HIPAA-Compliant Google Ads: The 2026 Guide for Healthcare

Google Ads can be run in a HIPAA-compliant way, but Google won't take on HIPAA obligations for you: it doesn't offer a BAA for Google Analytics, and it tells covered entities not to accept the terms for its Google Ads call features. HIPAA-compliant Google Ads comes down to three things: no protected health information in what your website sends Google, audiences that follow Google's Health in personalized advertising rules, and ads and landing pages that meet the Healthcare and medicines policy, including certification where Google requires it. Curve Compliance handles the tracking side, sending Google Ads conversions server-side with neutral event names and PHI-like patterns flagged before anything leaves, under a BAA on every plan.

Book a call. Curve Compliance replaces the Google tag on your healthcare site with server-side conversion tracking for Google Ads, Meta, TikTok, Microsoft and LinkedIn, keeps attribution through booking tools, and signs a BAA on every plan. Book a call with Curve.

Does Google sign a BAA for Google Ads?

No. Google says it does not offer Business Associate Agreements for Google Analytics, and for Google Ads call features it goes further. Its Call Ads Supplemental Terms say: "Unless otherwise specified in writing by Google, Google does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act," and that a covered entity or business associate that wants to use them "should not accept these Supplemental Terms" (Google Ads Help). So the work is keeping PHI out of what Google receives, not getting Google to cover it. See Google Ads in the BAA Directory.

1. Tracking: keep PHI out of what Google receives

The default Google tag runs in the visitor's browser and sends Google the page address, the page title and the event with every conversion. On a clinic site those can name a condition, a treatment or a booking for a specific service, which is exactly what the HHS guidance on online tracking warns about for booking and intake pages. The compliant pattern is to remove the tag from those pages and send conversions from a server instead, with a neutral event name and no page details that reveal care.

Curve Compliance does that for Google Ads: one script replaces the Google tag, conversions go to Google Ads from Curve's servers with a fixed list of fields, and PHI-like patterns such as a condition in a URL are flagged so they can be stopped at the source. Bookings in IntakeQ, Calendly, Jane and other schedulers keep the ad click, so Google still learns which campaigns book patients. For the mechanics, see whether Google Ads conversion tracking is HIPAA compliant and offline conversions for patient appointments.

2. Targeting: Health in personalized advertising

When Google decides an ad promotes something in its Health category, the campaign can't use advertiser-curated audiences: Customer Match, your data segments (what Google used to call remarketing), audience expansion and lookalike segments. Keywords and Google's predefined audiences still work. If an ad is flagged, remove those audiences and Google reviews it again. The full walkthrough is in what the Health in personalized advertising notice means.

3. Ads and landing pages: Healthcare and medicines

Healthcare and medicines is Google's umbrella policy for health advertising. In the US, Google allows telemedicine providers accredited by LegitScript's Healthcare Merchant Certification Program who are also certified with Google, and prescription drug names as keywords only for certified advertisers. Addiction treatment has its own certification. When an ad is disapproved, find the sub-policy Google named and fix that specific thing. See Healthcare and medicines disapprovals and the Ad Account Rescue hub for every other notice.

4. Calls

Phone calls are often a clinic's best conversion, and Google's own call features come with the HIPAA disclaimer above. Use a call tracking provider that signs a BAA, such as CallRail on its Healthcare plans, and send the call outcome to Google Ads server-side without recordings or patient details. Curve Compliance credits call outcomes from call tracking to the original ad click.

A HIPAA-compliant Google Ads checklist

1. Scan the site. Curve Compliance's free website scan lists every pixel and tracker on a page, including the Google tag.
2. Move conversions server-side. Remove the Google tag from booking, intake and condition pages and send conversions from a server under neutral names.
3. Sign the BAAs that exist. Your tracking vendor, call tracking and scheduler should sign one. Google Ads isn't covered, so Google must receive no PHI.
4. Rebuild audiences. Drop Customer Match, your data segments, audience expansion and lookalikes from Health campaigns; use keywords and predefined audiences.
5. Check certification. Telemedicine, online pharmacy, prescription drug terms and addiction treatment need the certification Google names.
6. Measure bookings in your own reporting. Campaign Reporting in Curve Compliance puts Google Ads spend next to booked appointments for each campaign.

Book a call. Curve's team will check what your site sends Google today and set up HIPAA-compliant conversion tracking that keeps your campaigns optimizing. Book a call with Curve.

Frequently Asked Questions

Is Google Ads HIPAA compliant?

Google Ads is not covered by a BAA, so it must receive no protected health information. Run it in a HIPAA-compliant way by sending conversions server-side with neutral event names, following Google's Health in personalized advertising rules, and getting the certification Google requires for your services. Curve Compliance handles the tracking side under a BAA on every plan.

Does Google sign a BAA for Google Ads?

No. Google says it does not intend its Google Ads call features to create HIPAA obligations and tells covered entities not to accept those terms, and it does not offer BAAs for Google Analytics.

Can healthcare advertisers use remarketing on Google Ads?

Not for ads Google classifies as Health. Customer Match, your data segments, audience expansion and lookalike segments are not allowed; keywords and Google's predefined audiences are.

Is the Google tag HIPAA compliant on a clinic website?

Not on pages that reveal care, such as booking, intake or condition pages, because it sends the page address and title to Google from the browser. Replace it there with server-side conversion tracking.

How does Curve Compliance work with Google Ads?

Curve Compliance replaces the Google tag with one script, sends conversions to Google Ads from its servers with a fixed list of fields and neutral event names, keeps attribution through booking tools and call tracking, and signs a BAA on every plan. Setup is done by Curve's team, typically in about a week.