Google Ads "Rehabilitation Services" In-Market Audience: PT & OT Campaign Targeting

The U.S. physical and occupational therapy market reached an estimated ^[1]$53 billion in 2024, up 6.4% from 2023 and up 64% from 2020, and outpatient clinics now compete for the same patients on Google. The rehabilitation services in-market audience google ads segment lets PT and OT clinics reach users actively researching rehab providers, but most clinics deploy it incorrectly, leaking patient data to Google through default tag configurations that violate HIPAA. This guide explains how to configure Google's rehabilitation services in-market audience for PT and OT campaigns, what HIPAA requires of your conversion tracking, and how to keep PHI out of Google's systems while still feeding Smart Bidding the signals it needs to scale qualified bookings.

Why the Rehabilitation Services In-Market Audience Google Ads Segment Matters for PT and OT Clinics

Patient Discovery Behavior in Rehab Search

Outpatient PT and OT clinics sit at the high-intent end of healthcare search. Patients typically arrive via three pathways: a physician referral followed by a clinic search, a direct symptom search ("knee pain physical therapist near me"), or insurance-driven shopping. The Rehabilitation Services in-market segment, located under Audiences > Browse > In-market > Health, captures users whose recent browsing signals active research into rehab providers, including physical therapy, occupational therapy, and post-surgical recovery.

This audience matters because clinic economics favor incremental volume. According to industry data, there are 50,883 U.S. clinics providing physical therapy, occupational therapy, speech therapy and audiology, with average annual receipts per clinic of $871,000 and a net profit margin of 14-20%.^[1] Margins reward consistent new-patient flow, which is exactly what a layered in-market audience strategy delivers when combined with high-intent search keywords.

Google's Healthcare Advertising Policies for Rehab

Standard outpatient PT and OT services do not require LegitScript certification (that requirement applies to addiction treatment providers). However, all healthcare advertisers fall under Google's personalized advertising restrictions. Content related to Health is a sensitive interest category and includes personal health content like physical or mental health conditions, products, services, or procedures to treat or manage chronic health conditions, and disabilities, even when content is oriented toward the user's primary caretaker.^[2]

For PT and OT, this means: you can use predefined Google audiences, but you can't use advertiser-curated audiences when targeting users on the basis of health interest. The Rehabilitation Services in-market segment is a predefined Google audience and is permitted. Customer Match lists built from patient PHI are not.

Key Terminology for PT Clinic In-Market Targeting

In-market audience: Predefined Google segment of users showing active purchase intent for a category
Audience signals (PMax/DemandGen): Suggested audiences Google uses as a starting point, not a strict include
Observation vs. Targeting: Observation reports performance without narrowing reach; targeting restricts delivery to the audience
Enhanced Conversions for Leads: Hashed first-party data sent to improve attribution, which becomes a HIPAA risk if patient data is involved

HIPAA Compliance Deep Dive for Google Ads

How Data Flows on Google Ads

A typical PT clinic Google Ads setup transmits data to Google through three channels: the Google tag (gtag.js or GTM web container) firing on page views and conversion events, Enhanced Conversions sending hashed user-provided data, and offline conversion imports or Google Ads API uploads sending downstream events from the CRM or EHR. Enhanced conversions is a feature that can improve the accuracy of your conversion measurement and unlock more powerful bidding. It supplements your existing conversion by sending hashed first party conversion data to Google in a privacy safe way. The feature uses a secure one-way hashing algorithm called SHA256 on your first party customer data, such as email addresses, before sending to Google.^[3]

Hashing is not anonymization under HIPAA. If the hashed value identifies a patient who scheduled a PT evaluation for a specific condition, the combination is still PHI in OCR's view.

PHI Exposure Risks Specific to Rehab Campaigns

OCR has been explicit on this. While it has always been true that regulated entities may not impermissibly disclose PHI to tracking technology vendors, because of the proliferation of tracking technologies collecting sensitive information, OCR is providing this reminder that it is critical for regulated entities to ensure that they disclose PHI only as expressly permitted or required by the HIPAA Privacy Rule.^[4]

The June 2024 court ruling narrowed but did not eliminate this exposure. On June 20, 2024, the US District Court for the Northern District of Texas ruled that key portions of the bulletin issued by HHS OCR regarding the use of online tracking technologies were unlawful. The court's ruling held that HHS exceeded its statutory authority with respect to certain aspects of the bulletin and granted, in part, the request that the bulletin be vacated.^[5] The vacated portion was the "Proscribed Combination" of IP address plus visit to an unauthenticated public webpage about a condition. Authenticated sessions (patient portals, scheduling forms, intake) and disclosures tied to appointment data remain firmly within HIPAA's scope.

For a PT or OT campaign, the highest-risk exposure points are:

Booking form fields: Name, email, phone, condition selector ("rotator cuff," "post-op knee," "stroke recovery") transmitted via the standard Google tag
URL parameters: Service slugs in landing page URLs (/post-surgical-rehab/, /stroke-recovery/) sent as page_location to Google
Enhanced Conversions for Leads: Hashed email plus appointment-confirmation page view, which together identify a patient seeking specific care
GCLID-bound CRM uploads: Offline conversions tied to evaluation completions or diagnosis codes

Compliant vs. Non-Compliant Features for PT Clinics

Standard Google tag (client-side gtag.js): Not compliant by default. It transmits full page URLs, form interactions, and user identifiers without filtering.
Predefined Rehabilitation Services in-market audience: Compliant when used as targeting or observation, because no patient data leaves your systems to define it.
Customer Match from patient lists: Not compliant. Uploading patient emails to Google constitutes disclosure of PHI without a BAA.
Enhanced Conversions for Leads via standard tag: Not compliant for healthcare. The Google tag or Google Tag Manager is responsible for collecting personally identifiable information (PII) from your website and hashing it in the browser before sending it to Google's servers. This is a critical component of matching media and conversion data.^[6] The PII is still being sent.
Server-side conversion uploads via Google Ads API with PHI stripping: Can be compliant when a HIPAA-compliant intermediary filters identifiers before transmission.
Remarketing to website visitors: Generally not compliant for rehab service pages, because the visit itself indicates a health-seeking behavior.

The agency also reminds covered entities that they may only disclose health information to digital tracking vendors who first sign a business associate agreement (BAA).^[7] Google does not sign BAAs for Google Ads, which is why server-side filtering through a HIPAA-compliant intermediary is the standard architecture.

Step-by-Step Compliant Setup for the Rehabilitation Services In-Market Audience Google Ads Configuration

Pre-Implementation Audit

Pull every page where the Google tag fires. Flag any URL containing condition or service descriptors (post-stroke-rehab, lymphedema-therapy, vestibular-rehab).
Inspect form submissions in Google Tag Assistant. Document every field passed to Google as user-provided data or in event parameters.
Review your conversion actions list. Identify any conversion whose name or page path reveals condition or treatment type.
List every vendor receiving conversion data: Google Ads, GA4, CRM connectors, call tracking. Confirm BAA status for each.

Compliant Tracking Configuration

Disable the standard Google tag on any URL that exposes condition, body part, or treatment specifics. Replace with a server-side tag managed by a HIPAA-compliant tracking layer.
Implement server-side tracking via the Google Ads API rather than client-side Enhanced Conversions. The Google Ads API uploads ClickConversion objects containing hashed, first-party user data like email and phone number, along with conversion details. Key aspects include normalizing and hashing user identifiers, creating UserIdentifier objects, building the ClickConversion object, handling user consent, including session attributes, and using the ConversionUploadService.^[8] A compliant intermediary intercepts the payload, strips PHI fields, and transmits only the GCLID plus an aggregate conversion value.
Configure PHI stripping rules to remove: email and phone before they leave your infrastructure, URL path segments containing condition keywords, form-field values for condition selectors, and any IP address tied to authenticated sessions.
Set up generic conversion events. Use "Lead Submitted" and "Evaluation Booked" rather than condition-specific names. Pass a static value, not a billed amount tied to a CPT code.

Campaign Structure for Compliance

Account-level: Turn off auto-tagging on landing pages serving authenticated users. Disable data sharing with Google products beyond what conversion measurement requires.
Campaign-level: Use the Rehabilitation Services in-market segment in Observation mode first on Search campaigns to gather performance data before narrowing reach. On Performance Max, supply the in-market segment as an audience signal alongside your service-page URLs.
Ad group: Pair the in-market audience with intent keywords ("physical therapist near me," "occupational therapy [city]," "post-op rehab clinic"). Avoid layering condition-specific keywords with condition-specific in-market segments, which compounds PHI risk if conversion paths are not filtered.
Audience exclusions: Exclude under-18 audiences and competitor employee segments. See our guide on setting healthcare audience exclusions that prevent PHI targeting for the full exclusion stack.

Verification and Testing

Use Chrome DevTools' Network tab to inspect every outbound request to googleadservices.com and google-analytics.com. Confirm no email, phone, or condition string appears in any payload.
In the Google Ads Conversions diagnostics report, verify that user-provided data is hashed and that no plain-text identifiers are being received.
Run a test booking with synthetic patient data and trace the entire path from form to Google Ads API call. Document where PHI is stripped.
Establish a monthly audit cadence with screenshots and tag firing logs retained as evidence for OCR investigations.

Campaign Strategies That Convert with the Rehabilitation Services In-Market Audience Google Ads Segment

Ad Formats That Work for Outpatient Rehab

Search campaigns deliver the strongest unit economics for PT and OT clinics because intent is explicit. Layer the Rehabilitation Services in-market audience as Observation on branded and non-branded service keywords; users in the segment typically show meaningfully higher conversion rates and justify a +15% to +25% bid adjustment.

Performance Max can scale once you have at least 30 conversions per month and clean server-side conversion data. Without filtered conversions, PMax will learn from PHI-tainted signals and you cannot retroactively scrub Google's models. Demand Gen and Display work for awareness in larger metros where ATI, Athletico, Select Medical, US Physical Therapy, and PT Solutions dominate; these six large chain competitors had combined revenues of $4.07 billion in 2024, and they operated 4,949 clinics (9.7% of the industry total)^[1] in saturated markets where in-market audiences plus contextual targeting outperform broad demographic Display.

Targeting Without PHI

Predefined in-market audiences: Rehabilitation Services, Health > Medical Facilities & Services, Senior Care
Affinity audiences: Health & Fitness Buffs, Sports Fans (for sports medicine clinics)
Geographic targeting: Radius targeting around clinic locations, typically 5 to 15 miles depending on metro density. Avoid ZIP-level targeting on payer-segregated geographies that could imply protected demographic targeting.
Avoid: Customer Match from patient lists, Similar Audiences derived from patient lists, advertiser-curated condition-specific segments. For a complete map of which segments leak PHI, see our breakdown of Google Ads healthcare audience segments and which are HIPAA-safe.

Conversion Tracking Done Right

Track three events through your compliant server-side pipeline: form submission (initial lead), evaluation booked (qualified lead), and evaluation completed (closed conversion). Server-side conversion events close this gap by sending offline qualification outcomes back to Google Ads using the Offline Conversion API. As a lead moves from raw submission to qualified lead, then to SQL, and finally to a paying customer, each status change can be captured and sent as a conversion event. When these signals are introduced, Smart Bidding can learn which users are associated with meaningful downstream outcomes.^[9] For PT clinics, this means Smart Bidding optimizes toward patients who actually show up to their evaluation, not patients who fill a form and ghost. See our detailed playbook on physical therapy patient acquisition through Google Ads in-market audiences.

Common Mistakes to Avoid

Firing the standard Google tag on intake forms. Most clinics install gtag.js sitewide and forget that the intake form passes condition selectors and contact details through page_location and form_submit events. This is the single most common source of PHI exposure for outpatient rehab.

Building Customer Match lists from EHR exports. Uploading patient emails to create Similar Audiences or remarketing pools is a clear HIPAA violation. Google does not have a BAA with healthcare advertisers, and the act of upload is the disclosure.

Enabling Enhanced Conversions for Leads without a server-side filter. Even though data is hashed, the hash plus the conversion context (rehab evaluation booked) ties a specific person to a specific health service. If tracking technologies collected an individual's email address, or reason for seeking health care typed or selected by an individual, when the individual visits a regulated entity's webpage and makes an appointment with a health care provider or enters symptoms in an online tool to obtain a health analysis, HIPAA would apply, so there would need to be a BAA with the tracking technology vendor or the user would need to consent.^[10]

Running condition-specific remarketing. A remarketing list called "Visited Stroke Recovery Page" is itself a form of PHI when it is shared with Google.

Ignoring the FTC and OCR coordination. In July 2023, HHS-OCR and the Federal Trade Commission sent warning letters to 130 hospitals that use third-party tracking technology, seeming to double down on the agency's positions in the Original Bulletin. Since that time, numerous class action suits have been filed against providers alleging damages to patients from the use of such online tracking technologies.^[7] Enforcement risk now comes from two federal agencies plus a private right of action under state privacy laws.

Self-audit checklist:

Tag inventory: Every Google tag location documented with payload contents
URL hygiene: No condition keywords in URL paths sent to Google
Form filter: No PII fields transmitted to Google Ads or GA4
Audience review: No Customer Match or condition-based remarketing lists
Vendor BAAs: Signed agreements with every tool touching conversion data
Server-side pipeline: PHI stripping verified with monthly test traces

Frequently Asked Questions

Is Google Ads advertising HIPAA compliant for PT and OT clinics?

Google Ads can be operated in a HIPAA-compliant manner, but the platform itself is not compliant out of the box. Google does not sign BAAs for Google Ads, so any direct transmission of PHI to Google constitutes an impermissible disclosure. Compliance requires a server-side architecture that strips PHI before data reaches Google, plus a BAA with whichever intermediary handles that filtering.

How do I set up compliant Google Ads conversion tracking for a rehab clinic?

Replace client-side Enhanced Conversions for Leads with server-side conversion uploads via the Google Ads API. Route all conversion events through a HIPAA-compliant intermediary that removes email, phone, condition descriptors, and URL parameters identifying treatment type. Send only the GCLID, conversion action, conversion time, and a non-PHI value. Verify in Google Ads diagnostics that no plain-text identifiers are received.

Can PT and OT practices use Google Ads remarketing?

Remarketing to homepage and general-information page visitors is lower-risk. Remarketing to visitors of condition-specific pages (stroke recovery, post-surgical rehab, pediatric OT) is not compliant because the page visit itself indicates the user's health-seeking behavior, and the remarketing list shared with Google constitutes a disclosure of that information.

What are the penalties for Google Ads HIPAA violations?

OCR civil monetary penalties scale by culpability tier, and recent enforcement against hospitals using tracking pixels has involved settlements plus required corrective action plans. Beyond OCR, the FTC has pursued enforcement under the Health Breach Notification Rule, and class-action lawsuits have produced multimillion-dollar settlements. OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies. OCR's principal interest in this area is ensuring that regulated entities have identified, assessed, and mitigated the risks to ePHI when using online tracking technologies.^[4]

Does the June 2024 court ruling mean PT clinics can run Google Ads without filtering?

No. The ruling only vacated one narrow OCR interpretation: that IP address plus a visit to an unauthenticated public webpage about a health condition automatically triggers HIPAA. Form submissions, appointment bookings, authenticated portal sessions, and any data tied to a patient relationship remain firmly within HIPAA's scope. PT and OT clinics still need server-side filtering for conversion tracking.

Simplify Google Ads Compliance with Curve

Stop worrying about PHI exposure in your rehabilitation services in-market audience google ads campaigns. Curve automatically strips PHI from conversion data before it reaches Google, signs a BAA, and replaces 20+ hours of manual server-side configuration with a no-code install. See how Curve automates compliant Google Ads tracking for PT and OT clinics.

Sources

Google Ads "Rehabilitation Services" In-Market Audience: PT & OT Campaign Targeting

Stay Compliant. Scale Confidently.