Google Ads Affinity "Health & Fitness Buffs": Healthcare Patient Acquisition

Google's "Health & Fitness Buffs" affinity segment groups users who consistently consume fitness blogs, workout videos, sports news, and health-related apps, making it one of the broadest top-of-funnel audiences available to healthcare marketers on Google Ads. The opportunity is real (wellness-adjacent practices, cash-pay clinics, weight management programs, and physical therapy groups all see this segment as a natural fit), but so is the regulatory risk. Google does not sign a BAA for Google Ads, and OCR has been actively investigating tracking technologies that pass PHI to ad platforms.^[1]

This guide explains how to use the health fitness buffs affinity audience for patient acquisition without violating HIPAA: what the segment actually targets, where PHI leaks happen, and the exact configuration steps for a compliant Google Ads stack.

Platform Overview for Healthcare

Why the Health Fitness Buffs Affinity Audience Matters for Patient Acquisition

Affinity segments help advertisers reach users based on what they're passionate about and their habits and interests, with the explicit goal of raising awareness and driving consideration among people who have a strong interest in a category.^[2] Google builds these segments by classifying users based on demonstrated long-term interests, drawing on signals from activity on Google products and on third-party websites and apps.^[3]

For healthcare advertisers, this matters because the segment captures the right identity for many wellness-adjacent service lines:

Sports medicine and orthopedics: active adults likely to need joint care, ACL rehab, or imaging
Physical therapy and chiropractic: recurring injury prevention and recovery audiences
Weight management and metabolic health: users primed for nutrition and body-composition messaging
Concierge and direct-pay primary care: health-engaged consumers willing to pay out of pocket
Med spa, IV therapy, and aesthetic wellness: lifestyle-aligned cash-pay services

Affinity targeting works best when offer, creative, and landing page all align with the segment's identity, which is why the health fitness buffs affinity audience outperforms broad demographic targeting for these service lines.

Google's Healthcare Advertising Policies

Google's Personalized Advertising policy classifies "Health" as a sensitive interest category that includes physical and mental health conditions, products and procedures used to treat or manage chronic conditions, health issues associated with intimate body parts or functions, and invasive medical procedures including cosmetic surgery.^[4] Advertisers promoting products and services that fall within sensitive interest categories cannot use advertiser-curated audiences (remarketing, Customer Match, similar segments), but because predefined Google audiences are expressly configured without sensitive user signals, all advertisers are allowed to use them, even when promoting sensitive interest categories.^[5] That is the policy reason affinity targeting like "Health & Fitness Buffs" remains available to healthcare advertisers when remarketing is not.

Google's May 2025 policy update clarified that Health sensitive interest restrictions do not apply to content directed at healthcare professionals in their professional capacity, but the underlying prohibition on targeting consumers based on sensitive health conditions did not change.^[6]

Key Terminology

Affinity segment: a predefined Google audience based on long-term interests, habits, and lifestyles
Custom segment: an advertiser-defined audience built from keywords, URLs, or apps
In-market segment: users actively researching a purchase right now (different from affinity, which reflects identity over time)
Your data segments: Google's current term for what was previously called remarketing^[7]
Targeting vs. Observation mode: Targeting narrows who can see ads to the selected segment; Observation keeps reach unchanged and just reports performance for the segment
Enhanced Conversions / Offline Conversions: Google's first-party data ingestion methods, both of which can transmit hashed PII unless filtered

HIPAA Compliance Deep Dive

How Data Flows from a Healthcare Site to Google Ads

A standard Google Ads setup uses the global site tag (gtag.js), Google Tag Manager, or the Google Ads conversion linker to collect events client-side. Those events pass through the user's browser, which means URL paths, page titles, query parameters, form-field values, IP addresses, GCLIDs, and cookie identifiers can be transmitted to Google whenever a user converts.

Server-side options (the Google Ads API for Conversion Import, server-side Google Tag Manager, and Enhanced Conversions for Leads) route events through the advertiser's infrastructure first, giving you the ability to filter or hash data before it leaves your server. The advertiser, not Google, bears the responsibility for what data crosses that boundary.

Where PHI Exposure Happens

OCR's guidance on online tracking technologies states that information collected by tracking technologies on user-authenticated pages (and on unauthenticated pages where a user's interaction reveals their health condition or care) generally constitutes PHI when combined with identifying data.^[1] A federal court in American Hospital Association v. Becerra later vacated the portion of that guidance treating an IP address combined with a visit to an unauthenticated public webpage as automatically PHI, but the rest of the bulletin (including its treatment of authenticated pages and appointment flows) remains in effect.^[8]

The most common PHI exposure points in a Google Ads setup:

URL parameters: condition names, provider IDs, appointment types, or referral codes appended to thank-you pages
Page titles: "Booking Confirmation - Diabetes Consultation" sent as a conversion event name
Form-field auto-collection: Enhanced Conversions configured to grab email, phone, and name fields from intake forms
GCLID + offline conversion uploads: matching a click ID to a patient record without scrubbing PHI fields
Customer Match lists: uploading patient email lists, which discloses the underlying health relationship
Remarketing tags: dropping a cookie on a condition-specific page

Compliant vs. Non-Compliant Google Ads Features

Standard gtag.js conversion pixel on patient pages: Not compliant. Transmits URL, IP, and identifiers directly to Google with no BAA.
Server-side Conversion API / Google Ads API uploads with PHI filtering: Can be compliant when an intermediary strips PHI before transmission.
Customer Match (uploading patient email lists): Generally not compliant. Google's Customer Match policy explicitly prohibits using sensitive interest categories to target ads or to promote products and services, and bars using Customer Match data to identify sensitive interest categories related to customers.^[9]
Remarketing / retargeting based on condition pages: Not compliant. Sensitive interest categories cannot be used for personalized targeting, and the underlying tracking discloses PHI.^[5]
Similar/Lookalike segments seeded from patient data: Not compliant. The seed disclosure exposes the underlying patient relationship.
Affinity targeting (including "Health & Fitness Buffs"): Compliant when used in Targeting or Observation mode without uploading PHI. Predefined Google audiences are configured without sensitive user signals, so Google assigns users to the segment; the advertiser does not disclose patient information.^[5]
Geographic and demographic layers: Compliant when kept broader than ZIP+4 and not combined with health-condition signals.

Step-by-Step Compliant Setup for the Health Fitness Buffs Affinity Audience

Pre-Implementation Audit

Inventory every tag and pixel currently firing on your site. Map each one to the page types it fires on (homepage, condition pages, intake forms, thank-you pages, patient portal).
Document data flows from form submission through CRM through ad platform. Note any field that could constitute PHI.
Pull a sample of recent conversion events from Google Ads. Look at the "conversion source URL" column for condition keywords, appointment types, or patient identifiers.
Review vendor agreements. Confirm none of your ad-tech vendors are receiving PHI without a signed BAA. Google does not sign a BAA for Google Ads, so any PHI reaching Google is, by definition, an impermissible disclosure under HIPAA.^[1]

Compliant Tracking Configuration

Remove or scope the standard gtag.js conversion pixel. At minimum, do not fire it on condition-specific pages, intake forms, symptom checkers, or appointment flows.
Implement server-side tracking through an intermediary that signs a BAA and strips PHI before forwarding events to the Google Ads API. The intermediary should hash or drop name, email, phone, IP, condition fields, appointment types, and any URL parameters that could reveal a health relationship.
Configure PHI-stripping rules for: URL path tokens (e.g., /oncology/, /mental-health/), query parameters (?condition=, ?provider=), form fields, and page titles. Replace specific values with generic event names like lead_submitted or appointment_booked.
Set up compliant conversion events in Google Ads with event names that contain no condition language. Use Enhanced Conversions for Leads only if the upstream system hashes PII and your BAA-bound intermediary handles the transmission.

Campaign Structure for the Health Fitness Buffs Affinity Audience

Account-level setting: Turn off the "Include Google signals data" option in linked GA4 properties if you have not already; disable auto-tagging features that append GCLID to authenticated patient URLs.
Campaign type: Use Display, Demand Gen, or YouTube campaigns for affinity targeting. Affinity audiences are useful to advertisers looking to raise awareness and drive consideration, and Google supports them across Search, Display, Standard Shopping, Video, Gmail, and Display & Video 360.^[7]
Audience configuration: Add "Health & Fitness Buffs" through the Audiences module by clicking Edit audience segments at the campaign level and selecting the segment under lifestyle and hobbies.^[2] Layer with broad geography (DMA or city, not ZIP+4) and adult age brackets.
Exclude personalized re-engagement. Do not layer remarketing lists, Customer Match, or "similar to" segments seeded from your own visitors.
Creative compliance: Use general wellness messaging. Avoid asserting personal health attributes about the viewer in ad copy.

Verification and Testing

Use the Google Tag Assistant and Network tab to inspect every outbound request after a test conversion. Confirm no URL parameter, page title, or payload field contains PHI.
Run a test conversion through your full funnel weekly. Compare what your CRM records with what Google receives.
Document the audit trail. OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies, focusing on whether regulated entities have identified, assessed, and mitigated risks to ePHI.^[1] Keep written risk assessments and tag-management change logs.
Schedule quarterly tag audits. Marketing teams add pixels without engineering review more often than they should; quarterly reviews catch silent regressions.

For verticals where this matters most, see our deeper walkthroughs on physical therapy in-market audience targeting and urgent care same-day patient acquisition through paid search.

Campaign Strategies That Convert

Ad Formats That Work With Affinity Targeting

Because affinity audiences capture lifestyle identity rather than active purchase intent, they perform best in formats that build awareness and consideration: YouTube in-stream and bumper ads, Demand Gen image and video campaigns, and Display responsive ads on the Google Display Network.^[3] Search campaigns can use the health fitness buffs affinity audience in Observation mode to gather performance data without restricting reach.

Creative should speak to the identity the segment captures (active adults who train consistently, follow nutrition content, and prioritize recovery), not to a specific medical condition. Real workout scenarios outperform clinical or studio imagery for this audience.

Targeting Without PHI

Use the affinity segment as your interest signal. "Health & Fitness Buffs" is a predefined Google audience built without sensitive user signals, making it broad enough to function without any layered patient data.
Layer geographic targeting at the city or DMA level. Use radius targeting around clinic locations, not ZIP+4.
Layer demographic ranges (age brackets, parental status if relevant). Avoid combining demographic layers with sensitive health categories.
Avoid health-condition custom segments. Google notes that Custom Segment audiences using sensitive creative assets or pointing to sensitive landing pages have limited eligibility to serve, and most campaign types using sensitive Custom Segments will not be eligible at all.^[5]
Skip Customer Match for patient lists. Use only general newsletter lists with explicit marketing authorization, and even then, scrutinize whether the list signals a health relationship.

Conversion Tracking Done Right

Track macro conversions only: appointment booked, lead submitted, call initiated. Do not track condition-specific micro-conversions.
Use generic event names. lead_form_submit works; oncology_consult_booked does not.
Assign conversion values based on average patient lifetime value at the practice or service-line level, not per-condition.
Attribution: Data-driven attribution is acceptable; just verify the underlying click and conversion data feeding it has been scrubbed of PHI at the server-side layer.

Common Mistakes to Avoid

Firing the standard conversion pixel on thank-you pages with descriptive URLs. A confirmation URL like /thank-you?service=fertility-consult transmits the service category to Google with the user's IP and GCLID. This is the single most common PHI leak in healthcare Google Ads accounts.

Uploading patient lists to Customer Match. Even hashed, the upload itself signals that everyone on the list has a relationship with a healthcare provider. Google's Customer Match policy bars using sensitive interest categories to target ads, and without a BAA (which Google does not offer for Google Ads), the disclosure is impermissible under HIPAA.^[9]

Building similar/lookalike segments from converters. The seed audience is the disclosure, and lookalikes built from PHI inherit the same compliance problem.

Enhanced Conversions for Leads without PHI filtering. Enhanced Conversions is designed to scoop up email, phone, and name fields from your forms and pass hashed versions to Google. Without a BAA-bound intermediary stripping fields that reveal a health relationship, this expands PHI exposure rather than reducing it.

Tracking call conversions through Google's forwarding numbers on condition-specific landing pages. The forwarding number, call duration, and caller ID combination, tied to a page about a specific condition, can constitute PHI.

Assuming the Texas court ruling means tracking is now safe. The AHA v. Becerra decision vacated only the "IP + unauthenticated public webpage" portion of the OCR bulletin. Authenticated pages, appointment scheduling flows, symptom checkers, and patient portals remain squarely in scope, and HHS has indicated it is evaluating next steps.^[8]

Penalties scale quickly. HIPAA civil monetary penalties are tiered by culpability and adjusted annually for inflation, with per-violation amounts rising to substantial annual caps for the most serious tiers.^[10] A single misconfigured pixel firing across thousands of patient sessions can compound rapidly.

For service lines that have lost ad-platform options entirely (fertility, GLP-1 weight loss), Google Ads with compliant affinity targeting becomes even more central; see our breakdowns of fertility clinic alternative platforms after the TikTok IVF ban and weight loss clinic alternatives after the GLP-1 ad ban.

Self-Audit Checklist

No standard gtag.js conversion pixel firing on condition pages, intake forms, or appointment confirmations
Server-side tracking in place through a vendor that has signed a BAA
PHI stripping rules cover URL paths, query parameters, page titles, form fields, and IP handling
Conversion event names are generic and contain no condition or service-line language
No Customer Match uploads from patient lists; no remarketing on condition pages
Affinity targeting uses the health fitness buffs affinity audience without lookalike layers seeded from patient data
Quarterly tag audits documented in writing
Written risk assessment covering each ad-tech vendor in the stack

Frequently Asked Questions

Is Google Ads HIPAA compliant for healthcare advertisers?

Google Ads is not HIPAA compliant out of the box because Google does not sign a business associate agreement for the Google Ads product. Google's BAAs cover certain Google Cloud and Google Workspace services, not Google Ads. Covered entities can still use Google Ads, but the burden falls entirely on the advertiser to ensure no PHI reaches Google's servers, typically through server-side tracking with a BAA-bound intermediary, scrubbed URLs, and avoidance of personalized targeting features like remarketing and Customer Match.^[1]

How do I set up compliant Google Ads conversion tracking?

Replace client-side conversion pixels on patient-facing pages with server-side conversion uploads through the Google Ads API. Use an intermediary that signs a BAA and strips PHI (names, emails, phone numbers, IP addresses, condition-specific URL parameters, and any field that would reveal a health relationship) before forwarding the event. Use generic conversion names like lead_submitted rather than condition-specific labels, and verify outbound payloads weekly with browser developer tools.

Can healthcare practices use Google remarketing or the health fitness buffs affinity audience for remarketing?

Remarketing is generally not compliant for healthcare advertisers promoting medical services because Google's Personalized Advertising policy prohibits using sensitive interest categories (including Health) with advertiser-curated audiences like remarketing, Customer Match, and similar segments.^[5] The health fitness buffs affinity audience itself is a predefined Google audience that Google builds from its own user signals, not a remarketing list, so using it as a targeting layer does not require disclosing any patient data and is treated differently from remarketing.

What are the penalties for HIPAA violations from Google Ads misconfiguration?

HIPAA civil monetary penalties are tiered by culpability, with per-violation amounts and annual caps adjusted for inflation each year, scaling to substantial totals for the most serious violation tiers.^[10] OCR continues to actively investigate tracking technology disclosures, and state attorneys general can also pursue penalties under state privacy laws.

Does the 2024 court ruling mean Google Ads tracking is now safe for hospitals?

No. The Northern District of Texas vacated only the portion of OCR's bulletin that treated an IP address combined with a visit to an unauthenticated public webpage as automatically PHI.^[8] The rest of OCR's guidance (covering authenticated pages, appointment booking, symptom checkers, mobile apps, and explicit identifiers) remains in effect.^[1]

Simplify Google Ads Compliance with Curve

Stop worrying about PHI exposure in your affinity campaigns. Curve's no-code server-side tracking automatically strips PHI before events reach Google Ads, includes a signed BAA, and saves teams 20+ hours versus manual server-side GTM builds. See how Curve automates compliant Google Ads tracking.

Sources

Google Ads Affinity "Health & Fitness Buffs": Healthcare Patient Acquisition

Stay Compliant. Scale Confidently.