A healthcare Performance Max campaign works best with 3-5 asset groups organized by service category rather than health condition, Final URL Expansion turned off, and conversion goals limited to PHI-free actions such as "Appointment Booked." Performance Max is Google's AI campaign type that serves ads across Search, Display, YouTube, Gmail and Discover from one campaign. Curve Compliance sends those conversions server-side to Google Ads with neutral event names and only a fixed list of fields.
Google reports that advertisers using Performance Max see an average of 18% more conversions at a similar cost per action, based on its late-2022 data. Yet healthcare marketers face unique challenges: one misstep in your Google Performance Max healthcare campaign structure can expose protected health information (PHI) and trigger HIPAA violations with civil penalties of $145 to $2,190,294 per violation, depending on culpability.
This comprehensive guide shows you exactly how to structure compliant, high-performing Google Performance Max campaigns that protect patient privacy while maximizing your advertising ROI. Whether you're a small practice or a multi-location healthcare organization, you'll learn the precise campaign architecture needed for HIPAA compliance.
By the end of this Google Performance Max healthcare campaign structure guide, you'll understand compliant tracking implementation, campaign settings that prevent PHI exposure, and optimization strategies specifically designed for healthcare advertisers.
Book a call. Running Performance Max for a healthcare practice and not sure what your Google tag sends from form and thank-you pages? Book a call with Curve.
Platform Overview for Healthcare
Why Google Performance Max Matters for Healthcare
Google Performance Max (PMax) represents Google's most advanced campaign type, using AI to optimize ads across Search, Display, YouTube, Gmail, and Discover simultaneously. For healthcare practices, this means reaching patients at every stage of their healthcare journey with a single campaign structure.
Healthcare-seeking behavior on Google is intensely local and intent-driven. A 2012 Google and Compete hospital study found 77% of patients used search before booking an appointment, and Google said in 2015 that about 1 in 20 of its searches are health-related. Performance Max campaigns leverage this intent by automatically serving ads when potential patients demonstrate the highest likelihood of conversion.
The ROI potential can be substantial when Performance Max's automated audience matching and creative optimization work from good conversion data.
Healthcare Advertising Policies on Google Ads
Google maintains strict healthcare advertising policies under its "Healthcare and medicines" category. Healthcare providers must comply with both general advertising policies and region-specific requirements. In the United States, healthcare advertisers can promote facilities and services without special certification, but online pharmacies and telemedicine providers need LegitScript accreditation, and promoting prescription drugs requires Google certification.
Restricted content categories include unapproved pharmaceuticals, clinical trial recruitment without proper disclosure, and misleading health claims. Google requires certification to run ads on abortion-related queries in the US, UK and Ireland, and does not allow ads for speculative or experimental medical treatments.
Addiction treatment advertisers must be certified through LegitScript. Healthcare advertisers must maintain accurate business information in their Google Business Profile and avoid making unsubstantiated treatment outcome claims in ad copy or landing pages.
Performance Max Terminology for Healthcare Marketers
Understanding platform-specific terminology is essential for proper Google Performance Max healthcare campaign structure. Asset Groups function as creative containers within your campaign, holding headlines, descriptions, images, and videos that Google's AI combines dynamically. Healthcare campaigns typically need 3-5 asset groups segmented by service line or patient intent.
Audience Signals guide Google's AI toward your ideal patients without creating restrictive targeting. These include custom segments, in-market audiences, and your first-party data. Unlike traditional targeting, audience signals are directional inputs rather than hard constraints. Conversion Goals define which actions you want to optimize for, such as appointment form submissions, phone calls, or contact form completions.
The Final URL Expansion setting allows Google to send traffic to pages beyond those you specify, which creates compliance risks for healthcare advertisers. Data-Driven Attribution distributes conversion credit across touchpoints, but requires sufficient conversion volume. It works with any volume, though Google recommends at least 200 conversions and 2,000 ad interactions in 30 days for the best accuracy.
Before scaling Performance Max, check the basics in our guide to HIPAA-compliant Google Ads: what Google will and won't sign, and how to keep PHI out of conversions.
When a clinic should and should not use Performance Max
Google recommends Performance Max when a business has specific conversion goals, such as leads, and wants to reach all of Google's channels from one campaign (Google Ads Help). For a clinic, the deciding factors are the conversion signal and the audience rules for health.
| Situation | Use Performance Max? | Why |
|---|---|---|
| You send a reliable conversion with no PHI, such as a booked consultation | Yes | Performance Max uses Smart Bidding on the conversion actions you define, so a clean, real conversion is what it learns from |
| You want reach on YouTube, Display, Gmail and Maps as well as Search | Yes | One campaign covers all Google Ads inventory |
| You need control over exact search terms | Alongside Search | A Search campaign with an exact match keyword is prioritized over Performance Max for that query |
| You planned to use remarketing lists or Customer Match as audience signals | Not with those signals | Google bars advertiser-curated audiences, such as Customer Match and your data segments, for health content, and tells advertisers to check asset groups too (Google health policy) |
| Some landing pages name conditions or drugs | Only with Final URL expansion reviewed | Google may replace your final URL with another page and generate headlines from it, and you remain responsible for that content |
| Your only conversion is a page view or form start | Not yet | Set up a booked or qualified lead conversion first |
Curve Compliance sends Google Ads the booked or qualified lead conversion server-side, with a fixed list of fields and neutral event names.
HIPAA Compliance Deep Dive
How Data Flows in Google Performance Max
Google Performance Max campaigns collect data through multiple mechanisms that create PHI exposure risks for healthcare advertisers. The standard implementation uses client-side tracking via the Google tag (gtag.js), which fires directly from the user's browser and transmits data to Google's servers including URL parameters, form field values, and user behavior patterns.
When a patient visits your healthcare website, the Google tag automatically captures the page URL, referrer information, device identifiers, IP addresses, and interaction data. If your URLs contain appointment types, provider names, or condition-related keywords, this constitutes PHI transmission to Google without a Business Associate Agreement (BAA).
Server-side tracking offers a compliant alternative through Google's Enhanced Conversions and Google Ads API. In this configuration, conversion data flows from your server to Google's servers, allowing you to strip PHI before transmission. However, most healthcare practices still rely on client-side implementation, unknowingly violating HIPAA daily.
PHI Exposure Risks in Performance Max Campaigns
Default Google tag implementation captures numerous data points that constitute PHI under HIPAA. URL parameters are the most common exposure vector: tracking codes like ?service=addiction-treatment or ?provider=dr-smith-oncology reveal health conditions and provider relationships. Google automatically captures these parameters and associates them with device identifiers.
Form data transmission represents another critical risk. When patients submit appointment requests, the Google tag can capture form field contents including names, email addresses, phone numbers, and selected services. This data, when combined with health-related context, becomes PHI. Dynamic remarketing features in Performance Max can create audiences based on specific pages viewed, effectively creating health-condition-based audience segments.
Cookie and device ID concerns arise because Google assigns persistent identifiers to users across sessions. When these identifiers link to health-related behavior on your site, you've created a PHI record in Google's systems. IP addresses, which Google collects by default, are considered identifiers under HIPAA and must be anonymized or stripped when associated with health information.
Compliant vs. Non-Compliant Performance Max Features
| Feature | Compliance Status | Notes |
|---|---|---|
| Standard Google Tag (Client-Side) | ✗ Not Compliant | Automatically captures PHI from URLs and forms |
| Enhanced Conversions (Server-Side) | ✓ Can Be Compliant | Requires proper PHI filtering implementation |
| Dynamic Remarketing | ✗ Generally Not Compliant | Creates health-condition-based audiences |
| Customer Match (Hashed Emails) | ⚠️ Requires Careful Setup | Not allowed for ads about health conditions or their treatment |
| URL Expansion | ✗ Not Recommended | Sends traffic to pages you haven't audited for PHI exposure |
| Location Extensions | ✓ Generally Compliant | Does not transmit patient-specific information |
| Call Tracking | ⚠️ Depends on Implementation | Dynamic number insertion must not expose caller health conditions |
| In-Market Audiences | ✓ Compliant as Signals | Google's pre-built audiences don't contain your PHI |
Step-by-Step Compliant Google Performance Max Setup
Pre-Implementation Audit for Healthcare Practices
Before launching your Google Performance Max healthcare campaign structure, conduct a thorough audit of your current tracking implementation. Access Google Tag Manager or your website's header code to identify all existing Google tags, including Analytics, Ads, and conversion tracking pixels. Document every tag, its trigger conditions, and what data it collects.
Identify PHI exposure points by examining your website's URL structure. Create a spreadsheet listing all URLs containing health-related parameters, service names, or provider identifiers. Check your form implementations to determine whether Google tags fire on form submission events and whether field-level data gets transmitted to Google.
Document your data flows by creating a visual map showing how patient information moves from initial website visit through conversion tracking to Google's systems. Include all third-party tools that might share data with Google Ads. Assess your vendor agreements by reviewing whether you have a signed BAA with Google (note: Google does not provide BAAs for Google Ads).
Compliant Tracking Configuration for Performance Max
Implementing compliant tracking for your Google Performance Max healthcare campaign structure requires removing or significantly modifying the standard Google tag. The compliant approach uses server-side conversion tracking exclusively, eliminating direct browser-to-Google data transmission that captures PHI.
Step 1: Disable automatic form tracking by accessing your Google Ads account, navigating to Conversions under Tools & Settings, and ensuring no conversion actions use automatic detection. Remove any event snippets that fire on form submissions or capture URL parameters. If using Google Tag Manager, disable or delete triggers that fire Google Ads tags on form interactions.
Step 2: Implement server-side tracking by setting up a secure server endpoint that receives conversion data from your website. This endpoint must strip all PHI before forwarding sanitized conversion data to Google via the Google Ads API. Your server-side implementation should use the gclid (Google Click ID) to attribute conversions without transmitting patient identifiers.
Step 3: Configure PHI stripping rules on your server layer. Create filters that remove names, email addresses, phone numbers, specific health conditions, treatment types, and appointment details from all data sent to Google. Implement URL parameter filtering to strip service types, provider names, and condition-related keywords. Replace specific values with generic conversion categories like "appointment_scheduled" or "contact_form_completed."
Step 4: Set up compliant conversion events that provide optimization data without exposing PHI. Create conversion actions for high-level goals like "New Patient Inquiry," "Phone Call from Website," and "Appointment Booked" without specifying which service or condition. Assign appropriate conversion values based on average patient lifetime value, not specific procedure costs that might reveal health information.
Campaign Structure for Compliance and Performance
Your Google Performance Max healthcare campaign structure must balance compliance requirements with optimization best practices. At the account level, make sure no healthcare campaign uses remarketing, Customer Match or lookalike segments, which Google's personalized advertising policy bars for ads about health conditions.
Campaign settings require careful configuration to prevent PHI exposure. When creating your Performance Max campaign, immediately disable Final URL Expansion under campaign settings. This prevents Google from automatically sending traffic to URLs you haven't audited for PHI exposure. Set your conversion goals to only include properly configured, PHI-free conversion actions.
Structure your asset groups by service category, not specific health conditions. Instead of creating asset groups for "Diabetes Treatment" or "Addiction Recovery," use broader categories like "Chronic Condition Management" or "Behavioral Health Services." This prevents Google's AI from creating implicit health-condition audiences. Each asset group can hold up to 15 headlines, 5 long headlines and 5 descriptions, plus multiple images and videos.
Configure audience signals carefully in your Google Performance Max healthcare campaign structure. Use geographic targeting, broad demographic data, and general interest categories. Don't upload customer lists: Google does not allow Customer Match for ads about health conditions or their treatment, and patient lists used for marketing need HIPAA authorization. Use Google's in-market audiences and affinity audiences as signals, but never create custom audiences based on specific health-related website behaviors.
Verification and Testing Procedures
Verifying that your Google Performance Max healthcare campaign structure properly protects PHI requires systematic testing. Use browser developer tools (F12 in Chrome) to monitor network traffic when submitting test conversions. Filter network requests for "google" or "doubleclick" and examine the payload of each request to confirm no PHI appears in transmitted data.
Test your conversion tracking by submitting multiple test appointments using fictional PHI (clearly marked as test data). Check your Google Ads conversion reports to verify that no specific health information, patient names, or condition details appear in the conversion data. Examine the conversion paths to ensure URL parameters don't reveal health conditions.
Create an audit trail by documenting your compliance measures in a HIPAA compliance manual. Include screenshots of your disabled URL expansion settings, your server-side tracking architecture diagram, your PHI stripping rules, and your conversion action configurations. This documentation proves due diligence in the event of an OCR audit or patient complaint.
Ongoing monitoring setup is essential because Google regularly updates Performance Max features. Create a monthly calendar reminder to review your campaign settings, checking that URL expansion remains disabled, no new automatic tracking features have been enabled, and your conversion actions still exclude PHI. Subscribe to Google Ads API change logs to receive notifications about new features that might impact compliance.
Campaign Strategies That Convert Patients
Ad Formats and Creative Best Practices for Healthcare
Google Performance Max requires diverse asset types to populate ads across all Google properties. For healthcare advertisers, image assets should showcase your facility, staff, and welcoming environment without showing identifiable patients (unless you have signed HIPAA-compliant photo releases). Include video assets too, since Performance Max also serves ads on YouTube.
Creative best practices for your Google Performance Max healthcare campaign structure focus on trust-building and accessibility. Headlines should emphasize credentials, experience, and patient-focused care rather than specific conditions. Instead of "Expert Diabetes Treatment," use "Experienced Primary Care - Accepting New Patients." Descriptions should address common patient concerns like wait times, insurance acceptance, and telehealth availability.
Compliant messaging frameworks avoid outcome guarantees and unsubstantiated claims. Replace "cure," "guarantee," and "best" with verifiable statements like "board-certified providers," "evidence-based treatments," and "accepting most major insurance." Include clear calls-to-action that don't require revealing health conditions: "Schedule a Consultation," "Call to Learn More," or "Check Insurance Coverage."
Targeting Strategies Without PHI Exposure
Effective targeting in your Google Performance Max healthcare campaign structure relies on audience signals rather than restrictive targeting. Geographic targeting is your most powerful compliant tool: set radius targeting around your practice locations, typically 5-15 miles for primary care and 25-50 miles for specialized services. Performance Max does not support bid adjustments, so add or exclude locations to focus on areas matching your ideal patient profile.
Interest-based targeting through audience signals helps Google's AI find patients without creating health-condition audiences. Use broad wellness interests like "fitness enthusiasts," "healthy living," or "health information seekers" rather than specific condition-related audiences. In-market audiences for "medical services" or "healthcare providers" provide optimization guidance without PHI exposure.
Demographic approaches should focus on age and household income when appropriate for your services. Pediatric practices can target parents with children, while retirement communities can target users 65+. Avoid creating audiences based on website behavior related to specific health conditions, as this creates impermissible health-based audience segments under HIPAA.
Conversion Tracking That Optimizes Without Exposing PHI
Proper conversion tracking in your Google Performance Max healthcare campaign structure requires balancing optimization needs with privacy protection. Track high-level events like phone calls, form submissions, and appointment bookings without specifying the service type or health condition. Create separate conversion actions for different patient journey stages: "Contact Form Submit," "Phone Call - 60+ Seconds," and "Appointment Confirmed."
Assign conversion values based on average patient lifetime value rather than specific procedure costs. Calculate your average new patient value across all services, then use this universal value for all conversion actions. This provides optimization data to Google's AI without revealing which specific services patients sought. For multi-specialty practices, consider using slightly different values for different marketing channels rather than different health services.
Data-driven attribution is the default for most conversion actions and has no minimum volume, though Google recommends at least 200 conversions and 2,000 ad interactions in 30 days for the best accuracy. Practices with low volume can switch a conversion action to last click in its settings for steadier reporting. Never use attribution models that rely on extensive cross-device tracking, as these increase PHI exposure risk by linking multiple patient devices and sessions.
Common Mistakes in Healthcare Performance Max Campaigns
The most frequent error in Google Performance Max healthcare campaign structure is leaving URL expansion enabled. This feature allows Google to send traffic to any page on your domain, including patient portals, condition-specific landing pages, and protected resources. Always disable this feature immediately upon campaign creation.
Custom audience violations occur when healthcare marketers upload email lists obtained during patient interactions without proper marketing consent. Under HIPAA, using patient contact information for marketing requires explicit written authorization separate from treatment consent forms.
Form tracking errors represent another critical mistake. Many healthcare practices implement Google Tag Manager with automatic form tracking triggers, inadvertently sending form field contents including names, phone numbers, and selected appointment types directly to Google.
Conversion tracking misconfiguration often manifests as tracking thank-you page URLs that contain appointment details. URLs like /thank-you?service=substance-abuse-treatment&provider=dr-johnson expose PHI directly in conversion tracking. In July 2023 the FTC and HHS jointly warned about 130 hospital systems and telehealth providers that tracking technologies can expose health data in violation of HIPAA, the FTC Act or the FTC's Health Breach Notification Rule, potentially triggering enforcement from multiple agencies.
Self-Audit Compliance Checklist
- ✓ URL expansion is disabled in all Performance Max campaigns
- ✓ No client-side Google tags fire on form submissions or capture form data
- ✓ Server-side conversion tracking strips all PHI before transmission to Google
- ✓ Conversion action names and descriptions contain no health condition information
- ✓ No custom audiences created from website visitors to condition-specific pages
- ✓ No Customer Match lists on ads about health conditions or their treatment
- ✓ Thank-you page URLs contain no appointment details or health information
- ✓ Dynamic remarketing features are disabled or not configured
- ✓ Asset groups are organized by service category, not specific health conditions
- ✓ Ad copy makes no unsubstantiated outcome claims or guarantees
- ✓ Landing pages are HIPAA-compliant with proper privacy policies and secure forms
- ✓ Monthly compliance audits scheduled to review campaign settings
Simplify Google Performance Max Compliance with Curve
Building and maintaining a compliant Google Performance Max healthcare campaign structure requires constant vigilance, technical expertise, and significant time investment. Every platform update creates new compliance risks, and manual PHI stripping implementations can fail without warning.
Curve automates HIPAA-compliant tracking for Google Performance Max campaigns, keeping PHI out of what Google receives while maintaining the conversion data Google's AI needs for optimization. Curve's team does the setup, most customers are live in about a week, and Curve signs a BAA on every plan. Healthcare practices using Curve keep full campaign performance data while PHI stays out of what Google receives.
Stop worrying about PHI exposure in your Google Ads campaigns. See how Curve automates compliant Google Performance Max tracking and protects your practice from HIPAA violations while maximizing your advertising ROI.
Frequently Asked Questions
What is a Performance Max campaign?
Performance Max (PMax) is Google's most advanced campaign type. It uses AI to run ads across Search, Display, YouTube, Gmail and Discover from a single campaign. You supply asset groups of headlines, descriptions, images and videos, plus audience signals and conversion goals, and Google combines them dynamically to reach people most likely to convert.
How should I structure asset groups for a healthcare Performance Max campaign?
Most healthcare campaigns need 3-5 asset groups segmented by service line or patient intent. Name them by service category, such as "Behavioral Health Services," not by condition, such as "Addiction Recovery," so Google's AI doesn't build implicit health-condition audiences. Each asset group can hold up to 15 headlines, 5 long headlines and 5 descriptions, plus multiple images and videos.
Should healthcare advertisers turn off Final URL Expansion in Performance Max?
Yes. Final URL Expansion lets Google send traffic to pages you didn't specify, including patient portals and condition-specific landing pages you haven't audited. Disable it when you create the campaign and check monthly that it stays off.
How do you track Performance Max conversions in healthcare without sending PHI to Google?
Track high-level actions such as "Appointment Booked" or "Phone Call from Website" with no service or condition in the name, and send them server-side using the gclid instead of firing the Google tag on forms. Curve Compliance handles this setup under a signed BAA, sends Google Ads only a fixed list of fields, and shows in Event Logs what Google accepted.