Healthcare In-Market vs Affinity Audiences: Which Google Ads Segment Converts

Healthcare advertisers running Google Ads face a targeting dilemma that other industries never have to confront: the audience segment that drives the best conversions may also be the one most likely to expose protected health information. The in-market vs affinity healthcare audience decision is rarely about CTR alone, it's about whether your campaign survives an OCR audit. Google's own documentation confirms that in-market segments are built from users' "recent purchase intent" while affinity segments capture long-term passions and habits,^[1] and that distinction maps directly onto patient funnel stages. This guide breaks down which Google Ads audience segments convert better for medical practices, how each interacts with HIPAA tracking rules, and how to configure both for compliant patient acquisition.

Google Ads Audience Segments: A Healthcare Marketer's Overview

Why Google Ads Matters for Patient Acquisition

Google Search captures the moment of patient intent in a way few other channels can. When a prospective patient types "urgent care near me," "ACL repair surgeon," or "fertility clinic reviews," they have moved from passive interest into active research, the exact moment Google's audience system labels them "in-market." Healthcare CPCs in competitive specialties (cosmetic surgery, dental implants, orthopedics, addiction treatment) regularly sit at the high end of paid search, which makes audience selection a budget-discipline issue as much as a targeting one. Every impression spent on a poorly matched segment is one not spent on a real patient.

Google's Healthcare Advertising Policies

Google classifies health as a sensitive interest category in its Personalized Advertising Policy. Covered content includes ^[2]"Physical or mental health conditions, including diseases, sexual health, and chronic health conditions," along with invasive procedures, cosmetic surgery, disabilities, and treatments for intimate body functions. For ads in this category, Google permits predefined Google audiences but blocks advertiser-curated audiences (remarketing lists, Customer Match) from being used for targeting. Custom Segments built with sensitive creative or sensitive landing pages are restricted to Display campaigns serving non-sensitive audiences or contextual placements.

Independently of those policy rules, Google does not sign a HIPAA Business Associate Agreement for Google Ads. Compliance for patient-facing campaigns has to be engineered at the tracking layer, not assumed from the platform.

Key Terminology

• Audience segments: Google's umbrella term for what used to be called "audience types." ^[1]"Audience types" (custom, in-market, and affinity) are now referred to as audience segments, and "remarketing" is now referred to as "your data."
• Affinity segments: Reach users based on what they're passionate about and their long-term habits and interests.
• In-market segments: Reach users based on recent purchase intent, identified from active research behavior.
• Detailed demographics and Life events: Long-term life facts and milestone-based segments (parental status, new mover, recent graduate).
• Targeting vs Observation mode: Targeting restricts ads to the segment; Observation lets ads run normally while reporting performance for that segment.

In-Market vs Affinity Healthcare: The Core Difference

Affinity segments identify people based on sustained interests over time, derived from a holistic picture of lifestyle, habits, and the content they engage with across Google properties and the Display Network.^[3] The official Google example: pair an "outdoor enthusiast" affinity segment with camping-related keywords to reach people who are not only searching for camping products but are also passionate about the great outdoors. The mechanism reaches people based on who they are, not what they're shopping for this week.

In-market segments work the opposite way. ^[4]In-market audiences identify customers who are researching products or services and actively considering a purchase as they browse pages across the web, and are designed to reach consumers close to completing a purchase. Once a user converts, they typically exit the segment.

For healthcare, that distinction maps directly to funnel stage:

• Affinity (top of funnel): A "Health & Fitness Enthusiast" or "Family-Focused" user who reads wellness content and watches workout videos. Useful for brand awareness, less efficient on direct cost-per-conversion.
• In-market (mid-to-bottom of funnel): A user actively researching "physical therapists near me," comparing dental clinics, or pricing LASIK. Higher intent, smaller pool, generally lower CPA.

The Conversion Verdict (When Compliance Is Equal)

When both segments are configured compliantly, in-market generally wins on direct-response metrics for most healthcare verticals. ^[5]In-market segments sit at the "lowest funnel" and represent the highest intent option among Google's pre-made audiences, which typically translates to a higher likelihood of conversion. The same source notes that in-market may not fit products or services with a very short consideration window, the rare case where intent fires too late to matter.

Translation for healthcare verticals running in-market vs affinity healthcare audience tests:

• Urgent care, dental cleanings, primary care, PT, chiropractic: In-market dominates. Patients decide fast.
• Cosmetic surgery, fertility, weight-loss programs, elective orthopedics: Longer consideration windows make affinity layering worthwhile for awareness, with in-market capturing the conversion.
• Med spa memberships, concierge medicine, wellness subscriptions: Affinity-led for lifestyle alignment, in-market for promotion windows.

For a deeper dive on which segments are safe to actually deploy, see Curve's guide on which Google Ads audience segments leak PHI and which are HIPAA-safe.

HIPAA Compliance Deep Dive: How Audience Data Flows

What Google Ads Collects by Default

When a user clicks a Google ad and lands on a healthcare website running a standard tag, several data points travel back to Google: click ID (gclid), IP address, device identifiers, cookie IDs, URL parameters, and any form-field values captured by the page. Each of these can combine with the context of a healthcare site to create a record that identifies an individual in connection with health care, the regulatory definition of PHI.

PHI Exposure Risks by Audience Type

The audience type you choose changes what data gets implicated:

• Affinity targeting on Display/YouTube: Lower direct PHI risk because Google is matching users on their long-term interest profile, not your site behavior. The exposure point is still your landing page tracking, not the audience signal itself.
• In-market targeting: Slightly higher contextual risk because in-market signals are derived from recent health-adjacent search behavior. When combined with a landing page that reveals a condition (e.g., "/addiction-treatment/"), the gclid + URL + IP combination can constitute PHI.
• Remarketing ("your data"): Highest risk. Patient-facing remarketing lists are built from site behavior that can itself disclose condition or treatment interest. Google's own Personalized Advertising policy^[2] blocks advertiser-curated audiences for sensitive health content as a policy matter, separate from HIPAA.
• Customer Match / Lookalike seeds: The process of creating lookalike audiences from patient lists discloses sensitive medical information to a platform without a BAA.

OCR Guidance on Tracking Technologies

^[6]OCR has stated that regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules, and that OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies. ^[7]OCR's updated guidance also clarifies that when a tracking technology vendor will not sign a BAA, a regulated entity can establish a BAA with another vendor, such as a Customer Data Platform, that will de-identify online tracking information before it reaches the ad platform.

That third-party de-identification model is the architectural basis for compliant in-market and affinity campaigns: the audience signal itself stays with Google, but the conversion data flowing back is sanitized.

Compliant vs Non-Compliant Audience Features

• Standard Google Ads pixel/tag: Not compliant. Transmits IP, click ID, and any URL/form values by default.
• In-market segments (Search, observation mode): Can be compliant when paired with server-side conversion tracking that strips PHI.
• Affinity segments (Display/YouTube, observation mode): Can be compliant with the same safeguards. Lower PHI risk profile because the targeting is interest-based, not behaviorally derived from your site.
• Remarketing ("your data"): Generally not compliant for patient-facing campaigns, and blocked by Google policy for sensitive health content.
• Customer Match from patient lists: Not compliant without de-identification.
• Lookalike/Similar segments built on patient data: Not compliant.
• Custom Affinity from competitor URLs / non-PHI interest signals: Lower risk; acceptable with proper conversion sanitization.

Step-by-Step Compliant Setup for In-Market vs Affinity Healthcare Campaigns

Pre-Implementation Audit

1. Inventory every tag, pixel, and tracking script on your site. Note where the global site tag, Google Ads conversion linker, and any GTM containers fire.
2. Identify pages that reveal condition or treatment context (service pages, blog posts about specific diagnoses, intake forms).
3. Document what form fields, URL parameters, and event payloads currently transmit to Google.
4. Confirm BAA status with every vendor in the data chain.

Compliant Tracking Configuration

1. Remove or restrict the standard Google Ads tag from any URL path that reveals a condition, treatment, or provider specialty.
2. Implement server-side conversion tracking via the Google Ads API, sending only de-identified events.
3. Strip PHI before transmission: name, email, phone, IP, condition-specific URL parameters, and any form values must be sanitized or hashed in a HIPAA-compliant intermediary.
4. Use Enhanced Conversions only through a BAA-covered intermediary. Server-side conversion transmission that strips identifiers before data reaches Google is the architecture that lets you benefit from Google's machine learning without exposing PHI.

Curve handles steps 2 through 4 with a no-code installation that replaces 20+ hours of engineering work and provides the BAA required for the de-identification layer. For a detailed breakdown of the architecture, see how server-side Google Ads conversion tracking works for healthcare.

Campaign Structure for In-Market vs Affinity

For in-market healthcare campaigns:

• Start in Observation mode rather than Targeting mode. ^[5]Observation lets you gather data and insights for an in-market segment in Search, Shopping, and Display campaigns without restricting who sees your ads.
• Layer in-market segments onto Search campaigns first, since Search captures explicit intent.
• Avoid combining in-market segments with sensitive keywords in the same ad group; isolate so you can attribute performance cleanly.

For affinity healthcare campaigns:

• Deploy on YouTube and Display for awareness funnels.
• Use predefined lifestyle segments (Health & Fitness Enthusiasts, Family-Focused, Green Living Enthusiasts) rather than building Custom Affinity from URLs that imply condition-specific interest.
• Pair with geographic targeting based on service areas, not patient ZIP-level data.

Verification and Testing

1. Use the Google Tag Assistant and a packet inspector to verify no PHI fields are transmitted on form submission.
2. Confirm URL parameters with condition keywords are stripped from the page_location field.
3. Run test conversions and inspect the payload reaching Google's endpoint.
4. Document the data flow in your HIPAA risk analysis. OCR's enforcement priority on Security Rule compliance means this documentation is the first thing investigators will request.

Campaign Strategies That Convert Without PHI Exposure

Ad Formats and Creative

For in-market campaigns, Responsive Search Ads with location extensions and call extensions consistently outperform static formats for healthcare. Call tracking through Google forwarding numbers can capture that a call occurred, its duration, and the keyword that triggered it without recording the content of the conversation, but call recording or transcription features must be disabled if calls may contain PHI. For affinity campaigns on YouTube, 15-second bumper ads and 30-second skippable formats work for brand awareness without requiring patient-specific creative.

Targeting Without PHI

Compliant audience strategies for in-market vs affinity healthcare campaigns rely on three building blocks: geographic targeting based on service areas (not patient-specific locations), keyword-based targeting for healthcare services (not condition-specific remarketing), and interest-based audiences that do not rely on protected health information. Practical rules:

• Target intent keywords like "physical therapist near me" rather than condition-specific behavioral audiences.
• Use radius targeting around clinic locations.
• Layer detailed demographics (parental status, household income range) where relevant and permitted.
• Avoid building Custom Segments from URLs of competitor pages that reveal patient conditions.

For specialty-specific tactics, see how PT practices use in-market audience targeting to fill schedules and when chiropractors should choose Local Service Ads vs Search campaigns.

Conversion Tracking Done Right

Track these compliantly via server-side: form-submission events (count only, no field data), call-click events, appointment-booking page views, and direction requests. Pass de-identified conversion values that reflect average patient lifetime value by service line, not individual patient data. For multi-location practices, use offline conversion imports from booking confirmations with PHI stripped at the import layer.

Common Mistakes Healthcare Advertisers Make

• Using Targeting mode before Observation data is collected. Restricting reach to an in-market segment before validating its performance wastes budget and limits Smart Bidding's learning.
• Placing standard pixels on condition-specific pages. A standard Google Ads tag on a URL like "/depression-treatment/" can associate a user's device with a particular medical concern, the textbook PHI disclosure pattern OCR has cited in tracking-technology investigations.
• Importing CRM-based offline conversions without de-identification. Direct EHR-to-Google imports send patient identifiers tied to appointment status, which is PHI by definition.
• Building lookalikes from a patient list. This shares PHI with a non-BAA vendor by design.
• Treating in-market as automatically safer than remarketing. The audience signal itself is lower-risk, but the conversion data flowing back is what creates exposure. Both require server-side sanitization.
• Ignoring enforcement risk because penalties seem small. ^[8]OCR publishes resolution agreements and civil money penalties imposed on regulated entities ranging from small practices to major hospital systems, with settlements regularly reaching six and seven figures. ^[9]Beyond OCR fines, regulated entities also face class action litigation related to tracking technologies, with numerous suits filed against providers alleging damages from tracking pixel use.

Self-Audit Checklist

• Is the standard Google Ads tag removed from condition/treatment pages?
• Are conversions transmitted server-side through a BAA-covered intermediary?
• Are gclid, IP, and URL parameters sanitized before reaching Google?
• Are all in-market and affinity segments running in Observation mode initially?
• Are remarketing lists excluded from patient-facing campaigns?
• Is the data flow documented in your HIPAA risk analysis?

FAQ

Is Google Ads advertising HIPAA compliant for healthcare?

Google Ads is not HIPAA compliant out of the box. Google does not sign a BAA for Google Ads, so any campaign that transmits PHI to Google creates a HIPAA violation. Healthcare practices can run compliant Google Ads campaigns by removing standard pixels from sensitive pages, using server-side conversion tracking through a BAA-covered intermediary that de-identifies data, and avoiding remarketing or lookalike audiences built from patient data.

How do I set up compliant Google Ads conversion tracking?

Replace the client-side Google Ads tag with server-side conversion transmission through the Google Ads API. The server-side layer must strip PHI (name, email, phone, IP, condition-specific URL parameters) before data reaches Google. ^[7]OCR explicitly endorses using a BAA-covered vendor to de-identify online tracking information before disclosure to a tracking technology vendor that will not sign a BAA itself.

Can healthcare practices use Google Ads remarketing?

Patient-facing remarketing is generally not HIPAA compliant because the remarketing list is built from website behavior that may reveal condition or treatment interest. Google's Personalized Advertising policy^[2] also restricts advertiser-curated audiences for sensitive health content, blocking the use case at the platform level for most consumer health categories.

Should healthcare advertisers use in-market or affinity audiences?

For direct response and patient acquisition, in-market audiences generally convert better, especially in verticals with short consideration cycles. Affinity audiences perform better for awareness, brand-building, and longer-consideration services like cosmetic surgery or fertility. Both can be deployed compliantly as long as the conversion tracking layer strips PHI before data reaches Google.

What are the penalties for Google Ads HIPAA violations?

^[10]Civil monetary penalties for HIPAA violations are tiered based on culpability and adjusted annually for inflation. Beyond OCR fines, healthcare advertisers face FTC enforcement under the Health Breach Notification Rule and a growing wave of class action litigation over tracking pixel use.

Simplify Google Ads Compliance with Curve

Stop worrying about whether your in-market or affinity campaigns are leaking PHI. Curve provides the server-side tracking, automatic PHI stripping, and signed BAA that turn Google Ads into a HIPAA-compliant patient acquisition channel, with a no-code install that saves 20+ engineering hours. See how Curve automates compliant Google Ads tracking.

Sources

1. Google Ads Help, About audience segments
2. Google Advertising Policies Help, Health in personalized advertising
3. Google Ads Help, About affinity segments
4. Display & Video 360 Help, In-market audience targeting
5. Search Engine Land, Google Ads In-Market Segments guide
6. HHS OCR, Use of Online Tracking Technologies bulletin
7. Covington Inside Privacy, HHS OCR Updates Tracking Technologies Guidance
8. HHS, Resolution Agreements and Civil Money Penalties
9. Dentons Health Law, HHS-OCR Revised Tracking Technologies Guidance
10. HIPAA Journal, Penalties for HIPAA Violations