Google Analytics is a web and app analytics platform that helps organizations understand how users interact with their websites, apps, and digital campaigns.

With Google Analytics, businesses can measure customer journeys, analyze traffic, review marketing performance, and use reporting tools to improve digital experiences.

Is Google Analytics HIPAA compliant? No, based on our research, Google Analytics is not HIPAA compliant.

 

What changed this year?

As of June 2026, our review did not identify any publicly disclosed changes to Google Analytics HIPAA related policies or BAA terms.

Google continues to state that HIPAA regulated entities must not use Google Analytics in a way that gives Google access to protected health information (PHI).

 

Will Google Analytics sign a business associate agreement (BAA)?

No. Google does not offer a BAA for Google Analytics. Because Google Analytics is not covered by a BAA and Google instructs HIPAA regulated entities not to expose PHI to the service, Google Analytics is generally not considered HIPAA compliant for handling PHI.

Google’s HIPAA and Google Analytics guidance states, “Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service.”

 

Conclusion

Google Analytics does not sign a BAA and is therefore not HIPAA compliant. Healthcare organizations should not place Google Analytics tags on pages where the tool may collect or disclose PHI, including authenticated patient portals, appointment pages, or other HIPAA covered areas of a website or app.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a business associate agreement?

A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.

 

What is HIPAA?

HIPAA sets national standards for protecting the privacy and security of certain health information.

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.