Healthcare Performance Max Campaigns: PHI Risks and the 2026 Audit Framework

Google's Performance Max combines Search, YouTube, Display, Discover, and Gmail inventory into a single AI-driven campaign type, and healthcare advertisers are pouring budget into it. The problem: PMax automation collects and transmits user signals that can constitute protected health information under HIPAA, exposing covered entities to penalties that, as adjusted annually for inflation, can reach into the millions per violation category per year.^[1] Performance Max healthcare PHI exposure is now a top OCR enforcement priority heading into 2026, with the Office for Civil Rights flagging website tracking technologies as a continuing area of scrutiny.^[2] This guide covers the PMax-specific risks, the 2026 audit framework, and the configuration steps that keep your campaigns running without triggering a breach notification.

Performance Max for Healthcare: Platform Overview

Why Performance Max Matters for Healthcare Advertisers

Performance Max has shifted from experimental to a core Google Ads campaign type. It blends media placement inventory across Search, YouTube, Display, Discover and Gmail into a single, automation-heavy campaign type. For healthcare practices, that means a single PMax campaign can drive new-patient inquiries from a search for "knee replacement near me," a YouTube viewer researching a chronic condition, and a Discover feed user browsing health content, all under one budget and bid strategy.

The reach is the appeal. The exposure is the problem. Used carelessly, PMax can quietly show ads in contexts you'd never sign off on manually, and the conversion signals feeding Google's AI often include data points that qualify as PHI when collected by a covered entity.

Google's 2026 Healthcare Advertising Policies

Google's Healthcare and medicines policy restricts what can be promoted, by whom, and where. Some types of healthcare-related content can't be advertised at all, while others can only be advertised in certain locations by advertisers who have applied and been approved.^[3] For most healthcare policies, if your ad campaign targets allowed locations and the domain is properly certified, your ad will be labeled "Eligible (limited)" and can run in allowed locations.

Key 2026 considerations for PMax planning:

• Personalization restrictions remain: Google prohibits targeting or personalizing ads based on inferred or declared medical conditions, diseases, or health status under its personalized advertising policy.
• HCP and pharma certifications: Healthcare professional targeting and prescription drug advertising remain available only to certified advertisers in eligible jurisdictions.
• Shopping enforcement: Google continues to tighten product feed eligibility for healthcare advertisers, with manual reviews and certification gating.

Platform Terminology Healthcare Marketers Need

• Asset Groups: The PMax equivalent of ad groups, where you bundle creatives (images, text, videos) for different services or patient types. Google's AI decides how much of your budget to spend on each group.
• Audience Signals: Optional inputs (customer lists, custom segments, in-market signals) that suggest who to target. PMax may serve beyond these signals.
• Final URL Expansion: Allows Google to send traffic to URLs beyond your stated landing page. A compliance risk for healthcare.
• Enhanced Conversions: A feature that supplements your existing conversion by sending hashed first-party conversion data from your website tags or imported offline events to Google. The feature uses a secure one-way hashing algorithm called SHA256 on your first-party customer data, such as email addresses, before sending to Google.^[4] Hashing alone does not de-identify PHI under HIPAA.
• Customer Match: Patient list uploads used as audience signals. High PHI risk without a BAA.

HIPAA Compliance Deep Dive: Where Performance Max Healthcare PHI Risks Emerge

How Data Flows Through Performance Max

A typical PMax conversion path involves three data layers: the Google tag (gtag.js) on your site, the conversion event fired on a thank-you or appointment page, and any enhanced conversion data the tag captures from form fields. Automatic detection lets the tag identify user-provided data fields on your conversion page (email, phone) and send hashed data. You can also specify CSS selectors or JavaScript variables to manually identify which page elements contain email/phone, or add a code snippet that sends hashed customer data when conversion happens.

Every one of these paths can transmit PHI. Hashing changes the format; it does not change the legal status. Under HIPAA, identifiers tied to a service that reveals treatment, diagnosis, or payment for care remain PHI whether they are plaintext or SHA-256 hashed.

PHI Exposure Points Specific to PMax

• Auto-detected form fields: The Google tag pulls email, phone, and name from intake or appointment forms. When that form is on a page indicating a specific service line (e.g., "schedule oncology consult"), the combination becomes PHI.
• URL parameters: Service-specific URL paths (/cardiology/book) sent as conversion event metadata can disclose treatment context.
• Customer Match uploads: Uploading a patient list to seed audiences sends hashed identifiers tied to your status as a healthcare provider, an inherent PHI disclosure.
• Remarketing tags: First-party cookies set on condition-specific pages create remarketing audiences that, by definition, segment users by health interest.
• IP and device IDs: Captured by default in every gtag firing. OCR's guidance specifically calls out cookies, web beacons, pixels, session replay scripts, fingerprinting scripts, and mobile device identifiers as tracking technologies that can transmit PHI.^[2]

The Legal Backdrop: What Changed in 2024 and What Didn't

The regulatory picture shifted significantly. On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated a portion of OCR's online tracking guidance. OCR initially appealed but withdrew the appeal on August 29, 2024.^[5] The vacated portion (the "Proscribed Combination") was the rule that IP address plus a visit to an unauthenticated condition page automatically equals PHI.

What survives is more important for PMax advertisers. The court did not vacate those portions of the bulletin discussing the risk of impermissible disclosures resulting from tracking technologies on user-authenticated websites such as patient portals, or other combinations of identifiable health information on unauthenticated public webpages.^[2] Translation: form submissions, authenticated portal events, and any identifier paired with treatment context still trigger HIPAA.

OCR's scrutiny of the use of tracking technologies is expected to continue, and regulated entities are reminded of the need to establish a business associate agreement with online tracking technology vendors that collect PHI and to ensure compliance with the HIPAA Security Rule when using online tracking technology. Google does not sign BAAs for Google Ads. That single fact drives every recommendation in the rest of this guide.

Compliant vs. Non-Compliant PMax Features

• Standard Google tag (gtag.js) on conversion pages: Not compliant. Auto-detects form data and sends IP, user agent, and device identifiers to Google without a BAA.
• Google Ads API server-side conversion import (filtered): Can be compliant when a HIPAA-compliant intermediary strips PHI before transmission and signs a BAA with the covered entity.
• Enhanced Conversions with raw PII auto-detection: Not compliant for healthcare. Google's own documentation cautions against use cases involving healthcare-related information.
• Remarketing / Customer Match from patient lists: Not compliant. Creates audiences directly tied to PHI.
• Customer Match from de-identified marketing lists: Possible only with rigorous de-identification under 45 CFR 164.514.
• Final URL Expansion in PMax: Risky. Sends traffic to non-vetted URLs that may include condition-specific landing pages.

The 2026 Performance Max Healthcare PHI Audit Framework

Step 1: Pre-Implementation Audit

Before touching campaign settings, document what your current stack actually transmits. Run a tag inventory across every page Google's crawler can reach, especially appointment and intake forms. A healthcare pixel audit should capture: every conversion event, every form field auto-detected by the Google tag, every URL parameter sent with conversions, every customer list uploaded to Google Ads in the past 24 months, and every BAA (or absence of one) with vendors touching that data.

The audit must align with OCR's stated enforcement priority: ensuring that tracking technologies are addressed in regulated entities' HIPAA risk assessments and that the risks associated with such technologies have been identified, assessed, and mitigated.^[2]

Step 2: Compliant Tracking Configuration

1. Disable auto-detection of user-provided data in your Google tag settings. In Google Ads, go to Tools, then Conversions, choose the conversion action, expand Enhanced conversions, and turn off automatic collection.
2. Route conversions through a HIPAA-compliant server-side intermediary that signs a BAA, strips PHI before forwarding events to the Google Ads API, and logs every transmission for audit. This is the architectural pattern Curve uses.
3. Replace direct Customer Match uploads with audiences built from de-identified, non-patient marketing data.
4. Configure conversion events to send only non-PHI signals: event name, conversion value, anonymous click ID (GCLID), and a hashed transaction identifier generated downstream from the form submission.
5. Reject the "set and forget" temptation. Re-audit quarterly because Google's tag behavior updates frequently. Enhanced conversions for web and leads are being consolidated into a single on/off setting, and Google Ads will simultaneously accept user-provided data from website tags, Data Manager, and API connections, raising the risk of accidental PHI passthrough if controls are not re-verified.

Step 3: PMax Campaign Structure for Compliance

The campaign settings themselves matter. For a compliant build:

• Turn Final URL Expansion OFF for any campaign promoting a regulated service line, or restrict it to only your most relevant, pre-approved landing pages.
• Disable auto-created assets in restricted campaigns where copy must go through medical, regulatory and legal (MLR) review. Lock down approved text assets (headlines, descriptions, sitelinks) and store them in your content management ecosystem.
• Apply URL exclusions to keep ads off careers pages, privacy policies, and condition-specific blog content that could create unintended audience segments.
• Structure asset groups by service line, not by condition. Think of each asset group as a mini-campaign focused on a particular audience or service. For multi-location practices, our Performance Max for med spas multi-location strategy walks through this in more detail.
• Use precise location targeting and exclude geographies where you're not certified.

Step 4: Verification and Ongoing Monitoring

Use Tag Assistant to verify what data actually fires. Tag Assistant is a tool that lets you verify your conversion actions directly on your website from your Google Ads account.^[6] Look specifically for the tv.1~em. parameter in network requests. If anything other than a hashed value or a documented error code appears there, you have a PHI exposure to remediate.

For the structural side of conversion design, our compliant Performance Max campaign structure guide covers conversion action hierarchy in depth.

Strategies That Convert Without PHI

Ad Types and Creative Frameworks

Healthcare PMax works best when creative is precise, professional, and free of language Google's automated review flags as personalization. Lead with the service, the credential, and the location. Avoid second-person condition references like "your symptoms" or "your diagnosis," which trigger personalized-advertising policy violations.

Targeting Without Performance Max Healthcare PHI Leakage

Build audience signals from non-health data: ZIP code clusters, language, in-market signals for general categories (not condition-specific), and custom segments based on competitor and service-category searches. Never use uploaded patient lists for Customer Match. Never build remarketing audiences from condition-specific page visits.

For sports medicine and orthopedic practices, where performance claims add another layer of risk, see our guide on sports medicine athlete-focused campaigns and performance claims compliance.

Conversion Tracking Done Right

Track value-based conversions through a server-side path: form submission triggers a webhook to your compliant intermediary, which assigns a non-PHI conversion ID, strips identifying fields, and forwards an event to the Google Ads API with only the GCLID, event timestamp, and assigned conversion value. Match rate suffers slightly compared to enhanced conversions, but the legal status is defensible.

Common PMax Mistakes That Trigger Enforcement

• Leaving Enhanced Conversions on by default. Auto-detection scrapes email and phone fields from forms on condition-specific pages.
• Uploading patient lists for Customer Match. The act of uploading a list of your patients to a vendor without a BAA is itself an impermissible disclosure.
• Allowing Final URL Expansion. Sends traffic and conversion signals to URLs you haven't vetted for PHI exposure.
• Trusting hashing as de-identification. SHA-256 is one-way mathematically, but PHI status is determined by what the data represents, not how it's encoded.
• Skipping the risk analysis. Failing to monitor client-side scripts or to enforce tag manager governance can be characterized as willful neglect, the most serious penalty classification.
• Assuming the AHA v. Becerra ruling resolved everything. It narrowed one specific scenario. Authenticated pages, form submissions, and disease-specific mobile app data all remain firmly within HIPAA's scope.

Self-Audit Checklist for Q1 2026

• Tag inventory: Documented list of every Google tag, gtag firing, and conversion event by URL.
• Enhanced Conversions status: Confirmed OFF or routed through a BAA-covered intermediary.
• Customer Match audit: No patient lists uploaded in the past 24 months; any historical uploads documented in your breach analysis.
• BAA file: Signed BAA with every vendor that touches conversion data destined for Google.
• Final URL Expansion: Disabled on all healthcare PMax campaigns.
• URL exclusions list: Updated to block condition-specific blog and policy pages.
• Risk analysis: Tracking technologies explicitly addressed in your HIPAA Security Rule risk analysis.
• Landing page review: Forms on intake pages do not auto-populate PMax with PHI. See our landing page builder compliance review for builder-specific risks.

FAQ: Performance Max Healthcare PHI Compliance

Is Google Performance Max HIPAA compliant for healthcare advertisers?

Performance Max itself is not HIPAA compliant out of the box because Google does not sign a Business Associate Agreement for Google Ads. The decision in AHA v. Becerra did not give providers, business associates, or vendors carte blanche to use or disclose protected health information for purposes not permitted by HIPAA. Compliant use requires a server-side architecture where a BAA-covered intermediary strips PHI before any data reaches Google's servers.

How do I set up compliant Performance Max conversion tracking?

Disable Enhanced Conversions auto-detection, disable Final URL Expansion, and route every conversion event through a server-side endpoint that filters PHI before forwarding only non-identifying signals (GCLID, event name, conversion value) to the Google Ads API. Verify with Tag Assistant that no user-provided data appears in the em parameter of conversion pings.

Can healthcare practices use Performance Max remarketing?

Generally no. Remarketing audiences built from visits to condition-specific pages or from patient list uploads constitute disclosure of PHI to Google. Regulated entities may not share PHI with tracking technology vendors absent a business associate agreement. The narrow exception is remarketing built exclusively from de-identified, non-patient marketing data.

What are the penalties for HIPAA violations on Google Ads campaigns?

Penalties scale by culpability tier and are adjusted annually for inflation under federal civil monetary penalty rules.^[1] Tiered penalties can reach into the millions per violation category per year, and website violations multiply quickly across pages, tools, and time. OCR also pursues corrective action plans, mandatory monitoring, and breach notification costs.

Does the 2024 court ruling mean I can use the Google tag freely on healthcare websites?

No. Providers, their business associates, and vendors who may use tracking technologies must still be cautious. Although an IP address coupled with information that a person visited a website may not be individually identifiable health information as suggested by the vacated guidance, HIPAA will still apply if a person's health information is collected along with individually identifiable data.^[2] Form submissions, authenticated portal interactions, and disease-specific mobile app data all remain protected.

Simplify Performance Max Compliance with Curve

Stop worrying about PHI exposure in your PMax conversion stack. See how Curve automates compliant Performance Max tracking with server-side PHI stripping, signed BAAs, and no-code implementation that replaces 20+ hours of manual setup.

Sources

1. Annual Civil Monetary Penalties Inflation Adjustment - Federal Register (HHS)
2. HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
3. Google Ads Healthcare and Medicines Policy
4. About Enhanced Conversions - Google Ads Help
5. OCR Withdraws Appeal of District Court Order - Epstein Becker Green Health Law Advisor
6. About the Enhanced Conversions for Web Tag Diagnostics Report - Google Ads Help