Best HIPAA-Compliant Tracking for Addiction Treatment

The best HIPAA-compliant tracking for addiction treatment signs a BAA, credits admissions calls, insurance verification forms and booked assessments to the ad that drove them, and sends those conversions to Google, Meta and Microsoft server-side under neutral names, with no substance, diagnosis or insurance details in any event. Curve Compliance does this for detox, residential and outpatient programs: it replaces browser pixels with one script, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week.

Book a call. Curve Compliance tracks admissions calls, forms and booked assessments server-side for Google, Meta and Microsoft, keeps substances and diagnoses out of every event, and signs a BAA on every plan. Book a call with Curve.

Where addiction treatment tracking goes wrong

Rehab sites are organized by substance and level of care: an alcohol detox page, an opioid treatment page and an insurance verification form that asks for the insurer and member ID. A browser pixel sends those pages and form events to the ad platforms. Meta's list of prohibited information includes “Diseases, medical conditions and injuries” and “Physical locations that identify a health condition, or places of treatment and counseling” (Meta). Its Business Tools Terms, effective November 3, 2025, bar data that “includes or is based on, directly or otherwise, health information” (Meta Business Tools Terms).

Part 2 reaches the front door too. Its rules “cover any information (including information on referral and intake) about patients receiving diagnosis, treatment, or referral for treatment for a substance use disorder created by a part 2 program” (42 CFR 2.12). Admissions that start with a phone call and end in your CRM or EHR happen where a pixel never sees them. If you buy leads, read why third-party rehab leads create HIPAA liability.

What the right tool does for an addiction treatment center

• Signs a BAA. Curve Compliance signs a BAA on every plan.
• Sends conversions server-side. Curve Compliance replaces browser ad pixels with one script and sends conversions from its servers to Google Ads, Meta Conversions API, Microsoft Advertising, TikTok and LinkedIn.
• Keeps substances and diagnoses out of the events. Each platform receives only a fixed list of fields, events can use neutral names such as an admissions inquiry rather than detox, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names and form answers, and flags them before data reaches an ad platform.
• Hosts the insurance verification form. Curve Forms are HIPAA-hosted intake and lead forms with ad attribution attached. They can screen people out by insurance, and a crisis outcome has its own end screen; screened-out and crisis submissions send no conversion to ad platforms, and form answers are never sent.
• Credits admissions calls. CallRail sends each call to Curve by secure webhook, and Curve forwards the conversion server-side, credited to the ads, campaigns and keywords that drove it. Other call tracking tools connect through an incoming webhook.
• Credits assessments and admissions. Curve keeps the ad click when someone books an assessment in Calendly, Acuity or IntakeQ, or in GoHighLevel once Curve's team sets it up, and admissions come in from your CRM or EHR through incoming webhooks, Keragon or an offline upload, each credited to the original ad click.
• Shows what each platform accepted. Event Logs show what Curve sent to each platform and what it accepted, and Campaign Reporting puts Meta and Google Ads spend next to calls, assessments and admissions.

Questions to ask on a demo

Ask the vendor	A good answer	Curve Compliance
Will you sign a BAA on the plan we would buy?	Yes, before any data flows	Yes, on every plan
How do conversions reach Google, Meta and Microsoft?	Server-side, through each platform's conversions API	Server-side to Google Ads, Meta Conversions API, Microsoft Advertising, TikTok and LinkedIn
What stops a substance, diagnosis or insurer reaching an ad platform?	A fixed field list and PHI detection, not a promise	A fixed field list per platform, neutral event names and PHI-like pattern checks on every event
How are admissions calls credited?	Call tracking matched to the ad click	Calls arrive from CallRail or another call tracking tool by webhook and are credited to the ad, campaign and keyword
Can an admission count, not just an inquiry?	Webhooks, EHR or CRM connections, offline uploads	Incoming webhooks, Keragon connections to EHR and intake tools, and offline uploads
What happens to crisis submissions?	No conversion is sent	Curve Forms show a crisis end screen and send no conversion to ad platforms
Who does the setup, and how long does it take?	A named team and a timeline	Curve's team does it, typically live in about a week

Platform rules for rehab ads: Google, Meta, Microsoft and LegitScript

These rules apply whatever tracking you use. The key lines, checked October 26, 2026:

• Google. “Google restricts the promotion of recovery-oriented drug and alcohol addiction services.” Its examples include “Lead generators or referral agencies for addiction services” (Google Ads, Addiction services). In the United States, “you must be certified as an addiction services provider by the LegitScript Certification program”, and “Advertisers must also be certified with Google.” (Google Ads, Healthcare and medicines)
• Meta. “Meta requires advertisers who wish to run addiction treatment ads targeting people in the United States to be certified with LegitScript and apply to Meta for permission to advertise.” (Meta Advertising Standards)
• Microsoft Advertising. “Advertising for drug and alcohol addiction recovery is only allowed in the United States.” Advertisers of rehab facilities and similar offerings “must be certified by Legitscript”, and “Lead generation ads are not allowed.” (Microsoft Advertising policy)
• LegitScript. LegitScript says its certification “is required to run addiction treatment ads on platforms including Google, Meta, Microsoft Ads, and Nextdoor”, and that “US-based applicants who collect, store, or transmit Protected Health Information (PHI) must be in compliance with all applicable HIPAA requirements.” (LegitScript)

See LegitScript certification for healthcare ads and Google Ads addiction services certification.

42 CFR Part 2 and its February 16, 2026 compliance date

Part 2 applies to “a federally assisted program”, such as a person, other than a general medical facility, that “holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment” (42 CFR 2.11).

HHS updated Part 2 with a final rule published in the Federal Register on February 16, 2024 (89 FR 12472). It took effect on April 16, 2024, and “Persons subject to this regulation must comply with the applicable requirements of this final rule by February 16, 2026.” It makes changes “to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule” (Federal Register). For what that means for marketing, see 42 CFR Part 2 for behavioral health marketing. Whether Part 2 covers your program, and which forms and calls hold Part 2 information, are legal questions, so talk to your counsel.

If Meta has restricted your events

Meta may place a website in its Health and wellness data source category, which covers sites tied to “provider/patient relationships” and lists a “condition-specific support group” among its examples (Meta, About data source categories). Restrictions range from Core Setup, which “Restricts the sharing of custom parameters and parts of URLs following the domain”, to limits on “specific mid and lower funnel events”, up to full restrictions on sharing all events (Meta, data sharing restrictions). No tracking tool removes that category, and sending events server-side doesn't change it. The right setup keeps campaigns optimizing on the events Meta still accepts and keeps calls, assessments and admissions in your own reporting. Curve Compliance does both. See what core setup still allows.

Does your admissions stack sign a BAA?

Here is what each admissions vendor says on its own pages, as recorded in Curve's BAA Directory:

Tool	Role in admissions	What the vendor says	Source
CallRail	Call tracking	CallRail says it signs “a business associate agreement (BAA) with each of our Healthcare clients”	CallRail FAQ
CallTrackingMetrics	Call tracking	CTM says it “will put in place Business Associate Agreements (BAAs) with customers” as part of its HIPAA Compliance Program	CTM Security
Invoca	Call tracking	Invoca “offers an industry-standard BAA template” to customers subject to HIPAA	Invoca HIPAA page
Salesforce	CRM	The customer and Salesforce “must sign a BAA that includes the HIPAA Covered Service”	Salesforce BAA restrictions
GoHighLevel	CRM and follow-up	HighLevel offers “an optional, account-wide HIPAA add-on” that enables BAAs	HighLevel Support
Microsoft Advertising	Search ads	Microsoft “does not offer Business Associate Agreements (BAAs) for UET”	Microsoft Advertising Help
Curve Compliance	Server-side ad tracking	Signs a BAA on every plan	Directory entry

A BAA covers the data that one vendor holds for you. It does not reach the ad platforms, so conversions should reach them without substance or insurance details. See which ad platforms sign a BAA.

How Curve Compliance helps

For an addiction treatment center, Curve Compliance replaces the pixels on your program, admissions and insurance pages with one script. An insurance verification form, an admissions call, a booked assessment and an admission each become a neutral event, sent server-side with a fixed list of fields to Google Ads, Meta and Microsoft Advertising, and Curve strips PHI before data reaches an ad platform. Which events your program sends at all is your team's decision under Part 2. Event Logs show what each platform accepted, and Campaign Reporting shows which campaigns produced calls, assessments and admissions, not only clicks.

Start with the free website scan to see which pixels and trackers your admissions pages load today, or read Curve Compliance for addiction treatment centers. Other guides in this series cover mental health practices, TRT clinics, urgent care and plastic surgery.

Sources, checked October 26, 2026: Google Ads Addiction services policy; Google Ads Healthcare and medicines policy; Meta Advertising Standards, Drug and Alcohol Addiction Treatment; Microsoft Advertising Healthcare and Pharmaceutical policy; LegitScript Addiction Treatment Certification; 42 CFR 2.11; 42 CFR 2.12; Federal Register, 89 FR 12472; Meta Business Tools Terms; Meta, About prohibited information; Meta, About data source categories; Meta, data sharing restrictions by category; HHS bulletin on online tracking technologies; vendor pages for CallRail, CallTrackingMetrics, Invoca, Salesforce, HighLevel and Microsoft.

Frequently Asked Questions

What is the best HIPAA-compliant tracking for addiction treatment?

Curve Compliance is built for it: it signs a BAA on every plan, credits admissions calls, forms and booked assessments to the ad click, and sends them server-side to Google, Meta and Microsoft under neutral names, with no substance, diagnosis or insurance details.

Which events should a rehab send to Google, Meta and Microsoft?

Neutral ones: an admissions inquiry, a call, a booked assessment and an admission, each under a neutral name with a fixed list of fields and no substance, diagnosis or insurance details. Which events your program sends at all is your team's decision under Part 2; see Curve Compliance for addiction treatment centers.

Can a rehab see which campaigns produce admissions?

Yes. Campaign Reporting in Curve Compliance puts Meta and Google Ads spend next to the calls, assessments and admissions Curve tracked, for each campaign, with five attribution models. Admissions come in from your CRM or EHR through incoming webhooks, Keragon or an offline upload.

Does LegitScript certification require HIPAA compliance?

For US applicants that handle PHI, yes: LegitScript says “US-based applicants who collect, store, or transmit Protected Health Information (PHI) must be in compliance with all applicable HIPAA requirements” (LegitScript). Certification comes from LegitScript and permission to advertise from Google and Meta; tracking decides what each platform learns after the click.

Can admissions calls be credited to ads?

Yes. CallRail sends each call to Curve by secure webhook, and Curve forwards the conversion server-side under a neutral name, credited to the ads, campaigns and keywords that drove it. See Curve Compliance and CallRail.

What should a rehab ask a tracking vendor on a demo?

Whether it signs a BAA on the plan you would buy, how conversions reach Google, Meta and Microsoft, what stops a substance, diagnosis or insurer reaching an ad platform, and what happens to crisis submissions. Curve Compliance answers each in the table above: a BAA on every plan, server-side delivery, a fixed field list with PHI-like pattern checks, and no conversion for crisis submissions from Curve Forms.

How long does setup take for an addiction treatment center?

Curve's team does the setup, typically live in about a week, including call tracking, your forms and scheduler, and the event mapping for Google, Meta and Microsoft.

Talk to Curve Compliance

Book a call. Want admissions calls and assessments counted without sending substance or insurance details to Google, Meta or Microsoft? Curve's team will check what your site sends today and set up server-side tracking under the BAA Curve signs on every plan. Book a call with Curve.