In-Market Audience Bid Modifiers for Healthcare: Layered Targeting That Wins

Google Ads in-market audiences group users by what they're actively researching: a hip replacement consultation, a therapist for anxiety, a cosmetic dermatologist. For healthcare marketers, that signal is gold, and a liability. In-market bid modifiers let you reward high-intent prospects without restricting reach, but the moment you confirm a user's health condition by layering the wrong audience or piping the wrong conversion back to Google, you've turned a clever optimization into a HIPAA exposure event. This guide breaks down how to use in-market bid modifiers on Google Ads (alongside demographics, geography, and first-party signals) to build layered targeting that compounds performance without leaking PHI. You'll get the platform mechanics, the compliance guardrails, the exact setup sequence, and the mistakes that pull practices into enforcement.

Google Ads Overview for Healthcare

Why Google Search Matters for Patient Acquisition

Patients still start care journeys with a search box. Symptoms, second opinions, "near me" lookups, insurance questions: all of it happens on Google before a phone ever rings. In-market audiences sit on top of that intent layer. When you target in-market audiences, you're reaching users Google identifies as actively researching or comparing purchases, with segments spanning healthcare-adjacent verticals like cosmetic procedures, dental services, weight loss, and hearing aids. These audiences are dynamic and time-sensitive, built from real-time search and browsing signals, and they are available across Search, Display, YouTube and Discovery, which means a single bid modifier strategy can ripple across every Google surface.

Healthcare Advertising Policies

Google enforces its own healthcare and medicines policy on top of HIPAA. Pharmaceutical manufacturers and online pharmacies need certification, and Google's policy prohibits pharmaceutical manufacturers from targeting locations where they are not licensed, prohibits certified manufacturers from advertising prescription drugs for over-the-counter use, prohibits the use of prescription drug terms in ad text in most countries, and restricts advertisements for certain medical services in some locations, including abortion, birth control, health insurance, home HIV tests, and addiction services. On the privacy side, Google's personalized advertising policy restricts the use of remarketing and personalized targeting tied to sensitive health categories, which is the single most overlooked rule among new healthcare advertisers.

Platform Terminology You Need

• In-market segments: Users actively researching a product or service category.
• Observation vs. Targeting: Observation adds an audience to your campaign for reporting purposes only; your ads still show to everyone, and you simply get data on how that audience performs relative to others. Targeting restricts your ads to only show to users in the selected audience, which narrows your reach but increases relevance.
• Bid adjustments: Percentage modifiers (positive or negative) layered on top of base bids for a specific audience, device, location, or schedule.
• Smart Bidding signals: For campaigns that use Smart Bidding, first-party audience segments added under the "Observation" setting will be used as signals for Smart Bidding strategies.

HIPAA Compliance Deep Dive

How Data Flows Through Google Ads

Two paths carry data from your website into Google Ads: client-side (the gtag.js pixel running in the browser) and server-side (the Google Ads API, often paired with Enhanced Conversions). Client-side tracking happens directly in the user's browser, collecting data before sending it to Google, and this approach can inadvertently capture PHI. Server-side moves that collection to your infrastructure, where you can strip identifiers before transmission.

Where PHI Leaks on Google Ads

Traditional client-side tracking methods present substantial risks for healthcare advertisers. These methods often collect IP addresses, device information, and browsing history alongside health-related search terms, all potentially qualifying as PHI under HIPAA when combined with other identifiers. Specific leak points to audit:

• URL parameters: Condition names, appointment types, or referral source IDs appended to landing page URLs.
• Form fields: Patient-entered symptoms, insurance details, or treatment requests passed through gtag events.
• IP address on authenticated pages: OCR's still-active guidance treats tracking technologies on user-authenticated webpages (such as patient portals) as generally having access to PHI.^[1]
• Remarketing lists: Audiences built from page-level visits can effectively profile users by health condition.

The regulatory landscape shifted in 2024. ^[1] On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated the portion of OCR's online tracking guidance that treated an IP address combined with a visit to an unauthenticated public webpage addressing specific health conditions as automatically triggering HIPAA obligations.^[2] The remainder of OCR's bulletin was not vacated, and OCR withdrew its appeal on August 29, 2024, leaving the rest of the guidance in force.^[3] Authenticated pages, condition-specific data tied to existing patients, and other identifier-plus-health-information combinations still create exposure.

Compliant vs. Non-Compliant Google Ads Features

• Standard Google tag (gtag.js) on condition pages: Not compliant. Captures IP, page path, and event payloads with no filtering.
• Google Ads API and Enhanced Conversions via server-side: Can be compliant when patient data is hashed and PHI is stripped before transmission.
• Standard Remarketing and "Your Data" segments built from site visits: Generally not compliant for healthcare; behavioral retargeting on condition-specific pages carries high risk.
• In-market audiences in Observation mode: Can be used compliantly as a bid signal only, and not combined with PHI-derived first-party lists.
• In-market audiences in Targeting mode on sensitive conditions: Use with caution. Restricting ads to "in-market for Addiction Treatment" or "Depression" effectively confirms patient interest in a condition, which can feed identifiers (cookie ID, IP) plus condition data back to Google.
• Customer Match from PHI-derived patient lists: Not compliant without server-side hashing through a BAA-covered vendor.
• Similar audiences from patient lists: Creating lookalike-style audiences from patient lists discloses medical information to a partner that does not sign a BAA for Google Ads.

Penalties scale fast. Penalty amounts for HIPAA violations now range from roughly $145 per violation up to $2,190,294 per violation per year after the most recent inflation adjustment, with tier placement depending on culpability.^[4] OCR also typically requires multi-year corrective action plans on top of monetary penalties.

Step-by-Step Compliant Setup for In-Market Bid Modifiers

Pre-Implementation Audit

1. Pull every active conversion action in Google Ads and document what data fires (event name, parameters, page URL).
2. Inventory landing pages by sensitivity tier: brand and general (low risk), service category (moderate), condition-specific (high risk).
3. Map current audience signals: in-market segments attached at campaign or ad group level, Customer Match lists, remarketing lists, Similar audiences.
4. Confirm BAA coverage for every vendor in the data path. Google does not sign BAAs for Google Ads.

Compliant Tracking Configuration

1. Remove the standard Google tag from sensitive pages. Replace with a server-side container that you control.
2. Route conversions through the Google Ads API. Use Enhanced Conversions for Leads with hashed first-party data only after PHI is stripped from event payloads. Curve handles this server-side so email and phone are SHA-256 hashed before they reach Google.
3. Define PHI stripping rules. Block page URLs containing condition slugs, redact form fields like "reason for visit," and drop IP from outbound payloads.
4. Standardize conversion events. Use generic event names ("lead_submitted," "appointment_requested") rather than "cancer_consult_booked."

Campaign Structure for Layered Targeting

For healthcare, the bid-modifier-friendly structure is: Search campaign with broad service keywords, in-market segments in Observation mode, and Smart Bidding (tCPA or Max Conversions with target). This combination gives the algorithm signal without forcing a privacy-risky narrow audience. A common practice is to start with Observation, gather data over several weeks, then shift high-performing audiences to Targeting with increased bids, but for sensitive specialties (mental health, addiction, oncology) we recommend staying in Observation indefinitely.

Layer in additional signals that don't depend on health condition data:

• Geography: Service-area radius, not narrow ZIP that could imply identity.
• Demographics: Age bracket and household income matching your patient panel.
• Device and dayparting: Mobile bid-ups for urgent care; weekday business-hours bid-ups for elective.
• In-market segments: Layered as observation for bid signal, not as the gate.

This is the same layered logic we cover in our guide to in-market audience targeting for physical therapy and the segment-by-segment compliance breakdown in which Google Ads audience segments are HIPAA-safe.

Bid Modifier Mechanics

Mechanically, in the audience interface, you'll see the ability to increase or decrease the bid for an audience group in your search campaign; Observation doesn't affect campaign delivery unless you add a bid modifier. Two caveats specific to Smart Bidding:

• When you add audience segments to a Smart Bidding campaign, you are not telling Google how much to bid for those users. You are giving the algorithm a signal that helps it identify high-value patterns faster. The machine learning model uses your audience data as one input among many to predict conversion probability and set the optimal bid. Manual bid modifiers on in-market audiences are ignored under tCPA and tROAS.
• Under manual CPC or Enhanced CPC, your bid modifiers fire directly. If a customer is part of multiple audience lists that have been targeted in a campaign, the highest adjustment among the matching audience lists is used.

Verification and Testing

1. Use Google Tag Assistant and your server-side logs to confirm no PHI appears in outbound payloads.
2. Run a controlled test: apply a modest positive modifier on a benign in-market segment (for example, "Health & Fitness, Fitness Products") and verify it registers in the auction-time bid simulator.
3. Audit the Audience report monthly. Segments showing high CPA with poor conversion rate are candidates for negative modifiers or exclusion.
4. Document the data flow in your HIPAA risk assessment.

Campaign Strategies That Convert

Ad Types and Bid Modifier Use Cases

Search remains the safest healthcare format because intent is explicit and creative doesn't require imagery that implies a condition. Use in-market bid modifiers on Search to amplify intent overlap (for example, a dental practice running brand-agnostic implant keywords boosts bids when the searcher is also in-market for "Cosmetic Procedures, Dental"). Demand Gen and YouTube work for awareness, but observation-only on audiences and broad creative are non-negotiable. For a deeper comparison of audience-led versus broad-targeting approaches on Meta, see our breakdown of when Advantage+ broad targeting beats custom audiences.

Targeting Without PHI

Build the targeting hierarchy from outside in:

• Geographic: Service area, not narrow ZIP.
• Demographic: Age, gender, and parental status when relevant to the service.
• In-market (Observation): Apply modest positive bid adjustments on segments that map to your service category. In practice, start by running audiences in Observation to collect conversion data for several weeks, then test small upward bid adjustments on high-value segments while monitoring CPA and ROAS.
• Custom segments: Built from competitor search terms or category-level URLs, never from condition-specific patient behavior.
• Exclusions: See our guide on Google Ads audience exclusions for healthcare for the negative side of layered targeting.

Conversion Tracking Done Right

Track a generic primary conversion (for example, "Lead") and one or two secondaries (call, form). Pass value where you can (predicted LTV by service line) without passing the service line name itself. Start with Target CPA bidding focused on completed appointment bookings, using only the conversion event (not patient details) to train Google's algorithms.

Common Mistakes to Avoid

• Switching in-market audiences from Observation to Targeting on sensitive conditions. The moment you restrict a campaign to "in-market for Addiction Treatment," your campaign data effectively associates users with that condition category.
• Stacking Customer Match on top of in-market bid modifiers without a BAA-covered hashing layer. Uploading patient emails to Google Ads, even hashed by gtag, is a disclosure event without proper server-side handling.
• Building Similar Audiences from a patient list. Same disclosure problem, scaled.
• Letting Optimized Targeting run by default. Google selects Optimized Targeting by default when you create a new ad group; switch it off in ad group settings. Otherwise your ads can show to users outside your defined safe audience.
• Naming conversion events after conditions. "Bariatric_Consult_Booked" written into the event name reaches Google in plaintext.
• Misreading the scope of the AHA ruling. The court vacated only the "Proscribed Combination" (IP plus unauthenticated condition-page visits); OCR's broader guidance on authenticated pages, BAAs, and identifier-plus-health-information disclosures remains in force.^[1]

Self-Audit Checklist

1. Are any in-market audiences set to "Targeting" on condition-specific campaigns? Switch to Observation.
2. Are conversion event names or parameters carrying condition language? Rename and redact.
3. Is gtag.js firing on authenticated patient portals? Remove it.
4. Are Customer Match uploads originating from EHR or patient lists? Route through a BAA-covered server-side hashing layer.
5. Has Optimized Targeting been disabled at the ad group level? For healthcare remarketing in particular, this setting should almost always be turned off.

Frequently Asked Questions

Is Google Ads HIPAA compliant for healthcare advertisers?

Google does not sign a BAA for Google Ads, so the platform is not HIPAA compliant out of the box. Healthcare advertisers can use it compliantly by routing conversions through server-side infrastructure that strips PHI before data reaches Google, and by avoiding remarketing and condition-based audience targeting. Disclosing PHI to unauthorized parties is one of the reasons Google Ads is not HIPAA compliant out-of-the-box. To use the platform compliantly, redact PHI from page titles, page content, URL parameters, and form-derived fields in conversion events, and route data through a BAA-covered server-side layer.

How do I set up compliant Google Ads conversion tracking with in-market bid modifiers?

Disable client-side conversion tags on sensitive pages, deploy server-side tracking that hashes identifiers and removes URL and form PHI, attach in-market audiences in Observation mode at the ad group level, and let Smart Bidding consume them as signals. Verify outbound payloads before enabling any bid modifier.

Can healthcare practices use Google Ads remarketing?

In nearly all cases, no. Google offers two methods to build retargeting audiences: the Google retargeting tag and Google Signals. Google's personalized advertising policies restrict the use of remarketing tied to sensitive health categories, and behavioral remarketing on condition pages also creates HIPAA exposure because it associates a device or user identifier with a medical interest.

What are the penalties for Google Ads HIPAA violations?

Civil monetary penalties for HIPAA violations are tiered based on culpability and adjusted annually for inflation, with maximum annual caps reaching into the millions of dollars per violation category.^[4] Beyond fines, OCR enforcement typically includes multi-year corrective action plans, mandated breach notifications, and the reputational fallout from a public OCR resolution agreement.

Do in-market bid modifiers actually work under Smart Bidding?

Manual percentage modifiers on audiences are ignored by tCPA and tROAS, but the audience attachment still feeds the algorithm. Smart Bidding uses your audience segments as signals to bid more efficiently and help get you more conversions and conversion value. Smart Bidding also takes into account how long a member has been on a segment, and uses this data to optimize performance. Under manual CPC or eCPC, the modifier fires directly.

Simplify Google Ads Compliance with Curve

Stop worrying about PHI exposure. See how Curve automates compliant Google Ads tracking, signs a BAA, and saves 20+ hours over manual server-side setups, so you can run layered in-market targeting without the legal overhead.

Sources

1. HHS.gov, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
2. Holland & Knight, American Hospital Assn. v. Becerra: Court Dials Back OCR Bulletin
3. HIPAA Journal, OCR Drops Appeal in AHA Tracking Technology Case
4. HIPAA Journal, HIPAA Violation Fines
5. Google Ads Help, Targeting and Observation settings
6. Google Ads Help, Smart Bidding with audience segments
7. Google Ads Help, Bid adjustments for audience lists