Google Ads In-Market for Mental Health Practices: HIPAA Targeting Without PHI

According to SAMHSA's 2024 National Survey on Drug Use and Health, ^[1]23.4% of U.S. adults (61.5 million people) had any mental illness in the past year, and only 52.1% of those adults received any mental health treatment. That treatment gap fuels intense competition on Google Ads, where in-market segments promise to deliver patients at the moment of highest intent. The problem: when therapy practices layer mental health in-market targeting onto pages, forms, or remarketing lists tied to clinical content, they routinely transmit protected health information to Google without a BAA. This guide explains how mental health in-market targeting actually works inside Google Ads, where the HIPAA failure points live, and exactly how to run a compliant therapy practice Google Ads audience strategy that fills your schedule without exposing PHI.

Platform Overview for Mental Health Advertisers

Why Google Ads Matters for Therapy Practices

Mental health is one of the largest and fastest-growing healthcare verticals on Google. ^[1]SAMHSA also found that 26.1% of adults (67.8 million people) perceived they ever had a mental health issue, which means search demand for therapy, psychiatry, and counseling far outstrips the supply of available clinicians. Practices that can show up for "therapist near me," "anxiety counseling," or "in-network psychiatrist" capture patients at the decision point.

In-market segments amplify that reach by identifying users Google has classified as actively researching a service. ^[2]Google's own developer documentation describes audience segments as groups of people with specific interests, intents, and demographic information, as estimated by Google. For mental health practices, the relevant segments sit inside the broader Health Services categories rather than diagnosis-specific buckets.

Healthcare Advertising Policies on Google Ads

Google maintains a Personalized Advertising policy that restricts sensitive health categories from being used to target consumers. Historically, Google's ad personalization rules have blocked sensitive health interest categories from being used for targeting. For patient-facing therapy ads, practices cannot use remarketing or Customer Match lists built on mental-health-condition pages, because Google does not sign Business Associate Agreements with healthcare advertisers and is not authorized to receive PHI.

Google's audience segments documentation reinforces that Google will not use sensitive information like health, race, religion, or sexual orientation to tailor ads to users. In practice this means certain mental-health-adjacent in-market segments exist (for example, general "Health Services") but Google will not let you target users based on a diagnosis.

Platform Terminology Mental Health Marketers Need

• Audience segments: the umbrella term Google now uses for custom, in-market, affinity, and first-party audiences
• In-market segments: users Google has flagged with recent purchase intent for a category
• Your data segments: the current name for remarketing lists, including website visitors and Customer Match
• Custom segments: advertiser-built audiences using keywords, URLs, or app activity
• Enhanced Conversions: a server-side mechanism that hashes first-party data before transmission
• Observation vs. Targeting: ^[3]per Google's Ads API documentation, setting bid_only to true enables Observation mode, allowing bidding adjustments without restricting traffic, while setting it to false enables Targeting mode, restricting traffic to targeted lists

HIPAA Compliance Deep Dive

How Data Flows from Your Therapy Website to Google

By default, a Google Ads conversion tag or GA4 tag sits client-side on your website. When a visitor loads a page like /anxiety-therapy or submits an intake form, the browser sends to Google: the URL, page title, referrer, cookies (including the Google Click ID), device fingerprint, IP address, and any URL parameters or form fields the tag is configured to capture. Server-side options, including the Google Ads API and Enhanced Conversions for Leads, can replace that browser transmission, but only if the data is sanitized before it leaves your infrastructure.

OCR has made clear what triggers HIPAA obligations. ^[4]While it has always been true that regulated entities may not impermissibly disclose PHI to tracking technology vendors, because of the proliferation of tracking technologies collecting sensitive information, OCR is providing this reminder that it is critical for regulated entities to ensure that they disclose PHI only as expressly permitted or required by the HIPAA Privacy Rule.

Where PHI Exposure Happens in Mental Health Campaigns

• URL paths: pages like /depression-treatment or /ocd-intake reveal a condition. When paired with an IP address or click ID, this can become PHI.
• Form fields: intake forms that ask "What brings you in today?" transmit clinical information if the form's submit event is mirrored to Google.
• Query parameters: appointment-booking URLs that pass ?service=ptsd-therapy or ?reason=bipolar leak diagnosis-level data.
• Audience list construction: building a "Your data" segment from visitors to /trauma-therapy is, by Google's own logic, a list of people likely receiving trauma care.
• IP addresses: the legal status has narrowed but not disappeared. ^[5]The Court vacated the guidance to the extent it provides that HIPAA obligations are triggered in "circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers". Despite these unknowns, the other portions of the OCR guidance remain in effect, and regulated entities should proceed with caution when using online tracking technologies.
• Authenticated pages and disease-specific apps: ^[6]for disease-specific mobile apps, the mere fact that an individual uses the app, when transmitted along with any identifying information about the individual (including IP address or device ID), is sufficient to constitute a disclosure of PHI.

Compliant vs. Non-Compliant Google Ads Features for Therapy Practices

• Standard Google Ads conversion tag (client-side): not compliant out of the box for therapy sites because it transmits URLs, click IDs, and IP addresses that can identify a patient seeking mental health care.
• Google Ads API / server-side Enhanced Conversions with PHI stripping: can be compliant when an intermediary de-identifies data before it reaches Google. ^[7]OCR added that if a vendor refuses to execute a BAA, the regulated entity may execute a BAA with an intermediary that deidentifies the information in accordance with 42 C.F.R. § 164.514 prior to such information being disclosed to the refusing vendor.
• In-market segments (general categories): compliant to target because Google builds them from its own behavioral data; you are not disclosing patient information to use them.
• Your data segments / remarketing built from condition pages: not compliant. The list itself is built from PHI.
• Customer Match from patient email lists: not compliant. Google will not sign a BAA with healthcare marketers, so any upload of a known-patient list is an impermissible disclosure.
• Lookalike (Demand Gen) segments seeded from patient data: requires careful, de-identified setup; seeding from a PHI-tainted list is non-compliant.

Step-by-Step Compliant Setup for Mental Health In-Market Targeting

Pre-Implementation Audit

1. Inventory every script firing on your therapy website: Google tag, GA4, Google Tag Manager containers, call-tracking pixels, chat widgets, scheduling embeds.
2. Map each URL pattern that reveals a condition (for example, /depression, /anxiety, /eating-disorder-treatment) and flag any tags running on those pages.
3. Document form fields, parameters, and thank-you-page URLs. If "intake_reason" or "therapy_type" appears anywhere in your tracking payload, that is a PHI exposure point.
4. Confirm BAA status with every vendor that touches form or analytics data. Google will not sign one; you need an intermediary that will.

Compliant Tracking Configuration

1. Remove or restrict the client-side Google tag from condition-specific URLs and intake confirmation pages.
2. Implement server-side tracking through a HIPAA-compliant intermediary that signs a BAA and de-identifies data before transmission. By preventing protected health information from reaching Google's servers, conversion identifiers can be safely sent. This requires the configuration of a server-side container and de-identification of potential PHI.
3. Configure PHI stripping rules for: URL paths (strip /condition-name segments), query strings (remove service, reason, diagnosis parameters), form fields (drop free-text symptom entries), and identifiers (hash email and phone before Enhanced Conversions upload).
4. Set up compliant conversion events: "Booking Started," "Consultation Requested," "Phone Call Over 60 Seconds." Do not name conversions after conditions ("Anxiety Intake Submitted"); use service-line-agnostic labels.

Campaign Structure for Compliant Mental Health In-Market Targeting

• Account level: disable Google Signals in linked GA4 properties, enable IP anonymization, and turn off auto-tagging on pages where GCLID could be appended to a PHI-revealing URL.
• Campaign level: separate campaigns by service line so you can manage in-market and custom segments without leaking diagnosis context across remarketing lists.
• Ad group level: apply mental health in-market targeting in observation mode first to gather performance data without restricting reach. ^[8]Per Google Ads Help, the Observation setting allows you to monitor and set custom bids for criteria without restricting your reach, and is recommended for all Search campaigns as well as the Display campaigns of more advanced advertisers.
• Audience creation: never build "Your data" lists from condition pages. Use general site-visitor lists scoped to non-clinical pages (homepage, about, fees, insurance) only if you have a compliant tracking stack.

For deeper mechanics on running campaigns inside Google's mental health policy guardrails, see Curve's guide on running Google Ads for therapists without triggering mental health policy rejections.

Verification and Testing

• Use Tag Assistant and the browser Network tab to confirm no condition-specific URL or query parameter reaches google-analytics.com or googleads.g.doubleclick.net.
• Trigger every conversion path in a sandbox and inspect the outbound payload. If you can read the condition, so can Google.
• Maintain an audit log of every payload transmitted, with timestamps, for at least six years to satisfy the HIPAA Security Rule documentation standard.
• Re-test after every website change. New landing pages and new GTM tags are the most common source of regression.

Campaign Strategies That Convert

Ad Types That Work for Mental Health Practices

Search remains the workhorse for therapy intake because intent is explicit. Demand Gen and YouTube extend reach for brand-building once you have a compliant tracking stack. Performance Max can work for medical practices but requires careful configuration: the campaign type combines Search, Display, Video, and Discovery placements, which makes it harder to control where ads appear and what audiences see them. For healthcare, that lack of placement control creates compliance concerns. Most mental health practices are better served by standard Search campaigns for core service lines, with Performance Max used selectively and monitored closely.

Targeting Without PHI

The cleanest therapy practice Google Ads audience strategy combines:

• Keyword targeting on intent terms ("therapist accepting new patients," "in-network psychiatrist [city]")
• Geographic targeting by service area, not radius around a treatment facility (which can imply current patient status)
• Demographic targeting by age and household income where relevant to your fee structure
• Mental health in-market targeting using general Health Services segments applied in observation mode, with bid adjustments based on performance
• Custom segments built from competitor URLs and informational keywords, never from condition diagnosis terms

What to avoid: building remarketing lists from clinical pages, uploading Customer Match lists of current patients, or layering audiences in a way that confirms a user's diagnosis. For psychiatry-specific keyword and audience tactics, see targeting mental health searches without policy violations. For Meta-side strategy, review compliant Meta campaigns for therapy and counseling practices.

Conversion Tracking Done Right

• Events to track: form submission (without form contents), call connect of 60+ seconds, appointment-booking-started, insurance-verification-completed
• Conversion values: assign average new-patient value to each conversion type so Smart Bidding can optimize, but never pass per-patient revenue tied to a service line
• Attribution: data-driven attribution works inside Google Ads even without raw user-level data, because aggregated conversion modeling does not require PHI

Common Mistakes to Avoid

Mistake 1: Building remarketing from condition pages. Avoid without legal review: importing offline conversion data from your EHR or practice management system directly into Google Ads, or building remarketing audiences based on pages that reveal health conditions (for example, remarketing to visitors of your "addiction treatment" page).

Mistake 2: Uploading patient lists for Customer Match. Even if hashed, the act of uploading a list of known patients to a platform without a BAA is an impermissible disclosure under the HIPAA Privacy Rule.

Mistake 3: Recording call content. Google Ads call tracking using forwarding numbers can track that a call occurred, its duration, and the keyword that triggered it, all without capturing the content of the conversation. The key compliance rule: do not use call recording or call transcription features if calls may contain PHI. If you use a third-party call tracking service, ensure it has signed a BAA and that recordings are stored in HIPAA-compliant environments.

Mistake 4: Cookie banners as authorization. Banners that ask visitors to accept or reject a website's use of tracking technologies do not constitute a valid HIPAA authorization. A consent banner does not let you bypass the BAA requirement.

Mistake 5: Ignoring the wiretap exposure. ^[9]Even full compliance with HIPAA on this topic does not guarantee compliance with overlapping federal and state laws, such as the wiretapping statutes under which numerous putative class action lawsuits have been filed related to tracking technologies, against HIPAA-regulated entities and others, in recent years.

Self-audit checklist:

• No Google tag fires on any URL containing a condition name
• No form field with clinical content is mirrored to dataLayer or Google
• No "Your data" segment is built from a condition-specific page
• BAA is in place with the server-side tracking intermediary
• Conversion event names are service-line-agnostic
• Call tracking does not record or transcribe
• Quarterly tag inventory is documented

For broader strategies that span Meta and Google, including audience construction without PHI, see Mental Health Practice Marketing Without Exposing PHI.

Simplify Google Ads Compliance with Curve

Stop worrying about PHI exposure in your therapy practice Google Ads audience and mental health in-market targeting campaigns. Curve strips PHI before it ever reaches Google, signs a BAA, and routes conversions through server-side infrastructure that supports Enhanced Conversions and the Google Ads API. See how Curve automates compliant Google Ads tracking for mental health practices.

Frequently Asked Questions

Is Google Ads HIPAA compliant for mental health practices?

Not out of the box. Google provides a powerful ad platform, but it is not designed with HIPAA compliance in mind, and Google will not sign a Business Associate Agreement directly with healthcare advertisers. Mental health practices can advertise on Google Ads compliantly only when they route conversion data through a BAA-covered intermediary that de-identifies PHI before transmission, avoid building audience lists from clinical pages, and do not upload patient lists for Customer Match.

How do I set up compliant Google Ads conversion tracking for a therapy practice?

Replace the client-side Google tag on condition-revealing pages, route conversion data through a server-side intermediary that signs a BAA, configure PHI-stripping rules for URLs, parameters, and form fields, and use service-line-agnostic event names. Then use Enhanced Conversions for Leads with hashed identifiers transmitted via the Google Ads API. Verify by inspecting outbound payloads in your network tools before going live.

Can mental health practices use Google Ads remarketing or in-market audiences?

In-market segments built by Google (such as general Health Services categories) are generally usable in observation mode because you are not disclosing PHI to use them; Google constructs the segments from its own behavioral data. Remarketing lists ("Your data" segments) built from visits to condition pages, or Customer Match audiences uploaded from a patient CRM, are not compliant, because the list itself encodes patient status.

What are the penalties for HIPAA violations through Google Ads?

Civil monetary penalties under HIPAA are tiered based on culpability and can be substantial per violation, with annual caps that scale by tier. Beyond OCR penalties, practices face breach-notification obligations: providing breach notification to affected individuals, the Secretary, and the media (when applicable) of an impermissible disclosure of PHI to a tracking technology vendor that compromises the security or privacy of PHI when there is no Privacy Rule requirement or permission to disclose PHI and there is no BAA with the vendor. In such instances, there is a presumption that there has been a breach of unsecured PHI unless the regulated entity can demonstrate that there is a low probability that the PHI has been compromised. Class-action exposure under state wiretap statutes adds a separate, parallel risk.

Does the 2024 Texas court ruling mean IP addresses are no longer PHI?

Not broadly. ^[10]On June 20, 2024, the US District Court for the Northern District of Texas ruled that key portions of the bulletin issued by HHS Office for Civil Rights regarding the use of online tracking technologies were unlawful, holding that HHS exceeded its statutory authority with respect to certain aspects of the bulletin and granting, in part, the request that the bulletin be vacated. The narrow ruling addressed the specific combination of IP address plus an unauthenticated webpage visit. Authenticated pages, mobile apps, form submissions, and any context in which the visit demonstrably relates to a person's care remain subject to HIPAA, and other parts of the OCR guidance remain in effect.

Sources

1. SAMHSA, 2024 National Survey on Drug Use and Health (Press Release, July 28, 2025)
2. Google Ads API, Get Started with Audience Management
3. Google Ads API, Targeting Settings
4. HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
5. Morrison Foerster, Federal Judge Vacates Portions of OCR Guidance
6. Ropes & Gray, OCR Updates Online Tracking Technology Guidance
7. Moore & Van Allen, New OCR Guidance on Tracking Technologies
8. Google Ads Help, About Targeting and Observation Settings
9. McDermott Will & Emery, OCR Update on Tracking Technologies
10. Nixon Peabody, Portions of OCR's Bulletin on Online Tracking Technologies Deemed Unlawful