Skip to main content
BAA Directory

Does Google Ads sign a BAA?

The answer

Does not sign a BAA

No. Google says it does not intend its Google Ads call features to create HIPAA obligations, and tells covered entities not to accept those terms.

Ad platforms. Checked on the vendor's own pages on .

On this page

What Google says

“Unless otherwise specified in writing by Google, Google does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act, as amended (“HIPAA”), and makes no representations that the Communication Features satisfy HIPAA requirements.”

Source: Google Ads Help, Call Ads Supplemental Terms, HIPAA Disclaimer, checked .

“If you are (or become) a Covered Entity or Business Associate under HIPAA or are advertising on behalf of a third party that is (or becomes) a Covered Entity or Business Associate under HIPAA, and you wish to proceed with use of Communication Features, you should not accept these Supplemental Terms.”

Source: Google Ads Help, Call Ads Supplemental Terms, HIPAA Disclaimer, checked .

What this means for ad tracking

Google Ads is where your conversion data ends up, so the question is not whether Google will protect PHI but what you send it. A browser pixel sends the page address, the event name and identifiers with every conversion, and on a healthcare site those can describe a condition or a treatment.

Google's own BAAs cover the services they name, such as Google Workspace and Looker Studio, and Google says it does not offer one for Google Analytics.

Google's own terms rule out health information, so the workable route is to send Google Ads conversions that carry none: a neutral event name, hashed identifiers and no page details that reveal care.

Curve Compliance sends Google Ads conversions that way: server-side in place of the pixel, with neutral event names, PHI-like pattern detection and SHA-256 hashed identifiers, under a BAA it signs on every plan. Book a call to see it on your own funnel.

How Curve helps

  • Curve sends your Google Ads conversions server-side, in place of the Google Ads pixel, with neutral event names and SHA-256 hashed identifiers.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • Attribution is kept through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, in about a week, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Google Ads and patient data, read Is Google Ads Conversion Tracking HIPAA Compliant? Client-Side Risks and Server-Side Solutions.

Frequently asked questions

Does Google Ads sign a BAA?

No. Google says it does not intend its Google Ads call features to create HIPAA obligations, and tells covered entities not to accept those terms. In Google's words: “If you are (or become) a Covered Entity or Business Associate under HIPAA or are advertising on behalf of a third party that is (or becomes) a Covered Entity or Business Associate under HIPAA, and you wish to proceed with use of Communication Features, you should not accept these Supplemental Terms.” We checked Google's own pages on September 29, 2026.

Can I send Google data about patients?

Not health information. Google's own terms rule it out, as quoted on this page. Send Google Ads conversions with neutral event names and hashed identifiers, and nothing that reveals a condition or a treatment.

Can a healthcare business still track Google Ads ad conversions?

Yes, when the conversion carries no health information. Curve sends Google Ads conversions server-side, in place of the pixel, with neutral event names and identifiers hashed with SHA-256 to Google's requirements.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call