Skip to main content
BAA Directory

Is Google Ads HIPAA compliant? Does it sign a BAA?

The answer

Does not sign a BAA

No. Google says it does not intend its Google Ads call features to create HIPAA obligations, and tells covered entities not to accept those terms.

Ad platforms. Checked on the vendor's own pages on .

Running Google Ads for a healthcare brand? Curve Compliance sends your conversions server-side with PHI filtered out, under a BAA on every plan. Book a call

On this page

What Google says

“Unless otherwise specified in writing by Google, Google does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act, as amended (“HIPAA”), and makes no representations that the Communication Features satisfy HIPAA requirements.”

Source: Google Ads Help, Call Ads Supplemental Terms, HIPAA Disclaimer, checked .

“If you are (or become) a Covered Entity or Business Associate under HIPAA or are advertising on behalf of a third party that is (or becomes) a Covered Entity or Business Associate under HIPAA, and you wish to proceed with use of Communication Features, you should not accept these Supplemental Terms.”

Source: Google Ads Help, Call Ads Supplemental Terms, HIPAA Disclaimer, checked .

What this means for ad tracking

Google Ads is where your conversion data ends up, so the question is not whether Google will protect PHI but what you send it. A browser pixel sends the page address, the event name and identifiers with every conversion, and on a healthcare site those can describe a condition or a treatment.

Google's own BAAs cover the services they name, such as Google Workspace and Looker Studio, and Google says it does not offer one for Google Analytics.

Google products and BAAs: Google Workspace signs a BAA, Google Cloud signs a BAA, Google Analytics 4 does not, Google Ads does not, and Google Tag Manager has no public statement.

Google's own terms rule out health information, so the workable route is to send Google Ads conversions that carry none: a neutral event name, hashed identifiers and no page details that reveal care. Booked and attended appointments can still reach Google Ads: offline conversion import for patient appointments shows how to send them without health details.

Curve Compliance sends Google Ads conversions that way: server-side in place of the pixel, with neutral event names, PHI-like pattern detection and SHA-256 hashed identifiers, under a BAA it signs on every plan. Book a call to see it on your own funnel.

Already restricted by Google Ads? Start with the notice you saw: Personalized advertising policy for health audiences, Healthcare and medicines disapproval or Account suspended.

A business associate agreement binds only the vendor that signs it, so each vendor that handles patient information for you needs its own.

How Curve helps

  • Curve sends your Google Ads conversions server-side, in place of the Google Ads pixel, with neutral event names and SHA-256 hashed identifiers.
  • Curve checks every event for PHI-like patterns before it goes out, and its neutral event names keep conditions and treatments out of what the platforms see.
  • Curve keeps attribution through booking tools, so a booked appointment is credited to the ad that brought the patient in.
  • Curve adds consent management to your site, alongside the tracking.
  • Curve signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you in about a week.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Read the full guide

For the full picture on Google Ads and patient data, read Is Google Ads Conversion Tracking HIPAA Compliant? Client-Side Risks and Server-Side Solutions.

Frequently asked questions

Is Google Ads HIPAA compliant?

No. Google says it does not intend its Google Ads call features to create HIPAA obligations, and tells covered entities not to accept those terms. Without a BAA, Google Ads should not receive patient information.

Does Google Ads sign a BAA?

No. Google says it does not intend its Google Ads call features to create HIPAA obligations, and tells covered entities not to accept those terms. In Google's words: “If you are (or become) a Covered Entity or Business Associate under HIPAA or are advertising on behalf of a third party that is (or becomes) a Covered Entity or Business Associate under HIPAA, and you wish to proceed with use of Communication Features, you should not accept these Supplemental Terms.” We checked Google's own pages on September 29, 2026.

Can I send Google data about patients?

Not health information. Google's own terms rule it out, as quoted on this page. Send Google Ads conversions with neutral event names and hashed identifiers, and nothing that reveals a condition or a treatment.

Can a healthcare business still track Google Ads ad conversions?

Yes, when the conversion carries no health information. Curve sends Google Ads conversions server-side, in place of the pixel, with neutral event names and identifiers hashed with SHA-256 to Google's requirements.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup in about a week. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Google before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call