Google Ads "Health Services" In-Market Audience: HIPAA-Safe Targeting for 2026

Google's in-market audiences identify users actively researching products and services, and the "Health Services" segment captures people comparing providers, scheduling appointments, or evaluating treatment options. For healthcare advertisers, that signal is valuable, but using it carelessly can transform a routine campaign into a HIPAA enforcement matter. ^[1] OCR has continued to pursue tracking-related disclosures even as the agency's broader online-tracking guidance has been partially vacated in court, and 2026 inflation-adjusted penalty amounts took effect on January 28, 2026.

This guide explains how to use the health services in-market audience Google Ads segment for in-market healthcare targeting without exposing PHI, what changed under Google's 2025–2026 policy updates, and how to architect compliant conversion tracking that still feeds Smart Bidding the signals it needs.

Platform Overview for Healthcare Advertisers

Why the Health Services In-Market Audience Matters for Google Ads

Google Search remains the dominant entry point for patients researching providers, symptoms, and treatment options. In-market audiences layered onto search and Performance Max campaigns let practices reach users showing active intent across Google's surfaces (Search, YouTube, Discover, Gmail, Display). ^[2] Google's policy specifically allows predefined Google audiences (such as in-market segments) to be used by advertisers in sensitive interest categories because those audiences are curated by Google "without sensitive user signals," in contrast to advertiser-curated audiences which cannot be used to promote sensitive categories. That distinction is why the Health Services segment is one of the few audience signals Google permits healthcare advertisers to use in a quasi-direct way.

Google's 2025–2026 Healthcare Advertising Policies

Google's Healthcare and Medicines policy governs what content can run, what certifications are required, and which audience signals can be applied. Some healthcare content cannot be advertised at all, while other categories require advertiser certification and run under an "Eligible (limited)" status restricted to approved locations. Online pharmacies, telemedicine providers, and addiction treatment services must obtain LegitScript certification before serving ads.

^[3] A May 2025 update to Google's Personalized Advertising policy clarified that the Health sensitive interest category excludes "content directed at healthcare professionals in their professional capacity," and the Restricted Drug Terms category was updated with a parallel exclusion. ^[4] Effective July 1, 2025, advertisers using personalized targeting tools to promote restricted-drug-term content to healthcare professionals must apply for the Restricted Drug Term Personalization Certification. These changes opened B2B HCP targeting pathways while leaving consumer health targeting tightly restricted.

Platform-Specific Terminology

• In-market audience: Google-defined segment of users showing active purchase intent in a category, including "Health Services."
• Personalized Advertising Policy: Google's rule set restricting use of sensitive interest categories for ad targeting.
• Predefined Google audiences: Audiences Google builds without sensitive user signals; usable even by advertisers in sensitive categories.
• Advertiser-curated audiences: Customer Match, remarketing, and Custom Segments; prohibited for sensitive-category promotion.
• Enhanced Conversions: A feature that hashes first-party data to improve attribution; can leak PHI if user identifiers are tied to health intent.
• Google Signals: Cross-device data setting in GA4 that should be disabled for healthcare properties.

HIPAA Compliance Deep Dive

How Data Flows Through Google Ads

A standard Google Ads implementation involves the gtag.js or Google Tag Manager client-side tag firing in the user's browser. That tag transmits page URLs, referrer data, click IDs (GCLID), IP address, device identifiers, and any custom parameters passed by the advertiser. When a user with cookies enabled converts on a page about a specific condition, treatment, or appointment booking, Google receives the combination of identifier plus health-intent context.

Server-side options exist: the Google Ads API supports offline conversion imports, and Enhanced Conversions for Leads can be implemented server-side. These approaches give advertisers a control point to strip PHI before transmission, but only if the advertiser actually builds that filter. By default, server-side tagging passes the same data.

Where PHI Exposure Actually Occurs

^[5] The HHS Office for Civil Rights bulletin on online tracking technologies remains in force for authenticated portals such as patient portals. ^[6] In June 2024, a federal district court in Texas vacated the portion of OCR's bulletin treating an IP address combined with a visit to an unauthenticated public webpage addressing health conditions or providers as PHI, ruling that HHS exceeded its statutory authority. ^[7] OCR subsequently dropped its appeal of that decision, but the ruling left intact OCR's position that tracking on authenticated webpages and other PHI combinations on unauthenticated pages remain subject to HIPAA.

Common PHI leak points in Google Ads tracking include:

• URL parameters: Booking flows that pass condition names, provider names, or symptom selections in the query string.
• Page titles: Conversion events that include the page title automatically capture phrases like "Schedule Oncology Consultation."
• Form field capture: Enhanced Conversions configured to hash email plus phone from intake forms tied to specific treatment pages.
• Authenticated-portal tracking: Any gtag firing inside a logged-in patient portal continues to fall squarely within the OCR bulletin's scope.
• GCLID propagation: Click IDs stored in CRM records and later sent back to Google with patient outcomes attached.

Compliant vs. Non-Compliant Google Ads Features for the Health Services In-Market Audience Google Ads Setup

• Standard gtag.js pixel on health pages: Not compliant by default. Captures PHI through URLs, page context, and user identifiers. Google does not sign a BAA covering Google Ads.
• Google Ads API / server-side conversion imports: Can be compliant with proper PHI filtering before transmission.
• Remarketing audiences built from health-page visits: Not compliant. Building an audience from condition or treatment pages is an advertiser-curated audience tied to sensitive interest signals, which Google's Personalized Advertising policy prohibits for sensitive-category promotion.
• Customer Match from patient lists: Not compliant. Uploading patient email lists constitutes a disclosure of PHI to a vendor without a BAA, and Customer Match is an advertiser-curated audience disallowed for sensitive-category use.
• In-market "Health Services" predefined audience layered onto search: Permissible under Google's policy because predefined Google audiences are configured without sensitive user signals, and HIPAA-compliant when the advertiser is not transmitting PHI through conversion events.
• Similar audiences / lookalikes from patient seed lists: Not compliant. The seed list itself is a PHI disclosure to a partner without a BAA.
• Google Analytics 4 with Google Signals enabled: Not compliant. Google will not sign a BAA for GA4.

Step-by-Step Compliant Setup for the Health Services Segment

Pre-Implementation Audit

1. Inventory every tag firing on appointment, condition, and intake pages using a tag auditor or browser dev tools.
2. Document the exact data each tag transmits, including default Enhanced Measurement parameters in GA4 and any custom dataLayer pushes.
3. Identify which pages would meet OCR's PHI test (authenticated portals, condition-specific landing pages tied to known health intent).
4. Confirm signed BAAs with every vendor in the data path. Google Ads is not on that list, so it must never receive PHI.
5. Review URL structures and page titles for condition or treatment names that would be captured by default page_view events.

Compliant Tracking Configuration

1. Disable client-side conversion tags on PHI-adjacent pages. Remove gtag.js conversion firing from authenticated portal pages and from any unauthenticated page where conversion data combined with identifiers would meet the PHI test.
2. Route conversions through a HIPAA-compliant server-side layer. Server-side tagging provides a control point that lets you filter out PHI before it reaches Google's servers, and Google Signals should be disabled in any GA4 property on a healthcare site.
3. Configure PHI stripping rules. The intermediary should remove names, emails, phone numbers, condition names from URLs and page titles, and any custom parameters tied to clinical context before sending the event to the Google Ads API.
4. Use offline conversion imports for high-value events. Send a hashed click ID with a generic conversion label ("Lead" or "Booking") rather than passing condition-specific event names.
5. Sign a BAA with your tracking intermediary. Curve provides signed BAAs and automates PHI stripping across both client-side and server-side data flows, removing 20+ hours of manual configuration per implementation.

Campaign Structure for the Health Services In-Market Audience Google Ads Layer

Apply the in-market healthcare targeting segment in "Observation" mode first on Search campaigns to confirm that bid adjustments are meaningful before switching to "Targeting." Keep ad groups organized around service categories rather than specific conditions. For multi-location practices, build separate campaigns by geographic area to maintain local relevance and avoid mixing patient cohorts in audience data.

Account-level settings to verify:

• Auto-tagging enabled (GCLID required for offline imports), but ensure GCLID is not stored alongside PHI in your CRM.
• Customer data terms reviewed; do not accept Call and Messaging Ads supplemental terms that involve recording or monitoring patient communications without explicit compliance review.
• Personalized advertising features audited at the account level for sensitive interest categories.
• Audience expansion turned off in Performance Max for healthcare accounts to prevent Google from inferring sensitive segments.

Verification and Testing

Run the Google Tag Assistant on every conversion path and review the network payloads sent to googleadservices.com and google-analytics.com. Confirm that no email addresses, phone numbers, condition keywords, or provider names appear in the request body or query parameters. Re-run this test quarterly because site updates, new landing pages, and CMS changes routinely reintroduce leaks. Document each audit with timestamped screenshots to support your Security Rule risk analysis.

Campaign Strategies That Convert

Ad Types That Work for Healthcare

Search campaigns remain the most reliable format for medical and mental health marketing because users are typing in service intent, and predefined audiences like Health Services can be layered as an observation or targeting signal without triggering the advertiser-curated-audience prohibitions in Google's Personalized Advertising policy. Performance Max and Demand Gen broaden signal collection and audience inference in ways that healthcare accounts should treat cautiously. Video campaigns work for local branding rather than direct response.

Targeting Without PHI Using the Health Services In-Market Audience Google Ads Segment

The Google Ads health services segment pairs well with:

• Geographic targeting at the ZIP, radius, or DMA level around your service area.
• Demographic targeting by age, gender, and parental status where clinically relevant (pediatricians targeting parents, for example).
• Broad interest segments like "Health and Wellness Enthusiasts" that do not imply specific conditions.
• Detailed search keywords that capture service intent without storing user-level health attributes.

Avoid building Custom Segments tied to specific diagnoses or treatment-page visitation. For deeper guidance on which segments leak PHI, see our breakdown of HIPAA-safe Google Ads audience segments and how to configure audience exclusions that prevent PHI targeting.

Conversion Tracking Done Right

Track generic event names: "Lead Submitted," "Appointment Requested," "Call Initiated." Avoid descriptive event labels that disclose service type. Send conversion values to feed Smart Bidding without exposing patient context. For phone leads, route calls through a HIPAA-compliant call tracking vendor that signs a BAA, and pass only the conversion signal (not the call content or transcription) to Google Ads.

Common Mistakes to Avoid

• Letting Enhanced Conversions auto-collect form fields. When configured client-side, Enhanced Conversions can scrape email and phone fields from intake forms on condition-specific pages, hashing them before transmission. Hashing does not satisfy HIPAA when the underlying identifier-plus-context combination is PHI.
• Uploading patient lists to Customer Match. A direct disclosure to Google without a BAA, and an advertiser-curated audience that Google's policy disallows for sensitive-category promotion.
• Building remarketing audiences from condition pages. Even if the audience never runs ads, the audience definition itself is a disclosure.
• Leaving GCLIDs in CRM exports. If GCLID rows are linked to diagnosis fields and later sent to any analytics tool, the linkage creates PHI.
• Relying on cookie consent banners. Consent banners address GDPR and CCPA but do not satisfy HIPAA's requirement for a BAA or a valid authorization under 164.508.
• Trusting Google's automated bidding to "figure it out." Performance Max and Demand Gen broaden signal collection in ways healthcare accounts cannot safely permit.

^[8] Under the inflation-adjusted HIPAA civil monetary penalty schedule effective January 28, 2026, the four culpability tiers carry minimums ranging from $145 (Tier 1) to $73,011 (Tier 4) per violation, a per-violation maximum of $2,190,294 in Tier 4, and an annual cap of $2,190,294 per identical provision; OCR continues to operate under its 2019 Notice of Enforcement Discretion, which applies lower effective annual caps in Tiers 1–3. State attorneys general can bring parallel actions, and class action plaintiffs have settled pixel-tracking cases for substantial sums separate from any OCR action.

For mental health and psychiatric practices, the stakes are even higher because the underlying conditions are categorically more sensitive. Our specialty guides for psychiatry Google Ads targeting and medication management campaigns walk through the additional safeguards required.

Self-Audit Checklist

• BAA inventory: Every vendor in the tracking path has a signed BAA, and Google Ads is not relied upon as a business associate.
• Tag review: No client-side conversion tag fires on authenticated portal pages or condition-specific intake pages.
• URL hygiene: Booking URLs do not include condition, treatment, or provider names as query parameters.
• Server-side filter: All Google Ads conversions pass through a PHI-stripping layer before reaching the API.
• Audience definitions: No remarketing list or Customer Match list is built from health-page visitors or patient records.
• GA4 settings: Google Signals disabled, IP anonymization confirmed, no health-context custom dimensions.
• Documentation: Quarterly audit logs stored for six years to support Security Rule risk analysis.

Frequently Asked Questions

Is Google Ads HIPAA compliant for healthcare advertising?

Google Ads is not HIPAA compliant by default. Google does not sign a BAA covering the Google Ads product, so the advertiser bears full responsibility for ensuring no PHI reaches Google's servers. Compliant use is possible when conversion events strip identifiers and health context before transmission, when advertiser-curated audiences (remarketing, Customer Match, custom segments) are not used for sensitive-category promotion, and when a HIPAA-compliant intermediary handles data flows.

How do I set up compliant Google Ads conversion tracking?

Replace client-side gtag conversion tags on PHI-adjacent pages with server-side conversion imports through the Google Ads API. The intermediary layer should strip names, emails, phone numbers, page titles, URL parameters, and any condition-specific context, then send generic event labels with the GCLID and a conversion value. Curve handles this configuration without code changes on the source site.

Can healthcare practices use Google Ads remarketing?

Most healthcare advertisers cannot use remarketing or build audiences based on visits to pages related to conditions, symptoms, or treatments. Google's Personalized Advertising policy prohibits advertiser-curated audiences (including remarketing lists) from being used to promote sensitive interest categories such as health, and the audience definition itself is a disclosure of health intent to Google, which has no BAA covering the data. Brand-level remarketing from non-clinical pages (homepage, about, careers) may be permissible, but requires a careful review of which URLs feed the audience.

What are the penalties for Google Ads HIPAA violations?

HIPAA civil monetary penalties scale across four culpability tiers. Under the inflation adjustment that took effect January 28, 2026, statutory amounts range from a minimum of $145 per violation (Tier 1) to a maximum of $2,190,294 per violation (Tier 4), with an annual cap of $2,190,294 per identical provision; OCR's 2019 Notice of Enforcement Discretion continues to apply lower effective annual caps in Tiers 1–3. Tracking-related disclosures of PHI through pixels, analytics, and chat tools have triggered OCR investigations, corrective action plans, and monetary settlements, with separate class action exposure on top.

Can I use the Health Services in-market audience for targeting?

Yes. The Health Services segment is a predefined Google audience, which Google's policy expressly allows even for advertisers promoting sensitive interest categories because the audience is built without sensitive user signals on Google's side. The compliance risk lies downstream in how conversions are tracked, not in applying the segment itself. Keep conversion tracking PHI-free and the segment is one of the safer audience tools available to healthcare advertisers.

Simplify Google Ads Compliance with Curve

Stop worrying about PHI exposure on every new landing page, every campaign update, and every audience refresh. See how Curve automates compliant Google Ads tracking with signed BAAs, no-code PHI stripping, and server-side conversion delivery through the Google Ads API.

Sources

1. HIPAA Journal: HHS Applies Inflation Increase to Penalties for HIPAA Violations
2. Google Ads Policy: Restricted Targeting in Personalized Advertising
3. Google Ads Policy: Update to the Personalized Advertising Policy (May 2025)
4. Google Ads Policy: Personalized Advertising (Restricted Drug Term Personalization Certification)
5. HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
6. American Hospital Association: Judge Rules in Favor of AHA Vacating HHS Online Tracking Bulletin
7. HIPAA Journal: OCR Drops Appeal in AHA Tracking Technology Case
8. Compliance Junction: HIPAA Penalty Tier Amounts (2026 Inflation Adjustment)