you can also search the raw data for PHI-like patterns. Keep it simple at first. A manual scan catches most problems.

What good GA4 reporting looks like for a small practice

Once the data is clean, you can actually use it. A one-page monthly report for an owner or administrator should show:

Calls, form submissions and refill requests, by month, with the change from last month.
Top traffic sources (Google Business Profile, organic search, paid, direct).
Top landing pages for new patient inquiries.
Mobile vs. desktop conversion rate. Many practice sites lose people on the phone.
Ad cost per conversion, if you run ads.

One caution on interpreting GA4 at a small scale: low volumes mean noisy percentages. Twelve calls versus nine isn’t a trend. Look at quarters and keep context from your front desk. If the phones were slammed but GA4 shows a dip, trust your staff and go check the setup.

Our take: measure less, govern it better

We work with independent pharmacies, clinics and practices, and what we see over and over is the same pattern. Someone installs GA4 in ten minutes, the agency adds a pixel, the scheduler adds another, and six months later nobody can say what leaves the site. That’s not analytics. That’s a leak with a dashboard.

Our position is simple. Healthcare analytics isn’t about collecting more data. It’s about collecting better-governed data. Count the calls. Count the forms. Know your sources. Leave the identities out.

Our take: measure less, govern it better — overview diagram

We’d also push back on two common extremes. Ripping GA4 out entirely leaves you blind, and a lot of independents can’t afford to market without knowing what works. Leaving it on defaults and hoping the Texas ruling covers you is the other mistake. The middle path is a documented, minimal, audited setup, reviewed by someone who understands both the marketing and the compliance side.

And the compliance isn’t separate from the growth. A practice that can trust its numbers spends its ad budget better and competes harder against the big chains and online giants.

— Opinly

Want this built right the first time?

If your site is already live and you’re not sure what GA4 is collecting, start with an audit of the website, the tag setup and the forms. KLYR Media works only with healthcare providers, so HIPAA-compliant web design and healthcare SEO are built with measurement and compliance considered from day one. You can see everything we do at klyrmedia.com.

FAQ

Is GA4 HIPAA compliant?

No. Google’s own help documentation states that HIPAA generally doesn’t apply to its Analytics customers’ use the way it does for regulated entities, and Google doesn’t sign a BAA for GA4. That means you must ensure no PHI is sent to it. Many practices can use GA4 within those limits, but have your compliance officer or healthcare attorney review your design.

Does the 2024 court ruling mean I can use GA4 freely?

Not freely. The court vacated part of the HHS guidance about IP addresses and public pages, but identifiers in URLs, forms and logged-in pages remain risky, and state laws and the FTC still apply. Configure as if the stricter reading applies.

Should I use GA4 on my patient portal?

Our advice is no. Authenticated pages are where HHS expects the most care with tracking, so keep GA4 on your public marketing pages. If you need portal analytics, choose a vendor willing to sign a BAA and have your attorney review the arrangement.

What’s the first thing to fix on an existing GA4 property?

Check your page paths and event parameters for names, emails, IDs or conditions, then turn off Enhanced Measurement features you don’t need. After that, add internal traffic filters and set data retention deliberately.

Do I need server-side tagging?

Not every practice does. It makes the most sense if your forms collect health details, you run many third-party scripts, or you spend meaningfully on ads. It reduces what reaches Google, but it doesn’t turn GA4 into a HIPAA-compliant service.

GA4 Healthcare Setup: A HIPAA-Aware Guide for Clinics