Telehealth providers subject to HIPAA should not use Google Analytics on pages that collect, process, or reveal protected health information (PHI). Google does not offer a business associate agreement (BAA) for Google Analytics, meaning the service cannot be treated as a HIPAA compliant solution for handling PHI.

 

Telehealth and website analytics

Telehealth providers use website analytics to understand visitor behavior, measure marketing performance, and improve the patient experience. However, tracking technologies can collect sensitive information about individuals' healthcare activities and transmit it to third-party vendors.

In its guidance on online tracking technologies, the US Department of Health and Human Services (HHS) explains that HIPAA-regulated organizations must ensure that their use of tracking technologies complies with the HIPAA Rules. For telehealth providers, this means assessing what information analytics tools collect, where that information is sent, and whether any disclosures of PHI are permitted under HIPAA.

 

Why isn't Google Analytics suitable for HIPAA-regulated telehealth websites?

Google Analytics helps website owners understand visitor behavior, measure traffic, and evaluate marketing performance. However, telehealth providers subject to the Health Insurance Portability and Accountability Act (HIPAA) must consider whether using the tool could expose PHI.

As noted above, Google does not sign a BAA for Google Analytics and thus does not represent the service as HIPAA compliant. In its official guidance on HIPAA and Google Analytics, Google states that “HIPAA-regulated entities using Google Analytics must refrain from exposing to Google any data that may be considered Protected Health Information (PHI), even if not expressly described as PII in Google’s contracts and policies.”

A BAA establishes the obligations of a business associate that handles PHI on behalf of a HIPAA-regulated organization. Under HHS guidance, when a tracking technology vendor qualifies as a business associate, the healthcare organization must ensure that PHI disclosures are permitted under HIPAA and establish the required BAA.

Since Google does not offer a BAA for Google Analytics, telehealth providers cannot rely on the service to handle PHI in circumstances requiring such an agreement.

Go deeper: Is Google Analytics HIPAA compliant? (2026 update)

 

How can Google Analytics expose patient information?

The risk depends on how Google Analytics is configured and which pages contain tracking scripts. Tracking technologies can collect information that individuals enter or select on healthcare websites, as well as technical identifiers that may be linked to their online activities.

According to the HHS, information disclosed to tracking technology vendors may include “an individual’s medical record number, home or email address, or dates of appointments, as well as an individual’s IP address or geographic location, device IDs, or any unique identifying code.” When this information meets the definition of individually identifiable health information (IIHI), it may constitute PHI when maintained or transmitted by a HIPAA-regulated entity. Importantly, the information does not necessarily need to include a diagnosis, treatment details, or billing information to qualify. HHS explains that IIHI collected through a regulated entity's website or mobile app generally constitutes PHI, even when the individual does not already have a relationship with the healthcare provider.

For example, tracking an appointment booking could expose information about an individual's healthcare activities if identifying information or appointment details are transmitted to an analytics vendor. Similarly, information entered into an online symptom checker could reveal sensitive health-related details.

However, visiting a webpage about a specific health condition does not automatically mean that the resulting data constitutes IIHI or PHI. HHS clarifies that linking an IP address or another identifier to a visit to a webpage about a health condition or healthcare provider is not sufficient on its own if the visit is unrelated to the individual's past, present, or future health, healthcare, or payment for healthcare. Telehealth providers should therefore assess what their tracking technologies collect and disclose rather than assume that all website activity is either protected or exempt from HIPAA.

See also: How to use web analytics tools and be HIPAA compliant

 

How can telehealth providers measure website performance more safely?

Telehealth providers can measure website traffic and marketing performance while reducing the risk of exposing sensitive patient information. The key is to evaluate what tracking technologies collect, limit the information shared with third parties, and choose analytics tools that support the provider's privacy and compliance requirements.

The HHS recommends that HIPAA-regulated organizations assess the use of tracking technologies as part of their security risk analysis and risk management processes. Its guidance on online tracking technologies also explains that healthcare providers must ensure disclosures of PHI are permitted under HIPAA and establish business associate agreements when required.

Here are several ways telehealth providers can measure website performance more safely:

 

Use aggregate website performance data

Providers can measure general website performance using aggregated metrics, such as overall page views, traffic trends, referral sources, and campaign performance, provided the analytics configuration does not disclose PHI. For example, a telehealth provider could assess which general marketing campaigns generate website visits without transmitting patient names, appointment details, or information entered into health assessment forms to third-party analytics vendors. However, aggregation alone does not guarantee compliance. Providers must consider what information the tracking technology collects and transmits before the data is aggregated.

 

Audit tracking technologies

Healthcare organizations should regularly review the tracking technologies installed on their websites and mobile applications. These may include analytics scripts, advertising pixels, tag managers, and session replay tools.

A study titled Beyond the click: Pixel tracking technologies and patient data security in hospitals analyzed historical website data from 2012 to 2023 and found that 66% of the sampled US hospital websites used pixel tracking. The researchers also reported an association between third-party pixel use and increased data breach risk. Although the study focused on hospital websites, its findings show why telehealth providers should review how third-party tracking tools collect and share patient data.

 

Choose analytics vendors carefully

Telehealth providers should evaluate analytics vendors based on their data collection practices, security controls, contractual terms, and ability to meet applicable privacy requirements. For HIPAA-regulated organizations, this includes determining whether a vendor qualifies as a business associate and whether a BAA is required. If a vendor will not sign a BAA, the provider must not disclose PHI to that vendor without the required authorization.

HHS also describes an approach in which a healthcare organization works with a customer data platform (CDP) vendor willing to sign a BAA and de-identify tracking information before sharing the de-identified data with other analytics vendors. This approach requires careful implementation; sending PHI to a vendor for de-identification must itself comply with HIPAA.

 

Keep analytics away from sensitive patient workflows

Providers should pay particular attention to appointment booking pages, symptom checkers, patient registration forms, and authenticated patient portals. Tracking technologies on these pages may access information that qualifies as PHI. Where possible, separate general marketing analytics from patient-facing workflows. Review event parameters and URLs to ensure they do not transmit names, email addresses, appointment information, diagnoses, or other sensitive data.

 

Include tracking technologies in security risk assessments

HHS recommends that regulated entities address tracking technologies in their security risk analysis and risk management processes. Providers should document potential risks, assess whether electronic PHI is being disclosed, and implement appropriate administrative, physical, and technical safeguards. These reviews should be repeated when new analytics tools are introduced or existing tracking configurations change.

See also: HIPAA compliant email for telehealth and virtual pharmacies

 

FAQS

Can I use Google Analytics 4 on my telehealth website?

Google Analytics 4 is subject to the same fundamental concern: whether its implementation exposes PHI. Changing settings or removing certain identifiers does not automatically establish HIPAA compliance.

 

Does removing personally identifiable information make Google Analytics compliant?

No. Removing names or email addresses does not necessarily eliminate PHI. Other identifiers and information about healthcare interactions may still identify an individual and relate to their health or healthcare.

 

Can I use Google Analytics if patients accept my cookie banner?

A cookie banner does not, by itself, authorise the disclosure of PHI under HIPAA. Providers must still ensure that their tracking practices comply with applicable requirements.

 

What is the best alternative to Google Analytics for telehealth?

The appropriate alternative depends on the provider's reporting needs and privacy requirements. Consider privacy-focused or healthcare-oriented analytics tools, and evaluate their data-handling practices, contractual terms, and security controls before implementation.