On this page
Event tracking records specific actions on a website, such as a page view, a click, a form submission or a booked appointment, so you can measure what visitors do. On a healthcare site, track the action but not the health detail: give each event a neutral name and send each platform only the fields it needs. Curve Compliance, which tracks clinic conversions server-side under a BAA it signs on every plan, checked Google's, Meta's and HHS's own pages for this guide on November 2, 2026.
Book a call. Want form submits, calls and bookings tracked without health details in the events? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What event tracking is
Google Analytics defines it plainly: “An event allows you to measure a specific interaction or occurrence on your website or app.” Its examples are when someone “loads a page, clicks a link, or completes a purchase” (Google). Each event has a name, and it can carry parameters: extra details about what happened, such as which form or which link. The tag, pixel or script on the page is what records the event and sends it somewhere.
HHS describes the same tools from the privacy side: “Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts” (HHS). So every event you track comes with two questions. What does it measure, and who receives it?
Events, pageviews and conversions
These terms overlap, and the differences matter when you decide what to send to an ad platform.
| Term | What it means | Clinic example | Source |
|---|---|---|---|
| Event | Any interaction or occurrence you choose to measure | A click on the phone number | Google, About events |
| Page view | Google Analytics sends page_view “each time the page loads or the browser history state is changed by the active site” | A visit to the contact page | Google, Enhanced measurement |
| Key event (conversion) | Google calls a key event “an event that measures an action that's particularly important to the success of your business” | A submitted consultation request | Google, About events |
| Parameter | A detail sent with an event. Google's form_submit event can carry form_id, form_name, form_destination and form_submit_text | Which form was sent | Google, Enhanced measurement |
| Offline outcome | Something that happens after the visit. Importing it lets you “measure what happens in the offline world after your ad results in a click or call to your business” | A visit booked by phone, or a patient who attended | Google, Offline conversion imports |
Google sorts events into automatically collected, enhanced measurement, recommended and custom events, and it says to create custom events only “when no other events work for your use case” (Google). Ad platforms work the same way: an event becomes a conversion when you tell the platform to count it.
The events a clinic site should track
Track the steps that lead to a patient, not every click. Give each step two names: a descriptive label you keep in your own tracking plan, and a neutral name for ad platforms. Curve's tracking plan uses “a neutral alias such as event_1 for every ad platform.” A short list is easier to keep clean:
| Step | Label you keep | Name ad platforms see | Keep out of it |
|---|---|---|---|
| Form submitted | lead_submitted | event_1 | Answers, free text and the page title |
| Call link clicked | call_clicked | event_2 | A page address that names a treatment |
| Booking started | booking_started | event_3 | Service or provider names in the link |
| Booking completed | booking_completed | event_4 | Appointment type and visit reason |
| Lead qualified | lead_qualified | event_5 | CRM notes and pipeline names that describe care |
| First visit attended | visit_attended | event_6 | Anything from the clinical record |
Google's lead generation events follow the same funnel. Its generate_lead event fires when a user “submits a form online or submits information offline,” and qualify_lead fires when a lead “is marked as fitting the criteria to become a qualified lead” (Google). For the later steps, see how CRM lifecycle stages become conversions, and for form events in detail, see form tracking without PHI.
Naming events without health details
Meta's Business Tools Terms cover this directly. Advertisers agree not to share data that “includes or is based on, directly or otherwise, health information,” and the terms add: “The names you choose and criteria you establish for your events, conversions, and any custom audiences you create must not reflect, imply or be based on any category of information described in this Section 1.h.” (Meta).
An event called weight_loss_consult_booked tells the platform what the visitor wants treated. An event called event_4 tells it nothing, and the meaning stays in your own plan. Parameters need the same care. Google warns that “PII is often inadvertently sent in these URLs and titles” and says to “remove PII from user-entered information before it is sent to Analytics” (Google).
HHS lists what a tracking tool can pick up on a regulated entity's site: “an individual's medical record number, home or email address, or dates of appointments, as well as an individual's IP address or geographic location, device IDs, or any unique identifying code.” It says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). The same HHS page notes that a federal court vacated part of the bulletin on June 20, 2024: the part about connecting an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers. Which rules apply to your pages depends on your setup, so talk to your counsel.
For field-by-field rules, see UTM parameters and PHI and how to structure a privacy-safe data layer.
Event tracking in GA4 and Google Tag Manager
In Google Tag Manager, “a trigger listens to your web page or mobile app for certain types of events like form submissions, button clicks, or page views,” and “Every tag must have at least one trigger in order to fire” (Google). In Google Analytics, enhanced measurement collects events such as scrolls, outbound clicks and form interactions, and Google says “No code changes are required.” It adds: “You're required to ensure that no personally identifiable information is collected” (Google).
On a health site there is a bigger question first. Google says it “does not offer Business Associate Agreements” for Google Analytics, and that HIPAA-regulated customers “may only use Google Analytics on pages that are not HIPAA-covered” (Google). See Google Analytics vs Google Tag Manager for where each tool sits, and Google Tag Assistant to see which Google tags fire on your pages today.
Sending events to ad platforms server-side
Server-side tracking sends the event from a server instead of the visitor's browser. That gives you one place to decide which fields leave and to drop the rest. It does not change what the platform's rules allow: Meta's Business Tools Terms list “Meta Pixel, Conversions API” among the tools they cover (Meta). HHS adds that “it is insufficient for a tracking technology vendor to agree to remove PHI from the information it receives or de-identify the PHI before the vendor saves the information” (HHS). The removal has to happen before the data reaches a vendor that won't sign a BAA. See why server-side tracking alone is not HIPAA compliance.
Bookings made in a scheduler on another site need one more step: the click that started the visit has to travel with the patient. See booked appointment attribution and what a click ID is, or book a call and Curve's team will map your events with you.
Event tracking checklist
- List the steps that matter. Form submitted, call clicked, booking started, booking completed, qualified and attended.
- Give each one two names. A descriptive label you keep, and a neutral name such as event_1 for ad platforms.
- Strip the parameters. No form answers, free text, page titles or URLs that name a condition.
- Check every page type. Condition pages, forms, thank-you pages, booking pages and anything behind a login.
- Confirm the BAA. Any vendor that receives PHI needs to sign one. See the BAA Directory.
- Bring outcomes back. Bookings, attended visits and CRM stages, each credited to the original ad click. To weigh them, see conversion values.
- Keep a record. A log of what was sent to each platform and what it accepted.
- Scan first. Curve's free website scan lists the pixels and trackers on a page.
How Curve Compliance helps
Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted. Curve keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers, takes outcomes from CRMs and call tracking through incoming webhooks, and credits each to the original ad click. Curve is SOC 2 Type II, signs a BAA on every plan and does the setup for you, typically live in about a week.
Sources, checked November 2, 2026: Google Analytics Help, About events; Google Analytics Help, Recommended events; Google Analytics Help, Enhanced measurement events; Google Analytics Help, Best practices to avoid sending PII; Google Analytics Help, HIPAA and Google Analytics; Tag Manager Help, About triggers; Google Ads Help, About offline conversion imports; Meta Business Tools Terms; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is event tracking?
Event tracking records specific actions on a website, such as a page view, a click, a form submission or a booked appointment, so you can measure what visitors do. On a healthcare site, track the action with a neutral name and keep health details out of it.
What is an example of event tracking?
Google's own example is a news site tracking events like article_read, video_play and newsletter_signup (Google). On a clinic site, the useful events are a form submitted, a call link clicked, a booking started and a booking completed.
What is the difference between an event and a conversion?
Every conversion is an event, but only the events that matter most to the business are counted as conversions. Google calls these key events: “an event that measures an action that's particularly important to the success of your business” (Google).
Can an event name reveal a patient's condition?
Yes. A name like weight_loss_consult_booked says what the visitor wants treated, and Meta's Business Tools Terms say event names “must not reflect, imply or be based on” health information (Meta). Use a neutral name such as event_1 for ad platforms and keep the meaning in your own plan.
Should form answers be sent as event parameters?
No. Form answers can describe a condition or identify a person, and Google says to “remove PII from user-entered information before it is sent to Analytics” (Google). Send the fact that the form was submitted, not what it said.
How do I track bookings made on another site?
The booking tool has to report the booking back, and the original ad click has to travel with the patient. Curve Compliance keeps ad attribution when a patient leaves to book in IntakeQ, Calendly, Acuity, Jane App and other schedulers, and bookings made days later still match (how it works).
Is Google Analytics event tracking HIPAA compliant?
Google says it does not offer a BAA for Google Analytics and that HIPAA-regulated customers “may only use Google Analytics on pages that are not HIPAA-covered” (Google; Directory entry). Google adds that authenticated pages are likely to be HIPAA-covered, so keep its tags off anything behind a login.
Talk to Curve Compliance
Book a call. Want event tracking that keeps health details out? Curve Compliance sends neutral, server-side conversions to your ad platforms, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.