Measuring AI Search Traffic for Healthcare: GA4 Setup for ChatGPT & Perplexity Referrals

Measuring AI Search Traffic for Healthcare: GA4 Setup for ChatGPT & Perplexity Referrals

Patients no longer start their healthcare journey with a Google search. They ask ChatGPT about symptoms, query Perplexity for the best orthopedic surgeon nearby, or let Gemini summarize treatment options before clicking through to a provider site. If your GA4 reports show declining organic traffic but climbing "Direct" sessions, you are almost certainly losing visibility into AI-driven patient acquisition.

The challenge for healthcare marketers is twofold: you need to measure AI search traffic accurately, and you need to do it without sweeping protected health information (PHI) into analytics platforms that lack a signed Business Associate Agreement. This guide walks through the exact GA4 configuration for ChatGPT and Perplexity referrals, the HIPAA traps that catch most medical practices, and how to build a compliant measurement stack that survives an OCR audit.

Why Healthcare Marketers Can't Measure AI Search Traffic by Default

GA4 was built for a search world dominated by Google and Bing. AI assistants do not behave like search engines, and the platform's default channel rules historically misclassified the resulting traffic in ways that obscure both performance data and compliance risk.

Risk #1: AI Referrals Disappear Into "Direct" and "Referral" Buckets

When users click links from AI assistants, GA4 may not recognize the source, causing the traffic to land in "Direct" or "Referral," obscuring the impact of your content marketing investment and making it impossible to prove ROI on Answer Engine Optimization.

The behavior varies by platform. When users click links in Perplexity, sessions often appear in GA4 with a source like perplexity.ai and medium referral, making it relatively easy to identify in traffic reports. ChatGPT's in-app browser, by contrast, operates more like an embedded browser within the ChatGPT ecosystem. Links opened through it may strip or block referrer headers, so sessions can appear as "Direct" or as (not set) in source/medium. A urgent care campaign optimized around what looks like "direct" brand traffic may actually be driven entirely by ChatGPT citations.

Risk #2: HIPAA Compliance Implications of Misconfigured Analytics

The bigger problem is regulatory. ^[1] The OCR bulletin makes clear that HIPAA-regulated entities are not permitted to use tracking technologies in ways that would result in an impermissible disclosure of protected health information or any other violation of HIPAA. ^[2] The guidance also emphasizes that regulated entities may not share PHI with tracking technology vendors absent a BAA.

When you build GA4 explorations that include landing page + session source/medium for AI traffic, you may inadvertently log URLs like /conditions/erectile-dysfunction-treatment or /services/addiction-recovery-intake alongside IP-based user identifiers. The updated guidance maintains HHS OCR's original position that the use of tracking technologies on user-authenticated webpages is permitted only if the regulated entity configures its webpages to use and disclose PHI in compliance with HIPAA.

A June 2024 Texas federal court ruling vacated part of this guidance, but the core compliance obligations remain. ^[3] The ruling does not vacate the entire Guidance, implying that HHS OCR's characterization that IIHI includes an IP address in combination with activity on an authenticated webpage remains enforceable.

Risk #3: Hidden Costs of Blind AI Attribution

Misattributed AI traffic creates three categories of hidden cost:

• Wasted ad spend: If ChatGPT is sending high-intent patients but appears as "Direct," paid search budgets get inflated to compensate for "lost" organic traffic that was actually AI-driven.
• Content strategy errors: Without AI channel visibility, you cannot tell which clinical service pages are earning AI citations and which are invisible to large language models.
• Compliance exposure: ^[4] In July 2023, HHS-OCR and the Federal Trade Commission (FTC) sent warning letters to 130 hospitals that use third-party tracking technology, and since that time, numerous class action suits have been filed against providers alleging damages to patients from the use of such online tracking technologies.

The distinction between client-side and server-side tracking becomes critical here. Client-side tags (the default GA4 implementation) fire inside the patient's browser and transmit the URL, IP address, and user agent directly to Google. Server-side tracking routes that data through infrastructure you control, where PHI can be stripped before transmission. For healthcare advertisers, only the latter is defensible under current OCR guidance.

How to Measure AI Search Traffic in GA4 (HIPAA-Conscious Setup)

The configuration below works for any healthcare practice, telehealth platform, or wellness brand. The order of operations matters: build the channel group first, then layer in PHI safeguards before publishing reports to your team.

Step 1: Create a Custom Channel Group for AI Traffic

In GA4, navigate to Admin → Data display → Channel groups. ^[5] Google's official documentation recommends copying the Default Channel Group, then adding a new condition using "matches regex" with a pattern that captures popular AI assistants such as ChatGPT, Gemini, Microsoft Copilot, Claude, and Perplexity.

Name the new channel AI Search. Set the match condition to Session source matches regex and use a pattern such as:

.*(chatgpt\.com|chat\.openai\.com|openai\.com|perplexity\.ai|claude\.ai|gemini\.google\.com|copilot\.microsoft\.com|you\.com|search\.brave\.com).*

Step 2: Reorder Channels So AI Search Sits Above Referral

This step is the one most marketers skip, and it silently breaks the entire setup. ^[5] Google's own documentation instructs you to reorder your channel list so that "AI Assistants" appears above "Referrals" to ensure proper data processing. GA4 processes channel rules top-to-bottom; if Referral appears first, all AI traffic will match the Referral rule before it ever reaches your AI channel.

To validate: if you see AI Search with 0 sessions and Referral has traffic from chatgpt.com or perplexity.ai, your channel order is wrong.

Step 3: Build a Free-Form Exploration for AI Traffic Analysis

The channel group gives team-wide visibility. For deeper analysis, create a Free Form exploration with Session source/medium and Page referrer as dimensions, then add Sessions, Engaged sessions, and Conversions as metrics.

Critical caveat for healthcare: do not add Landing page + query string as a row dimension if any of your service pages contain condition-specific slugs. URLs like /treatments/hiv-prep-consultation combined with IP-derived geographic data can constitute IIHI under OCR's interpretation. Use page category or page group custom dimensions instead, populated server-side with PHI-stripped values.

Step 4: Validate Setup With DebugView

For real-time testing, enable GA4 DebugView. ^[6] According to Google's official documentation, DebugView displays the events and user properties that Analytics collects from a user in real time, allowing you to troubleshoot issues as you install your tags or step through a live user's activity. Enable debug mode using Google Tag Assistant at tagassistant.google.com, visit your site from a ChatGPT or Perplexity link, then go to Admin > DebugView in GA4. Watch the events stream in and check that Session source shows the AI platform domain.

Closing the HIPAA Gap: Why Native GA4 Isn't Enough

Even with perfect channel configuration, Google Analytics is not a HIPAA-compliant destination on its own. Google does not sign BAAs for GA4. That means any session data that could be linked to a specific patient interaction (an appointment booking event, a symptom checker completion, a condition-specific landing page) needs to be sanitized before it ever reaches Google's servers.

Curve's tracking infrastructure solves this with a two-layer approach:

• Client-side PHI stripping: Before any event fires from the browser, Curve's tag scrubs identifiers (email, phone, name fields, condition-revealing URL parameters) and replaces them with hashed, de-identified tokens.
• Server-side conversion forwarding: Conversion events route through Curve's HIPAA-compliant servers (under a signed BAA) before being forwarded to Google Ads via the Google Ads API and to Meta via the Conversions API.

This architecture lets you keep the GA4 AI channel group reports for traffic analysis while ensuring that the high-stakes conversion events (form fills, booked consultations, purchase) flow through a compliant pipeline. The no-code implementation typically saves 20+ engineering hours compared with building dual-tag, server-side container logic from scratch.

Three Advanced Strategies for AI Search Measurement

Strategy #1: Layer UTM Tagging for ChatGPT Recovery

Because ChatGPT's in-app browser often strips referrer headers, channel groups alone will not capture every visit. ChatGPT in some cases appends its own utm_source=chatgpt.com parameter, but you can override or supplement this by adding your own tracking parameters.

When you publish content designed to earn AI citations (FAQ pages, clinical glossaries, treatment comparison articles), include a canonical version with embedded UTM parameters in your structured data and llms.txt. When ChatGPT or Perplexity surfaces the link, the UTM persists even if the referrer is stripped. Common pitfall: do not put PHI-revealing values in the utm_campaign field. Use neutral campaign labels like ai_search_q1 rather than chatgpt_diabetes_landing.

For more on optimizing content to earn those AI citations in the first place, see our guide to healthcare marketing in the AI search era.

Strategy #2: Integrate AI Channel Data With Google Enhanced Conversions and Meta CAPI

AI search is typically a top-of-funnel discovery channel; conversions happen weeks later. A patient might find you through Perplexity, then convert weeks later via Direct or Organic. Last-click attribution will undercount LLM impact. Data-driven or position-based attribution models give a more accurate picture of how AI influences your pipeline.

The compliant way to connect AI-driven first sessions to eventual conversions is server-side. When a patient eventually books an appointment, Curve passes a hashed identifier (not the raw email or phone) to Google Ads via Enhanced Conversions and to Meta via CAPI. The data-driven attribution model can then credit the original AI Search session without ever exposing PHI to either ad platform. In practice, healthcare advertisers running this configuration recover a meaningful share of AI-attributed conversions that cookie-only attribution would have missed entirely.

Strategy #3: Build a Separated ChatGPT vs Perplexity vs Gemini Reporting View

Aggregated "AI Search" reporting hides important platform-level differences. For healthcare specifically, we recommend three sub-channels:

• ChatGPT (chatgpt.com, openai.com, chat.openai.com): Highest volume; expect strong intent on symptom and treatment queries.
• Perplexity (perplexity.ai): Strong citation visibility and tends to pass referrers reliably, useful for measuring content ROI.
• Other AI (Gemini, Claude, Copilot): Lower volume but rapidly growing; useful for trend analysis.

Track engagement rate, average engagement time, and conversion rate separately for each. Patients arriving from Perplexity often spend longer on clinical content because they have already seen a summary; ChatGPT visitors tend to bounce faster when the page does not match the conversational query that surfaced it. These insights drive your content strategy on which clinical topics to deepen versus broaden. For deeper context on how these platforms shape patient acquisition, see how AI health platforms are replacing Google Search.

Compliance Guarantees: What to Build Into Your Stack

Before launching any AI search measurement program, confirm three things:

• Signed BAA with your tracking infrastructure provider: GA4 alone cannot satisfy this. A server-side intermediary that signs a BAA (like Curve) is required for any tracking that could touch PHI.
• Technical safeguards meeting the HIPAA Security Rule: ^[7] OCR has signaled that it is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies. Encryption in transit and at rest, role-based access controls, and audit logging are non-negotiable.
• Documented audit trail: Maintain logs showing exactly what data was transmitted to each ad platform and analytics destination, with PHI-stripping events timestamped for OCR audit response.

Frequently Asked Questions

How do I measure AI search traffic in GA4 for a healthcare website without violating HIPAA?

Build a custom channel group in GA4 with a regex rule capturing chatgpt.com, perplexity.ai, claude.ai, gemini.google.com, and copilot.microsoft.com, placed above the default Referral rule. Critically, do not include condition-specific URL parameters or user identifiers in your GA4 reporting dimensions. Pair the GA4 setup with a server-side tracking provider that signs a BAA to handle conversion events.

Why does my ChatGPT traffic show as "Direct" in GA4?

ChatGPT's in-app browser and some other AI browsers strip referrer headers when opening links, causing sessions to appear as Direct or (not set). The fix is twofold: implement a custom channel group regex to catch sessions that do pass a referrer, and use UTM parameters on links you publish in content optimized for AI citations.

Is it a HIPAA violation to use GA4 on a medical practice website?

Using GA4 is not automatically a violation, but using it to collect data that could identify a patient and reveal their health condition (such as IP address combined with visits to authenticated patient portal pages or specific treatment landing pages) without a BAA is. Google does not sign BAAs for GA4, so healthcare entities need either to strictly limit what GA4 collects or to route data through a HIPAA-compliant intermediary that does sign a BAA.

How does Curve handle AI search referral data differently than standard GA4?

Curve operates as a server-side, BAA-backed layer between your website and downstream ad and analytics platforms. AI search referrer data is captured and de-identified before transmission to Google Ads, Meta, or your analytics destination. This preserves the attribution signal (the session came from Perplexity or ChatGPT) while stripping PHI from the payload, satisfying OCR's requirements without sacrificing measurement quality.

What other AI search platforms should I track besides ChatGPT and Perplexity?

Beyond the major players, include Claude (claude.ai), Gemini (gemini.google.com), Microsoft Copilot (copilot.microsoft.com), and emerging tools like You.com and Brave Search. Microsoft Copilot in particular is gaining share among older demographics that overlap with key healthcare audiences. For paid placement opportunities on these surfaces, see ChatGPT advertising for healthcare and our guide to Microsoft Ads for healthcare.

Ready to Run Compliant Google/Meta Ads?

Book a HIPAA Strategy Session with Curve

Sources

1. HHS.gov: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
2. Inside Privacy (Covington): HHS OCR Updates Tracking Technologies Guidance
3. Ropes & Gray: Federal Judge Vacates Key Points of HHS OCR HIPAA Online Tracking Technology Guidance
4. Dentons: HHS-OCR Revises its Guidance on Use of Online Tracking Technologies
5. Google Analytics Help: Custom channel groups
6. Google Analytics Help: Monitor events in DebugView
7. Holland & Knight: OCR Updates Its Website Tracking Tool Guidance