Can a Telehealth Company Legally Use Google Analytics?

Yes, if Google Analytics runs only where it cannot send Google your visitors' health information. Google offers no business associate agreement (BAA) for Google Analytics, lets HIPAA-covered customers use it only "on pages that are not HIPAA-covered," and says no data collected with it "may reveal any sensitive information about a user, or identify them" (Google Analytics Help). A cash-pay company outside HIPAA still answers to the FTC and state health data laws. Curve Compliance gives telehealth companies web analytics and server-side ad conversion tracking under a BAA it signs on every plan, so booking pages can be measured and conversions reach Meta, Google Ads and TikTok with PHI stripped before data reaches an ad platform.

Book a call. Curve's team will review what your telehealth site sends to Google, Meta and TikTok with you. Book a call with Curve.

What Google says about Google Analytics and HIPAA

Google's HIPAA and Google Analytics page is direct: "Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." It adds: "Authenticated pages are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages." Curve keeps Google's BAA statement in its BAA Directory entry for Google Analytics 4.

Some rules bind every Google Analytics customer. Section 7 of the Google Analytics Terms of Service says you will not "pass information, hashed or otherwise, to Google that Google could use or recognize as personally identifiable information," except where a feature's terms allow hashed data. Google's PII guide adds that "Both the URL path and parameters must be free of PII." On a telehealth site, check intake URLs, page titles and site search terms first.

Step one: is your company covered by HIPAA?

A covered entity includes "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter," such as an insurance claim (45 CFR 160.103). A brand that runs intake for an affiliated medical group that bills insurance can be a business associate, because it handles protected health information (PHI) for a covered entity. A cash-pay company that sends no standard transactions may sit outside HIPAA, which changes which rules apply, not whether rules apply. See does HIPAA apply to cash-pay telehealth.

If HIPAA applies: the HHS bulletin and AHA v. Becerra

The HHS tracking bulletin names "a patient or health plan beneficiary portal or a telehealth platform" as user-authenticated webpages and says tracking technologies on those pages "generally have access to PHI." Public pages where people book appointments or enter symptoms may carry PHI too. The rule: "Regulated entities must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI." Cookie banners "do not constitute a valid HIPAA authorization" (see is a cookie banner enough for HIPAA).

On June 20, 2024, in American Hospital Association v. Becerra (N.D. Tex., No. 4:23-cv-01110), the court vacated one piece of the bulletin, the "Proscribed Combination": that HIPAA applies when a tracking tool connects a person's IP address with a visit to an unauthenticated public page about specific health conditions or providers. The vacatur "is not intended to, and should not be construed as, limiting the legal operability of other guidance in the germane HHS document." HHS appealed on August 19, 2024, and the appeal was dismissed on the government's motion on September 4, 2024 (docket). The bulletin still says "HHS is evaluating its next steps in light of that order."

So for a HIPAA-covered telehealth company, logged-in pages and booking or symptom pages sit in parts of the bulletin the court left in place, and Google says to keep its tags off HIPAA-covered pages. See the bulletin, annotated, are IP addresses PHI and what counts as PHI on a website.

If HIPAA does not apply: the FTC still does

Section 5 of the FTC Act makes "unfair or deceptive acts or practices in or affecting commerce" unlawful (15 U.S.C. 45). On July 20, 2023, the FTC and HHS sent a joint letter to approximately 130 hospital systems and telehealth providers about tools "such as the Meta/Facebook pixel and Google Analytics." The FTC's release says: "Companies not covered by HIPAA still have a responsibility to protect against the unauthorized disclosure of personal health information." Such a disclosure "may violate the FTC Act and could constitute a breach of security under the FTC's Health Breach Notification Rule." On Meta, see is the Meta pixel a HIPAA violation.

That rule, 16 CFR Part 318, covers vendors of personal health records and related entities, and "does not apply to HIPAA-covered entities" or to business associates acting as such (318.1). A personal health record is an electronic record of a person's health information that can draw from multiple sources and is managed by or for that person (318.2); the FTC alleged GoodRx's website and apps were one (complaint). A breach of security "includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure" (318.2). Violations are "subject to civil penalties" (318.7).

FTC cases where health data reached Google and other ad platforms

GoodRx, February 1, 2023. The FTC acted "for the first time under its Health Breach Notification Rule" against the "telehealth and prescription drug discount provider" (FTC release). The complaint says GoodRx "configured a Google tracking pixel on its website" to share medication names and related health conditions. GoodRx agreed to a $1.5 million civil penalty and a ban on sharing health data for advertising.

Monument, April 11, 2024. The FTC says the alcohol addiction treatment service disclosed health data "to third-party advertising platforms, including Meta and Google" through pixels and APIs, with event names such as "Paid: Weekly Therapy" (FTC release).

Hims & Hers, July 29, 2026. The FTC, joined by Utah and California, sued the telehealth provider, alleging it "shared consumers' health information with Meta, Snap and other third parties" (FTC release). The court will decide the case. See the Hims & Hers complaint explained and the mid-2026 pixel lawsuit roundup.

State consumer health data laws

Washington's My Health My Data Act, RCW 19.373, reaches businesses in Washington or targeting its consumers. It covers "Data that identifies a consumer seeking health care services" (19.373.010). Since March 31, 2024, a regulated entity may collect consumer health data only "With consent from the consumer for such collection for a specified purpose" or as needed for a service the consumer requested, and sharing needs consent "separate and distinct from the consent obtained to collect consumer health data" (19.373.030). PHI under HIPAA is exempt (19.373.100). Connecticut bars businesses there or targeting its residents from selling consumer health data "without first obtaining the consumer's consent" (Conn. Gen. Stat. 42-526). Since July 1, 2026, those businesses also need consent to process residents' sensitive data, including consumer health data (42-516 and 42-520). Both exempt HIPAA covered entities and business associates.

Which rules apply to your telehealth company

Your telehealth company	What applies	What it means for Google Analytics
Sends insurance claims or other HIPAA transactions electronically (a covered entity)	HIPAA (45 CFR 160.103); the HHS bulletin, minus the part vacated in AHA v. Becerra; Google's HIPAA page	Only on pages that are not HIPAA-covered. Keep it off logged-in, booking and intake pages.
Handles PHI for a covered entity (a business associate)	HIPAA for that PHI (45 CFR 160.103); the HHS bulletin	The same limits on pages that carry that PHI.
Cash-pay only, outside HIPAA	FTC Act section 5 (15 U.S.C. 45); the Health Breach Notification Rule if you offer or maintain a personal health record	Usable on pages and events that carry no health information. See GoodRx and Monument.
Serves Washington consumers	RCW 19.373 for consumer health data that is not PHI	Consent before collecting, and separate consent before sharing, consumer health data.
Any Google Analytics customer	Terms of Service, section 7; Google's PII guide	No personally identifiable information, hashed or otherwise, unless a feature's terms allow hashed data.

This table is a summary, not legal advice. Talk to your counsel about which row fits your company.

How Curve helps

Curve Compliance measures the pages Google Analytics should stay off, under the BAA Curve signs on every plan. Curve's web analytics reports sources, channels, goals, funnels and attribution under four models on every page, including booking pages. Before a page address leaves the browser, the Curve script redacts the parts that look like contact, health, search or quiz data, and Curve's consent management holds analytics for each visitor's choice where opt-in is required.

For ads, Curve replaces browser pixels with one script and sends conversions server-side to Meta, Google Ads and TikTok. Each platform receives only a fixed list of fields, contact identifiers are off by default for Meta, Google Ads and TikTok, and Curve strips PHI before data reaches an ad platform. Completed visits are credited to the original ad click (Curve for telehealth). Curve is SOC 2 Type II, and Curve's team does the setup; most customers are live in about a week. The free website scan lists every pixel and tracker on a page.

Sources, checked October 16, 2026: Google, HIPAA and Google Analytics, avoiding PII and Terms of Service; HHS tracking bulletin; AHA v. Becerra opinion and docket; 45 CFR 160.103; 15 U.S.C. 45; 16 CFR Part 318; FTC on the joint letter, GoodRx (complaint), Monument and Hims & Hers; RCW 19.373; Conn. Gen. Stat. 42-526, 2026 Supplement.

Frequently Asked Questions

Can a telehealth company legally use Google Analytics on its website?

Yes, if Google Analytics runs only where it cannot send Google health information: Google offers no BAA for it and limits HIPAA-covered customers to pages "that are not HIPAA-covered" (Google Analytics Help). Curve Compliance web analytics measures the rest under a BAA on every plan.

Does Google sign a BAA for Google Analytics?

No. Google says it "does not offer Business Associate Agreements in connection with this service" (Google Analytics Help).

Is Google Analytics HIPAA compliant for telehealth?

Google "makes no representations that Google Analytics satisfies HIPAA requirements" (Google Analytics Help). See GA4 is not HIPAA compliant.

Does HIPAA apply if my telehealth company is cash-pay only?

Not always. A provider is a covered entity only if it sends health information electronically in a HIPAA standard transaction (45 CFR 160.103), and a company can also fall under HIPAA as a business associate. The FTC Act and state laws apply either way.

Did the AHA v. Becerra ruling end the HHS tracking rules?

No. On June 20, 2024, the court vacated only the IP address and public page piece, and said the vacatur does not limit "other guidance in the germane HHS document" (opinion).

Has the FTC acted against a company for sending health data to Google?

Yes. The FTC says GoodRx shared health information with Facebook, Google and others (February 1, 2023), and Monument with platforms "including Meta and Google" (April 11, 2024).

Does Washington's My Health My Data Act apply to website analytics?

It can, for Washington consumers. It requires consent before collecting or sharing consumer health data, with separate consent for sharing (RCW 19.373).

Talk to Curve Compliance

Book a call. Curve's team will review what your site sends to Google, Meta and TikTok, then set up web analytics and server-side conversions under a BAA on every plan. Most customers are live in about a week. Book a call with Curve.