Is the GA4 MCP Server HIPAA Compliant? A Clinic Verdict

No, Google's GA4 MCP server is not HIPAA compliant for clinics, because Google does not offer a Business Associate Agreement for Google Analytics and the server exists to pull GA4 data into an AI model's context. It is read-only and runs on your own machine, which limits what it can change, not what it can reveal. Curve is the alternative built for clinics: it collects analytics server-side under a signed BAA included on every plan, and Curve MCP is built to release only weekly, organization-level counts, with small groups withheld, instead of page paths or visitor rows.

What Google's GA4 MCP server actually is

Google publishes an official GA4 MCP server on GitHub at googleanalytics/google-analytics-mcp. It is open source under Apache-2.0 and labelled "Experimental." It is not a hosted service. You run it with pipx run analytics-mcp or register it in a client such as Claude Code, and it runs as a local process that calls two Google APIs: the Analytics Admin API and the Analytics Data API.

Google's developer docs settle the write question: "The MCP server is available for read requests only. It can't edit your Google Analytics configuration or settings." The server itself requests only the analytics.readonly scope, through Application Default Credentials from an OAuth client or service-account impersonation.

The README documents seven tools. In clinic terms, this is what each one can hand to the model:

• get_account_summaries: every GA account and property the signed-in Google user can see. On an agency login, that can be every client at once.
• get_property_details and list_google_ads_links: property settings and the Google Ads accounts linked to it.
• get_custom_dimensions_and_metrics: the custom fields your team registered, which is where a field like appointment type or provider would live if anyone created one.
• run_report: any Data API report the model composes, with its own choice of dimensions, metrics and filters.
• run_funnel_report: step-by-step drop-off across paths the model defines.
• run_realtime_report: activity from the last 30 minutes (up to 60 on GA4 360 properties).

Check what your installed version exposes, not what the README says. As of September 2026, the code on the main branch (last changed August 7, 2026) also registers list_property_annotations and run_conversions_report, two tools the README does not list, and the funnel, conversions and annotations tools call alpha versions of Google's APIs. Tool lists drift between releases, so an approval should name the version you run.

GA4 on a clinic site is already the HIPAA problem

Start with the source, not the connector. Google's Analytics help page on HIPAA says: "Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service." It adds that HIPAA-regulated entities "must refrain from exposing to Google any data that may be considered Protected Health Information (PHI)" and may only use Google Analytics "on pages that are not HIPAA-covered."

Google also says where those pages are. Authenticated pages, such as a patient portal, "are likely to be HIPAA-covered." Unauthenticated pages "related to the provision of health care services" are "more likely to be HIPAA-covered."

In June 2024 a federal court in Texas, in American Hospital Association v. Becerra, vacated the part of the HHS tracking-technology bulletin that treated an IP address plus a visit to a public page about a health condition or provider as enough to trigger HIPAA, and HHS withdrew its appeal. The ruling was limited to that combination. The rest of the bulletin stands, and Google's help page still points to the HHS bulletin and still tells customers not to set GA tags on HIPAA-covered pages.

On booking, intake and portal pages, or joined to an identifier, none of these fields needs a patient's name to become PHI:

• pagePath and pageTitle: /book/semaglutide-consult/confirm, or a title such as "ED Treatment | Book Online."
• pagePathPlusQueryString: /book?service=ivf-consult&provider=dr-lee, or a GET-method form that wrote an email address into the URL.
• eventName: custom events such as ed_consult_submitted or suboxone_intake_started that name the service line.
• searchTerm: whatever visitors typed into your site search.
• city and region: location dimensions; Google's schema says region is derived from the visitor's IP address.
• User-scoped custom dimensions: the report tools can return any customUser: dimension, so a CRM ID or record number wired into one comes straight back. (User_id itself is not a Data API dimension, but sending it to Google is already the disclosure.)

Public condition pages are the contested middle after the ruling. Booking flows, portals and anything carrying an ID are not. For GA4 itself and what to replace it with, see our GA4 HIPAA verdict.

If your GA4 property has collected from HIPAA-covered pages, that data already sits with a vendor that does not offer a BAA for it. The MCP server does not create that exposure. It retrieves it and sends it somewhere new.

What the MCP server adds: a second recipient

Local does not mean private

The server runs on your machine, but the model does not. Every tool result becomes part of the conversation, and the AI client sends that conversation to its model vendor on the next turn. A run_report response listing booking-flow page paths by city is now in the model vendor's systems, plus whatever transcript your client keeps.

Whether the model vendor's terms cover that depends on the plan and the feature. Anthropic, for example, makes its Claude apps HIPAA-ready only on Enterprise plans, and at the time of writing its official pages gave conflicting answers on whether Claude Code is covered. A BAA with the model vendor cannot repair the source either: the rows came out of a product Google says is not for PHI.

The model writes the query

In a dashboard, a person chose the dimensions in advance. With run_report, the model picks dimensions, metrics and filters on the fly to answer a casual question. Ask "which service pages drove bookings from Tacoma last Tuesday?" and it can combine pagePath, city, eventName and dateHourMinute into rows small enough to point at one visitor.

The server adds no suppression or redaction of its own. Its code converts the API response into a dictionary and returns it to the client. Whatever the Data API returns, the model sees.

Realtime is the sharpest edge

run_realtime_report covers the last 30 minutes. Its dimensions include city, minutesAgo and unifiedScreenName, which for websites is the page title. "Who is on the site right now?" can come back as a treatment page title, one user, one city, two minutes ago.

The tool's own description tells the model it may add user-scoped custom dimensions to realtime reports. If one holds a CRM ID, the result is a live list of identified visitors and the page each is on.

One login, every property

Application Default Credentials sit on the laptop that runs the server, and they reach every GA property that Google user can see. Google's own sample setup commands also grant that stored credential the broad cloud-platform scope, so the file on disk is worth more than a read-only Analytics key.

For an agency, that can mean every client clinic in one session, with a refresh token stored on disk. Read-only scope stops edits. It does not stop reads, copies or a stolen token.

Can a clinic use it safely at all?

Narrowly, and only if the GA4 property was never a HIPAA problem in the first place. That is a small group, because on a clinic website the service pages are the website. Treat these as minimum conditions, all of them, before anyone connects:

1. The property has never collected from authenticated pages, booking, intake or patient forms, or other pages related to providing care. Historical data counts.
2. Page paths, titles, event names and custom dimensions contain no condition, treatment or service-line names, and query strings are stripped before collection.
3. No user_id, CRM ID, email address or phone number reaches GA4 in any field.
4. The Google login used by the server can see only that property, not an agency's whole roster, and its stored credential carries no scope beyond Analytics read-only.
5. Your compliance lead has approved the AI client's plan, retention terms and BAA position.
6. Someone reviews the installed tool list on every upgrade.

If any line fails, the verdict for your clinic is no. If every line passes, you can ask about blog traffic and generic page counts, and little more. The general version of this test is in what makes an MCP server HIPAA-safe.

How Curve handles clinic analytics without GA4's exposure

Fix collection first, then add the AI. Curve's tracking script installs in place of the Google tag, and events go to US-hosted infrastructure covered by the signed BAA, not straight to Google. Visitors, sessions, goals, funnels and campaign performance are reported in your dashboard.

If you keep GA4 for a purpose that involves no PHI, it can stay on as a destination, and per-destination field mapping forwards nothing to it unless you explicitly map the field. Neutral event aliases mean a destination sees a generic event name, not ed_consult_submitted. Curve does not bring GA4 under a BAA; it limits what reaches it.

For questions, there are two doors. The in-app analyst, Curve Analyst, handles deeper questions inside the app, behind your login. Curve MCP is the door for outside AI clients: Claude (desktop, web and Claude Code), ChatGPT, Cursor, or any other MCP-capable client or agent. Each of its limits answers a specific failure in the GA4 server:

• The model builds its own report. The GA4 server's run_report lets the model choose any dimensions and filters. The connector takes fixed choices, not free text, so there are no free-form breakdowns. It returns organization-level visitors, sessions, goal completions and funnel steps, and it reconciles your server-side campaigns: each campaign's platform-reported spend, clicks and impressions sit next to the conversions Curve's server-side tracking recorded, with cost per conversion by completed week. One link opens the full sent, accepted and matched view inside Curve.
• Visitor strings come back verbatim. GA4 returns pagePath, searchTerm and event names exactly as collected. The connector returns no visitor-set strings (page paths, UTMs, referrers), and a goal, funnel or campaign name your organization has not approved reads "(label hidden)."
• Realtime shows the last 30 minutes. The connector reports completed weeks only, over fixed look-backs of the last week or the last 4, 13 or 52 weeks, with no custom date ranges.
• One login reaches every property. The connector uses scoped access tokens that expire, issued only with a confirmation code and with admins notified. It is off by default, and only the clinic's primary user can turn it on for the organization.
• Nothing is suppressed. The GA4 server passes the API response through untouched. The connector counts people, not visits, over the whole window, withholds small groups, and rounds what it releases (see how small-group rules work). A final guard blocks the answer if it finds anything shaped like an email, phone number, ID, date or name, or if the guard cannot run. It blocks; it does not scrub.

What you give up, and why that is the point

The connector will not tell you which page, channel, device or region performed best, and it returns no revenue or ROAS. Figures can be up to a week behind the dashboard, because the current week is never included. Those gaps are deliberate. Page paths, fine-grained dates and free-form breakdowns are exactly what turned the GA4 question into a PHI question.

When a question needs more depth, the connector returns a link instead of data. The link opens Curve Analyst inside the app, needs a login, works once, expires quickly and carries no data itself.

The connector does not make any AI vendor HIPAA compliant, and the AI client you connect is your choice, under your own terms with that vendor. What changes is what the connector is built to send: counts about your clinic, not records about a patient. For which door fits which question, see when to use the connector versus the in-app analyst.

Frequently asked questions

Is the GA4 MCP server safe because it is read-only?

No. Read-only means it cannot change your GA4 configuration, which Google states plainly. The HIPAA risk here is disclosure, and every tool on the server exists to read data out and place it in a model's context.

Is a hosted third-party GA4 MCP connector safer than Google's?

No. It adds a vendor that holds your Google sign-in and sees every result, on top of the AI vendor, and the GA4 data underneath is the same.

Would a BAA with our AI vendor make the GA4 MCP server compliant?

It would cover one hop at most. Google still offers no BAA for Google Analytics and tells HIPAA-regulated entities not to expose PHI to it, so any PHI in the property was disclosed when it was collected. The AI vendor's BAA also covers only the plans and features that vendor lists as eligible.

Does Google Consent Mode make GA4 safe to connect?

No. Consent Mode adjusts how Google tags behave based on a visitor's consent choices. A banner click is not a HIPAA authorization, and it does not change what a page path or event name reveals. We cover that gap in where Consent Mode and HIPAA do not overlap.

Is the Google Ads MCP server any different?

It is a separate, strictly read-only server that queries ad accounts rather than site analytics, so the exposure sits in search terms and conversion data instead of page paths. We give it its own verdict in is the Google Ads MCP HIPAA compliant.

Can we ask Curve MCP which landing page is converting?

Not through the connector. It has no page breakdowns by design, because page paths are visitor-set strings that can name a condition. It will tell you which campaign is converting, week by week, and it hands page-level questions to the in-app analyst behind your login.

Where to start

1. Find out what GA4 has already collected. Run the free compliance scanner on your site, then check whether the Google tag loads on any booking, intake, portal or condition page.
2. Pause the GA4 MCP server on any property that fails the conditions above, and revoke the Google credential it used, including the file saved on disk.
3. Write down the questions you want an AI to answer. If they are weekly spend, conversions and cost per conversion by campaign, plus funnel drop-off, none of them needs a page path.
4. See Curve MCP answer them. Book a demo and we will show what the connector returns and what it refuses, on the questions your team actually asks.

The tracking side, server-side collection with a signed BAA on every plan, is at curvecompliance.com.

Reviewed September 2026. GA4 MCP server details were checked against Google's GitHub repository and developer docs, and Google's HIPAA statement against the Analytics help center, on September 24, 2026.