Google Tag Manager HIPAA Migration Checklist for Telehealth

To move Google Tag Manager from client-side to server-side on a telehealth site, inventory every tag, find the ones that fire on pages or events that can carry health information, check each vendor's BAA status, then build, filter and test a server container that forwards only what each vendor should get. A server container controls where data goes. It does not make Google or an ad platform your business associate. Curve Compliance is the managed route: it replaces the ad pixels with one script, sends conversions server-side under a BAA it signs on every plan, and Curve's team does the setup.

For building the container itself, see the server-side GTM setup guide for healthcare.

Book a call. Curve's team will review what your telehealth site sends to Meta, Google and TikTok today and set up server-side conversion tracking with a fixed list of fields per platform. Book a call with Curve.

What HHS says about tracking technologies today

The HHS Office for Civil Rights bulletin Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates now opens with a note about a court ruling. On June 20, 2024, the U.S. District Court for the Northern District of Texas, in American Hospital Association v. Becerra, vacated one part of the guidance: the part saying HIPAA obligations are triggered when an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. HHS says it "is evaluating its next steps in light of that order." The page was last reviewed on June 26, 2024. The rest of the bulletin is still there, and most of it bears on a telehealth funnel:

• Logged-in pages. Tracking on user-authenticated pages "generally" has access to PHI, and HHS names "a telehealth platform" as an example of such a page.
• Scheduling and symptom checkers. Tracking on these pages "may have access to PHI in certain circumstances," such as a reason for care the visitor types or selects.
• Vendors. A tracking vendor that receives PHI on your behalf is a business associate and needs a BAA. HHS calls it "insufficient" for a vendor to agree to remove or de-identify PHI after it receives it.
• Cookie banners. Accept or reject banners "do not constitute a valid HIPAA authorization."
• Vendors that will not sign. HHS describes a BAA with another vendor, such as a customer data platform, that de-identifies the data and passes only de-identified information to vendors that will not sign one.

That last point is the pattern a server-side migration follows: a party with a BAA receives the raw event first. Which pages are HIPAA-covered is a call for your legal team. Google's HIPAA and Google Analytics help page gives the same advice.

What a server-side container changes, and what it does not

Google's introduction to server-side tagging says a server container "doesn't run in the user's browser or on their phone. Instead, it runs on a server that you control," and "only you have access to the data in the server until you choose to send it elsewhere."

Question	Client-side web container	Server-side container
Where do tags run?	In the visitor's browser, sending to each vendor directly	On a tagging server you host, in Google Cloud or another environment you choose
Can you remove fields before a vendor sees them?	Only tag by tag	Yes. Transformations "include, exclude or modify event parameters" before tags see them
Which vendors work out of the box?	The tags you add	Google Analytics and Measurement Protocol clients and a Google Analytics tag. Other ad platforms need their own server tags
Hosting BAA	Not applicable	Google Cloud says it "enters into Business Associate Agreements as necessary under HIPAA" and lists Cloud Run and App Engine as covered products
Who maintains it?	Your team, in Tag Manager	Your team, in Tag Manager and the cloud project. Google's Cloud Run guide recommends "a minimum of 2 instances"

So the container is a control point, not compliance on its own. Its tags still send what you configure, and a vendor that receives PHI still needs a BAA. Google's Tag Manager Use Policy says not to upload "any data to Google Tag Manager that personally identifies an individual," and Google Cloud calls complying with HIPAA "a shared responsibility." See why server-side tracking alone is not HIPAA compliance.

The client-side to server-side migration checklist

1. Scan the live site. The free Curve Compliance scanner lists the pixels and trackers on a page. Run it on the homepage, a treatment page, intake, booking and the confirmation page, and keep the results as your baseline.
2. Export the web container. Admin, then Export Container, downloads a JSON file with the container's tags, triggers and variables, as Google's export help page describes. List each tag, its vendor, its trigger and the variables it reads.
3. Walk the funnel in Preview mode. Preview and debug mode shows which tags fired on each page and what triggered them. Go through intake and booking as a test patient.
4. Flag variables that read health information. Full page URLs, page titles, query strings, form fields and data layer values such as a medication or a quiz answer are how a condition ends up in a tag. See where telehealth intake funnels leak.
5. Sort pages by the HHS categories. Use the table below, and settle borderline pages with your legal team.
6. Check each vendor's BAA status. Google says it does not offer a BAA for Google Analytics. Curve's BAA Directory found no public statement about one for Google Tag Manager. Google Cloud signs one for its listed services. Vendors without a BAA should get only data with the health information already removed.
7. Decide what each destination receives. Use neutral event names such as "lead" or "booking_complete", and leave out page paths, page titles and form answers on sensitive steps. An allowlist is easier to defend than a blocklist, because a new field stays out until someone adds it.
8. Build the server container. Provision it automatically from Tag Manager or manually in Google Cloud, as the Cloud Run setup guide describes. Google's server-side introduction says to set it up "on your first-party domain and enable production mode" before going live, and to point events at it with the server_container_url option. Sign the hosting BAA before real traffic flows.
9. Add transformations and server tags. An Allow parameters transformation lets each tag see only the fields on your list. Add a server tag for each ad platform you keep, mapped to your neutral event names.
10. Cut over, retest and keep watching. Remove the browser tags from sensitive pages, then repeat steps 1 and 3. Record the change in your Security Rule risk analysis, which HHS says should address tracking technologies. Re-scan whenever a page or a tag changes.

Telehealth pages to check first

Page or step	What a tag there can pick up	What the HHS bulletin says
Patient portal or telehealth visit (logged in)	Appointment dates, record numbers, diagnosis, prescription and billing details	Tracking generally has access to PHI
Online scheduling	Appointment details and a typed or selected reason for care	May have access to PHI in certain circumstances
Intake quiz or symptom checker	Symptoms entered for a health analysis	May have access to PHI in certain circumstances
Portal login or registration	Login details, name and email address	Collecting them is a disclosure of PHI
Condition or treatment pages	The visit and the visitor's IP address	The court vacated this part; HHS is evaluating its next steps
Careers, locations, visiting hours	A general visit with no health context	Not regulated by HIPAA where tracking has no access to PHI

Where a managed option like Curve Compliance fits

Server-side GTM gives you a control point that your team hosts, filters and maintains, with a server tag per platform and a BAA with the host. Curve Compliance is the managed version of the same idea: Curve signs a BAA, receives the events, and sends each ad platform only a fixed list of fields.

Checklist item	Server-side GTM you run	Curve Compliance
BAA with the service that receives your events	With your cloud host, such as Google Cloud	Curve signs a BAA on every plan
What each ad platform receives	Transformations you write and maintain	A fixed list of fields per platform, neutral event names, and contact identifiers off by default and SHA-256 hashed when enabled
Catching health information you missed	Your own review in Preview mode	PHI-like patterns, such as a condition in a URL, are detected and flagged before data reaches an ad platform
Ad platforms	A server tag you add for each one	Meta Conversions API, Google Ads, TikTok, Microsoft Advertising, LinkedIn and ChatGPT Ads
Proof of what was sent	Preview mode and your server logs	Event Logs show what was sent to each platform and what it accepted
Attribution after the patient leaves to book	Work you build in the container	The ad click carries to IntakeQ, Calendly, Acuity, Jane App, OptiMantra, ZocDoc and other schedulers, and bookings made days later still match
Setup	Your team	Curve's team, typically live in about a week

Curve Compliance also credits completed visits to the original ad click through incoming webhooks, Keragon connections to EHR and intake tools such as Healthie and Athenahealth, or offline uploads, and Campaign Reporting puts ad spend next to those conversions. Tag Manager can stay for tags on general pages. See Curve Compliance for telehealth.

Book a call. Curve's team will map your funnel from the ad through intake, your scheduler and the visit, and set up server-side conversion tracking, typically live in about a week. Book a call with Curve.

Frequently Asked Questions

Is Google Tag Manager HIPAA compliant?

Curve's BAA Directory found no public statement from Google about a BAA for Tag Manager, and Google's Tag Manager Use Policy says not to upload data that personally identifies an individual. Keep health information out of the container and send conversions server-side from a service that signs a BAA. Is Google Tag Manager HIPAA compliant? goes deeper.

Does server-side Google Tag Manager make tracking HIPAA compliant?

Not on its own. Google says a server container runs on a server you control and lets you shape and route the data. Whether each vendor that receives PHI has a BAA does not change, and HHS says it is not enough for a vendor to remove PHI after receiving it.

Is the HHS online tracking guidance still in effect?

The bulletin is still on the HHS website. A federal court vacated one part on June 20, 2024: the part about connecting an IP address with a visit to an unauthenticated public page addressing specific health conditions or healthcare providers. HHS says it is evaluating its next steps. The guidance on logged-in pages, scheduling, symptom checkers and BAAs is still on the page.

Can a telehealth site keep Google Analytics?

Only on pages that are not HIPAA-covered, according to Google, which does not offer a BAA for Google Analytics. Its help page says authenticated pages are likely to be HIPAA-covered and unauthenticated pages related to the provision of health care services are more likely to be. See Google Analytics alternatives for healthcare.

Does Google sign a BAA for server-side tagging?

Google Cloud says it enters into BAAs as necessary under HIPAA, and Cloud Run and App Engine are on its list of covered products. That covers the hosting. What your server tags send to Google Analytics, Meta or another vendor is a separate question for each vendor.

How long does Curve Compliance take to set up?

About a week, though it varies case by case. Curve's team does the setup, including the script, the ad platform connections and the scheduler handoff, and Curve signs a BAA on every plan.