Google Ads "Medical Services" In-Market Audience: Specialty Practice Setup

Specialty practices bidding on the medical services in-market audience google ads segment face a paradox: Google's own audience taxonomy surfaces patients actively researching surgeons, dermatologists, fertility clinics, and orthopedists, yet the conversion data flowing back from those campaigns can quietly transmit Protected Health Information to Google's servers.^[1] Since Google's updated personalization policies classify physical and mental health conditions, chronic disease management, invasive procedures, and intimate-body-part services as a sensitive interest category, specialty practices using the in-market medical services segment must understand exactly what is permitted, what is prohibited, and how to wire compliant conversion tracking before launch.^[2]

This guide walks specialty practice marketers through Google Ads platform mechanics, HIPAA exposure points, a step-by-step compliant setup, and the campaign strategies that actually convert intent traffic into booked consultations.

Platform Overview for Healthcare

Why Google Ads Matters for Specialty Practices

Google's in-market segments target users "based on their recent purchase intent" who are actively researching and considering a product or service.^[3] For a specialty practice, that means reaching a parent comparing pediatric ENTs, a 50-year-old researching joint replacement options, or a couple evaluating fertility clinics, at the exact moment they are short-listing providers.

Google has also expanded its audience taxonomy and renamed several controls. The platform now refers to audience types (custom, in-market, affinity) as audience segments, and remarketing is grouped under your data.^[3] For specialty practices, the in-market "Medical Services" parent segment branches into sub-segments tied to specific specialties (cosmetic surgery, dental services, vision care, physical therapy, mental health, and others), giving granular reach without uploading any patient lists.

Healthcare Advertising Policies

Google requires healthcare advertisers to operate within its Healthcare and Medicines policy. Most healthcare ad categories are labeled "Eligible (limited)" only after the campaign targets allowed locations and the domain is properly certified. Categories that require certification or are restricted include prescription drug services, online pharmacies, telemedicine, pharmaceutical manufacturers, addiction services, and health insurance (with U.S. ACA-related keywords requiring an additional certificate).^[4]

Google's Health in Personalized Advertising policy further restricts targeting for sensitive categories. Audience segments based on chronic conditions, intimate body-part procedures, disabilities, and invasive procedures cannot be used to tailor ads to users.^[2]

Platform-Specific Terminology

• In-market segment: Users actively researching a purchase, including the "Medical Services" branch.
• Custom segment: Advertiser-defined audience based on keywords, URLs, and apps. Custom segments with sensitive creative assets or landing pages are restricted in serving.^[2]
• Your data segments: Formerly remarketing; first-party lists uploaded or built from site activity.
• Enhanced Conversions: Conversion API feature that hashes first-party identifiers to improve match rates.
• Sensitive interest category: Google's classification covering chronic conditions, intimate body-part procedures, disabilities, and invasive procedures.^[2]

HIPAA Compliance Deep Dive for Medical Services In-Market Audience Google Ads

How Data Flows Through Google Ads

A standard Google Ads implementation collects data three ways: the Google tag (gtag.js) loads in the browser and fires page-view plus conversion events; URL parameters carry query strings into landing pages; and conversion events POST back to Google's servers, optionally enriched with hashed user data through Enhanced Conversions or the Google Ads API. OCR's guidance on tracking technologies remains in force for authenticated pages such as patient portals and telehealth platforms, where tracking tools can access diagnoses, treatment information, and billing data.^[1]

PHI Exposure Risks

Default Google Ads tracking can expose PHI in several places specialty practices rarely think about:

• Conversion event URLs: Confirmation pages often include condition names, appointment types, or practitioner names in the URL path or query string. By default, web trackers collect HIPAA identifiers such as IP addresses and ad click IDs alongside page URLs and button text, and the combination is treated as PHI.^[5]
• Form field data: If a booking form posts to a thank-you page that includes the diagnosis or service requested as a parameter, that becomes an impermissible disclosure to the ad platform.
• Cookies and device IDs: Google's gclid (click ID), device IDs, and IP addresses can be combined with health-context page visits to create identifiable health information.
• Authenticated pages: In June 2024, the U.S. District Court for the Northern District of Texas in American Hospital Association v. Becerra vacated only the portion of OCR's bulletin treating an IP address combined with a visit to an unauthenticated public webpage about specific health conditions as PHI; the rest of the bulletin remained intact.^[6] Tracking tools still may not be used on authenticated pages such as patient portals unless a valid BAA is in place.^[6]

OCR also reminded regulated entities that they may only disclose health information to digital tracking vendors who first sign a business associate agreement.^[7] Google does not publicly offer a HIPAA BAA for Google Ads; Google's BAA program covers Google Cloud and Google Workspace, not the ads product.^[5] That means the advertiser is solely responsible for ensuring no PHI ever reaches Google's servers.

Compliant vs. Non-Compliant Features

• Standard Google tag (gtag.js) on health pages: Not compliant out of the box. It captures IP, page URL, and referrer, which combine to form PHI on condition-specific pages.
• Google Ads API / server-side conversion uploads: Can be compliant when PHI is stripped before transmission and only non-PHI conversion signals reach Google.
• Enhanced Conversions: Acceptable only if first-party identifiers are hashed and stripped of health context before transmission.
• "Your data" (remarketing) lists built from condition pages: High risk. OCR considers retargeting from sensitive-condition pages an impermissible disclosure.
• In-market "Medical Services" segment: Compliant when used as the inbound targeting layer, because Google curates the segment from its own behavioral signals; the advertiser uploads no patient data.
• Custom Segment audiences with sensitive creative or landing pages: Serving is restricted to Display non-sensitive contexts or contextual matching only.^[2]

Step-by-Step Compliant Setup

Pre-Implementation Audit

1. Inventory every Google tag, GTM container, and conversion action currently firing on your domain.
2. Map each conversion event to the URL pattern that triggers it. Flag any URL containing condition names, procedure types, or provider specialty in the path.
3. Review every form (appointment request, contact, financing) and trace the data flow from submission to "thank you" page.
4. Identify whether any pixels load on authenticated pages, the patient portal, or telehealth waiting rooms. These must be removed.
5. Confirm whether you have a signed BAA with every vendor in the tracking stack. Google's BAA program does not cover Google Ads.^[5]

Compliant Tracking Configuration

1. Remove the client-side Google tag from all health-context pages. Replace with a server-side gateway that filters payloads before they leave your infrastructure.
2. Route conversions through the Google Ads API (server-side). Server-side conversion uploads let you control exactly which fields ship to Google.
3. Apply PHI stripping rules to page URLs, page titles, referrers, form field values, and user-agent strings. At minimum, scrub the 18 HIPAA identifiers including name, email, phone, IP, MRN, and device IDs.
4. Set up two clean conversion events: a generic "Appointment Requested" (no condition or specialty in the payload) and "Phone Call Initiated" (without recording or storing call content).
5. Hash any first-party identifiers used for Enhanced Conversions before they leave your server. Curve performs a client-side scrub and server-side secondary scan, then routes the cleansed payload through the Google Ads API under a signed BAA.

Campaign Structure for Medical Services In-Market Audience Google Ads Compliance

• Account level: Complete Google's healthcare advertiser verification before launching restricted-category campaigns.^[4]
• Campaign level: Use Search and Performance Max campaigns with the in-market "Medical Services" segment applied as an "Observation" signal first, then move to "Targeting" once conversion data validates.
• Ad group level: Keep one specialty per ad group (orthopedics, dermatology, cardiology). This lets you point each ad to a non-condition-specific landing page.
• Audience layer: Combine the in-market medical services segment with broad geography (city or radius), age bands where appropriate, and parental status only if relevant. Avoid layering custom segments built on condition-specific URLs.

Verification and Testing

1. Use Google Tag Assistant to confirm no client-side tag is firing on protected pages.
2. Open browser DevTools, hit a confirmation URL, and inspect outbound network calls. Confirm no health-related query parameters appear in requests to google.com/pagead or googleadservices.com.
3. Run a "test conversion" through your server-side pipeline and audit the payload Google receives. The body should contain only the conversion name, value, currency, and a hashed click ID.
4. Document the data flow diagram, retention policy, and BAA inventory in a tracking audit binder. OCR's tracking guidance for authenticated pages and other PHI combinations beyond the vacated IP-only scenario remains in effect.^[6]

Campaign Strategies That Convert

Ad Types for Specialty Practices

The medical services in-market audience google ads segment is available on Display, Demand Gen, Video, and as an "Observation" signal on Search. For specialty practices, the highest-converting structure combines:

• Search campaigns: Brand and high-intent commercial keywords ("orthopedic surgeon near me," "best dermatologist [city]"). Apply the in-market medical services segment as an audience observation to bid up on the highest-intent users.
• Demand Gen campaigns: Visual ads on YouTube and Gmail layered against the in-market medical services sub-segments. Useful for procedures with longer consideration windows (LASIK, fertility, cosmetic surgery).
• Performance Max: Feed the algorithm with the in-market medical services audience signal, but exclude any first-party retargeting lists built from condition-specific pages.

For practices booking via phone, see our companion playbook on Google Local Services Ads for healthcare, which pairs naturally with in-market segment campaigns.

Targeting Without PHI

Google's policies prevent targeting based on health conditions, and HIPAA prevents building audience lists from diagnoses or treatment history.^[2] Compliant targeting layers include:

• Geography: Tight radius around each clinic location. Run separate campaigns per location to maintain local relevance.
• In-market "Medical Services" parent or sub-segments: Curated by Google, no patient data input required.
• Demographics: Age, gender, parental status where clinically relevant (pediatric, OB/GYN, geriatrics).
• Custom segments built on competitor URLs or general health keywords: Acceptable when the segment is contextual, not behavioral.

For psychiatric and behavioral health practices, condition-based targeting and remarketing carry the highest risk. Our psychiatry practice marketing guide covers the medication-management nuances in depth, and our physical therapy in-market audience playbook shows how to apply this framework to rehabilitation services.

Conversion Tracking Done Right

• Events to track: Appointment requested, phone call initiated, financing application started, location-page engagement. Keep names generic.
• Conversion values: Assign offline conversion values based on average new-patient lifetime value, uploaded via the Google Ads API from your CRM after PHI scrubbing.
• Attribution: Use data-driven attribution and a 30 to 90 day click window. Specialty consideration cycles run long.
• Offline conversion imports: The cleanest path. Upload booked-and-attended appointments (count only, no identifiers, no condition) through the Google Ads API to teach Smart Bidding what a real patient looks like.

Common Mistakes to Avoid

• Leaving the standard Google tag on condition-specific landing pages. A page titled "Knee Replacement Consultation" that loads gtag.js sends the page title, URL, and IP to Google. That combination meets OCR's PHI definition on authenticated pages and remains a serious risk on unauthenticated pages where intent is medical.^[6]
• Building "your data" remarketing lists from sensitive page visits. Generally not compliant for healthcare; OCR considers it an impermissible disclosure absent a BAA.^[7]
• Form submissions that POST to URLs containing the condition. Example: /thank-you?service=infertility-consult. Strip parameters or redirect to a clean confirmation URL before any tag fires.
• Uploading Customer Match lists built from a patient EMR. Patient data uploaded to Google triggers HIPAA disclosure obligations Google's Ads terms cannot satisfy.^[5]
• Allowing call recording or transcription to flow into ad platforms. Call content frequently includes diagnoses, symptoms, and identifiers. Any disclosure to a vendor without a BAA is impermissible.^[7]
• Assuming the AHA court win eliminated all tracking risk. The court vacated guidance only on unauthenticated public webpages combining IP with health-condition visits. Authenticated pages, lawsuits from state AGs, FTC Health Breach Notification Rule actions, and private class actions all remain active threats.^[8]

Self-audit checklist:

• No client-side Google tag on authenticated pages or condition-specific URLs
• All conversion events route server-side through the Google Ads API
• URL parameters scrubbed of condition, service, and identifier values
• No remarketing lists built from sensitive-page visits
• Signed BAA with every tracking vendor in the stack
• In-market segment used as Google-curated targeting layer, no patient data uploaded
• Documented data-flow diagram and quarterly tracking audit

Frequently Asked Questions

Is Google Ads advertising HIPAA compliant for healthcare?

Google Ads is not HIPAA compliant out of the box because Google's public BAA program covers Google Cloud and Workspace, not the ads product.^[5] Practices can run compliant campaigns by stripping PHI from all conversion events, routing data server-side, avoiding sensitive remarketing, and working with a HIPAA-compliant tracking intermediary that does sign a BAA.

How do I set up compliant Google Ads conversion tracking?

Remove the client-side Google tag from condition-specific and authenticated pages, redact PHI from URLs and page titles, and send conversions through the Google Ads API server-side. Use a compliant intermediary like Curve to scrub identifiers before transmission and operate under a signed BAA.

Can specialty practices use Google Ads remarketing?

Generally no for sensitive medical services. HIPAA prevents building audience lists based on specific medical conditions or diagnoses, and remarketing built from sensitive page visits is an impermissible disclosure absent a BAA.^[7] Brand-level remarketing from generic pages (homepage, about us) carries less risk but still warrants legal review.

What are the penalties for Google Ads HIPAA violations?

HIPAA civil monetary penalties are tiered by culpability. Under the January 28, 2026 inflation adjustment published in the Federal Register, ranges run from $145 to $73,011 per violation in Tier 1 (no knowledge) and from $73,011 to $2,190,294 per violation in Tier 4 (willful neglect, not corrected), with a $2,190,294 annual cap per identical provision.^[9][10] OCR investigations into tracking technologies remain active, and class-action plaintiffs have separately sued providers over pixel-based disclosures.^[7]

Does the in-market "Medical Services" segment count as PHI targeting?

No. In-market segments are curated by Google from aggregated behavioral signals and require no patient data from the advertiser. Google's policies state that sensitive information like health is not used to tailor ads to users, and predefined Google audiences remain available for healthcare advertisers within the broader Health personalization rules.^[3][2]

Simplify Google Ads Compliance with Curve

Stop worrying about PHI exposure in your medical services in-market audience google ads campaigns. See how Curve automates compliant Google Ads tracking with client-side scrubbing, server-side verification, no-code implementation, and a signed BAA built specifically for specialty practices.

Sources

1. HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
2. Google Ads Policy: Health in Personalized Advertising
3. Google Ads Help: About Audience Segments
4. Google Ads Policy: Healthcare and Medicines
5. HIPAA Journal, Is Google Analytics HIPAA Compliant?
6. HIPAA Journal, OCR Drops Appeal in AHA Tracking Technology Case
7. Dentons Health Law, HHS-OCR Revises Guidance on Use of Online Tracking Technologies
8. Norton Rose Fulbright, Applying HIPAA to Online Tracking Technologies
9. Federal Register, Annual Civil Monetary Penalties Inflation Adjustment (January 28, 2026)
10. HIPAA Journal, HHS Applies Inflation Increase to Penalties for HIPAA Violations