Best HIPAA-Compliant Conversion Tracking for Urgent Care

The best HIPAA-compliant conversion tracking for an urgent care center signs a BAA, credits online check-ins, calls and visits to the ad that drove them, and sends those conversions to Google and Meta server-side under neutral names, without the symptom or the reason for the visit. Curve Compliance does this for single-site and multi-location urgent care groups: it replaces browser pixels with one script, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week.

Book a call. Curve Compliance tracks urgent care check-ins, calls and visits server-side for Google, Meta and Microsoft, keeps symptoms out of every event, and signs a BAA on every plan. Book a call with Curve.

Where urgent care tracking goes wrong

Urgent care sites are built around symptoms and services: a strep test page, a flu shot page, an X-ray page, a wait-time page and an online check-in. A browser pixel sends those page names and URLs to the ad platforms. Meta's list of prohibited information includes “Diseases, medical conditions and injuries” and “Medical procedures, treatments and testing” (Meta). Its Business Tools Terms, effective November 3, 2025, say advertisers will not share data that “includes or is based on, directly or otherwise, health information” (Meta Business Tools Terms).

Online check-in is the sensitive step. HHS gives the example of tracking that collects a “reason for seeking health care typed or selected by an individual” when someone “makes an appointment with a health care provider or enters symptoms in an online tool to obtain a health analysis” (HHS). The same HHS page notes that on June 20, 2024 a federal court vacated part of the bulletin: the part saying HIPAA applies when a tool connects a visitor's IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers. The vacated part is about an IP address and a page visit; the HHS example above is about a reason typed into a booking step.

Then there is the visit itself. A patient who calls or walks in has left the website, so a pixel that stops at the website never sees the outcome. See walk-in attribution for urgent care.

What the right tool does for urgent care

• Signs a BAA. Curve Compliance signs a BAA on every plan, for one clinic or a regional chain.
• Sends conversions server-side. Curve Compliance replaces browser ad pixels with one script and sends conversions from its servers to Google Ads, Meta Conversions API, Microsoft Advertising, TikTok and LinkedIn.
• Keeps symptoms out of the events. Each platform receives only a fixed list of fields, events can use neutral names such as a check-in rather than a strep test, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as a condition name in a URL, and flags them so they can be stopped at the source.
• Credits online check-ins and walk-ins. Curve tracks which ad campaigns and keywords drive walk-in visits and online check-ins with server-side attribution. A visit that comes back from your EHR or practice system through an incoming webhook or an offline upload is credited to the original ad click.
• Counts calls. Calls from CallRail and other call tracking tools reach Curve by webhook, and Curve credits each one to the ad that drove it.
• Measures every location. Curve measures hyper-local campaigns across Google Maps, local search ads and geo-targeted Meta campaigns by location, and a multi-location chain manages every clinic from a single dashboard. Campaign Reporting puts Meta and Google Ads spend next to the conversions Curve tracked.
• Shows what each platform accepted. Event Logs show what Curve sent to Google, Meta and TikTok and what each platform accepted.

Questions to ask on a demo

Ask the vendor	A good answer	Curve Compliance
Will you sign a BAA on the plan we would buy?	Yes, before any data flows	Yes, on every plan
How do conversions reach Google, Meta and Microsoft?	Server-side, through each platform's conversions API	Server-side to Google Ads, Meta Conversions API, Microsoft Advertising, TikTok and LinkedIn
What stops a symptom or service name reaching an ad platform?	A fixed field list and PHI detection, not a promise	A fixed field list per platform, neutral event names and PHI-like pattern checks on every event
Can online check-ins count as conversions?	Yes, as a neutral event credited to the ad click	Yes, tracked server-side and credited to the campaign and keyword
How do calls get credited?	Call tracking matched to the ad click	Calls from CallRail and other call tracking tools reach Curve by webhook and are credited to the ad
Can a completed visit count?	Outcomes from your practice system, matched to the ad click	Incoming webhooks and offline uploads from your EHR or practice system, credited to the original ad click
Can we see results for each location?	Reporting by location, in one place	Campaigns measured by location, with every clinic in a single dashboard
Who does the setup, and how long does it take?	A named team and a timeline	Curve's team does it, typically live in about a week

Platform rules for urgent care: calls, walk-ins and audiences

These rules apply whatever tracking you use. The key lines, checked October 26, 2026:

• Google call ads. Google's Call Ads Supplemental Terms currently apply to advertisers in the United States. Google says it “does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act”, and a covered entity or business associate that wishes to use those features “should not accept these Supplemental Terms” and should instead contact its Google account representative or Google support “to request exclusion from monitoring and recording of Communications” (Google Ads Help). A call tracking tool that signs a BAA, listed below, is another route, with the call conversion sent to Google server-side.
• Microsoft Advertising. Microsoft says it “does not offer Business Associate Agreements (BAAs) for UET”, its conversion tag, and tells advertisers: “Do not place UET tags on pages subject to HIPAA regulations.” (Microsoft Advertising Help)
• Google, health audiences. “Content related to Health is a sensitive interest category” that covers “Physical or mental health conditions”. In that category, “You can't use advertiser-curated audiences”, which Google says include Customer Match and your data segments. Location targeting is on Google's list of predefined options that stay available (Google, Health personalized ads policy).

Whether HIPAA reaches a given page, call or check-in step depends on your setup, so talk to your counsel.

If Meta has restricted your events

Meta may place a website in its Health and wellness data source category, which covers sites “associated with medical conditions or specific health statuses, provider/patient relationships” (Meta, About data source categories). Restrictions range from Core Setup, which “Restricts the sharing of custom parameters and parts of URLs following the domain”, to limits on “specific mid and lower funnel events”, up to full restrictions on sharing all events (Meta, data sharing restrictions). No tracking tool removes that category, and sending events server-side doesn't change it. The right setup keeps campaigns optimizing on the events Meta still accepts and keeps check-ins, calls and visits in your own reporting. Curve Compliance does both. See what core setup still allows and Meta campaigns for urgent care.

Does your call and review stack sign a BAA?

Urgent care runs on calls and reviews, so those vendors handle patient details too. Here is what each says on its own pages, as recorded in Curve's BAA Directory:

Tool	Role for urgent care	What the vendor says	Source
CallRail	Call tracking	CallRail says it signs “a business associate agreement (BAA) with each of our Healthcare clients”	CallRail FAQ
CallTrackingMetrics	Call tracking	CTM says it “will put in place Business Associate Agreements (BAAs) with customers” as part of its HIPAA Compliance Program	CTM Security
Invoca	Call tracking	Invoca “offers an industry-standard BAA template” to customers subject to HIPAA	Invoca HIPAA page
WhatConverts	Call and lead tracking	Once a BAA is executed, its team “will activate HIPAA compliance for your profile”	WhatConverts Help Center
Podium	Reviews and messaging	A covered entity client and Podium “agree to the terms of Podium's BAA”	Podium Terms of Service
Birdeye	Reviews	Its HIPAA terms are “incorporated into the Master Service Agreement” for covered entity customers	Birdeye HIPAA statement
Microsoft Advertising	Search ads	No BAA for UET, its conversion tag	Microsoft Advertising Help
Curve Compliance	Server-side ad tracking	Signs a BAA on every plan	Directory entry

A BAA with a call tracking vendor covers the recordings and caller details it holds. The conversion that reaches Google or Meta should still leave out caller details and call content. For a side-by-side view, see HIPAA-compliant call tracking software, and for calls that Google's AI places to clinics, see Google AI calls and call tracking.

How Curve Compliance helps

For an urgent care group, Curve Compliance replaces the pixels on your symptom, service and check-in pages with one script. An online check-in, a call and a completed visit each become a neutral event, sent server-side with a fixed list of fields to Google Ads, Meta and Microsoft Advertising, and Curve strips PHI before data reaches an ad platform. Calls arrive from your call tracking tool by webhook, and visits from your practice system by webhook or offline upload, each credited to the original ad click. Event Logs show what each platform accepted, and Campaign Reporting puts Meta and Google Ads spend next to check-ins, calls and visits.

Start with the free website scan to see which pixels and trackers your pages load today, or read Curve Compliance for urgent care. For how a booked visit is matched to its ad, see booked appointment attribution. Other guides in this series cover TRT clinics, plastic surgery, addiction treatment and telehealth companies.

Sources, checked October 26, 2026: Google Call Ads Supplemental Terms; Google Ads Health personalized ads policy; Microsoft Advertising, UET safeguards for sensitive data; Meta Business Tools Terms; Meta, About prohibited information; Meta, About data source categories; Meta, data sharing restrictions by category; HHS bulletin on online tracking technologies; vendor pages for CallRail, CallTrackingMetrics, Invoca, WhatConverts, Podium and Birdeye.

Frequently Asked Questions

What is the best HIPAA-compliant conversion tracking for urgent care?

Curve Compliance is built for it: it signs a BAA on every plan, credits online check-ins, calls and visits to the ad click, and sends them server-side to Google, Meta and Microsoft under neutral names, without symptoms or reasons for the visit.

Do urgent care centers need HIPAA-compliant tracking?

If your center is a HIPAA covered entity, yes. HHS says “The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes protected health information (PHI)”, and online check-in is the kind of step its bulletin describes (HHS). Meta's terms bar health information either way (Meta Business Tools Terms).

Can walk-ins be credited to Google Ads?

Yes, when an earlier step carried the ad click, such as an online check-in, a call or a form. Curve matches the visit when it comes back from your practice system through a webhook or an offline upload, credits it to the original click and sends it to Google Ads server-side.

Can phone calls from ads be tracked without sharing PHI?

Yes. A call tracking tool that signs a BAA records the call, Curve receives it by webhook, and only the conversion goes to Google Ads or Meta, server-side, under a neutral name and with a fixed list of fields.

Does Google sign a BAA for call ads?

No. Google says it “does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act”, and that a covered entity or business associate that wishes to use those features “should not accept these Supplemental Terms” and should instead contact Google “to request exclusion from monitoring and recording of Communications” (Google).

Does Curve Compliance work with CallRail?

Yes. CallRail sends each call to Curve by secure webhook, and Curve forwards the conversion server-side, credited to the ads, campaigns and keywords that drove it. See Curve Compliance and CallRail.

How long does setup take for an urgent care group?

Curve's team does the setup, typically live in about a week, including the call tracking connection, the check-in flow and the event mapping for each ad platform.

Talk to Curve Compliance

Book a call. Want check-ins, calls and walk-ins counted for every location without sending symptoms to Google or Meta? Curve's team will check what your site sends today and set up server-side tracking under the BAA Curve signs on every plan. Book a call with Curve.