Skip to main content

Tracking plan

HIPAA-safe tracking plan for an addiction treatment provider

A HIPAA-safe tracking plan for an addiction treatment provider sends Meta and Google Ads neutral event names such as event_1, never condition-bearing URLs, page titles or form answers, and credits each booking to the ad click that sent it. This worked example comes from Curve Compliance's tracking plan tool. It assumes bookings through forms on your own site and counts two conversions: a booked appointment and a completed visit.

Any page on an addiction treatment site can show that someone is looking for treatment, so the plan sends ad platforms only neutral aliases and keeps admissions form answers on your side.

For an addiction treatment provider using on-site forms with Meta and Google Ads. Every ad platform receives neutral sequential aliases server-side, with no condition, service or form detail.

Funnel stages and event names

Each milestone keeps a descriptive label only inside your tracking tool. Every ad platform receives a neutral sequential alias instead, event_1, event_2 and so on in funnel order, so no event name says what someone booked. The numbers here are for a new setup: if you already send aliases, keep the numbers you have, because campaigns optimize on them.

  • Appointment booked: event_1 sent to ad platforms (booking inside your tracking tool). Your website's booking form.
  • Visit completed: event_2 sent to ad platforms (visit_completed inside your tracking tool). Your CRM or EHR, through an incoming webhook or offline upload.

What each ad platform receives

Meta

  • Send event_1 and event_2 to the Meta Conversions API as custom events, not Meta standard events, from a HIPAA-compliant server-side tool under a BAA, such as Curve Compliance, in place of the Meta Pixel. You or your agency choose which one each campaign optimizes on.
  • Health and wellness data restrictions can limit what your dataset shares, and Meta blocks custom events until you review and confirm them in Events Manager. If Meta restricts or blocks a milestone on your dataset, don't send it to Meta under any other name: optimize on an upper-funnel step Meta still accepts, and measure bookings outside Meta. Server-side delivery does not lift a restriction.
  • Website events carry event_source_url, which Meta requires. Use a page on your verified domain whose path and query string name no condition or treatment.
  • Events that happen off your website, such as event_2, use the action_source that matches where they happened, such as phone_call or system_generated, not website.

Google Ads

  • Create one Google Ads conversion action for each alias (event_1 and event_2), with the same neutral name, and feed it from a HIPAA-compliant server-side tool under a BAA, such as Curve Compliance, in place of the Google Ads tag.
  • The event_2 events reach Google Ads as offline conversions credited to the original ad click, with no health details.
  • Targeting is a separate question. Google's personalized advertising policy limits which audiences a health advertiser can use, and it does not switch off conversion tracking.

Never send

  • Page URLs, paths or query strings that name a condition, treatment or service. Strip them before anything leaves your systems.
  • UTM values that name a condition or treatment. Name the campaign instead.
  • Page titles or content names copied from a service or treatment page.
  • Form answers, quiz or intake answers, and anything typed into a free-text field.
  • Appointment types, visit reasons, or the service someone booked.
  • Event names, conversion names or parameters that reflect, imply or are based on a condition, including codes that map back to one.
  • Names, emails, phone numbers and other contact details. Curve Compliance keeps contact identifiers off by default and credits each conversion to the original ad click without them.
  • Any of the above through a browser ad pixel. A pixel sends what the page gives it, including full URLs and query strings, and Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn do not sign a BAA.

Check what leaves before it reaches a platform. Curve Compliance detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.

The booking-tool hop

  • Leads and bookings happen on your own site, so there is no hop to a separate booking tool to bridge.
  • Host forms with a tool that signs a BAA. Curve Forms from Curve Compliance are HIPAA-hosted intake and lead forms with ad attribution attached.

Later outcomes from your CRM or EHR

  • The event_2 events happen after the booking, in your CRM or EHR. Bring them back through webhooks or offline conversion uploads, and credit each one to the original ad click. Curve Compliance receives both and credits each outcome to the click.
  • EHR and intake tools such as Healthie, Athenahealth, OptiMantra, IntakeQ and Jane connect to Curve Compliance through Keragon.
  • Each outcome carries its alias, never the visit reason, notes or service.

Consent

Ask for consent before any non-essential tag fires, and use a consent tool covered by a BAA. Curve Compliance's consent management is covered by the same BAA as its tracking.

Implementation

  • You or your agency pick the milestones and what each campaign optimizes on. A HIPAA-compliant server-side tool under a BAA replaces the browser ad pixels and sends the aliases.
  • With Curve Compliance, its team does the setup for you under a BAA signed on every plan, and most customers are live in about a week.
  • Curve Compliance's Event Logs show what was sent to each platform and what the platform accepted, so you can check every event in this plan.

Sources

Why the plan uses neutral names

Meta and Google both have rules for health data and health ads:

  • Meta can assign a website to a data source category, including “Health and wellness: Is associated with medical conditions or specific health statuses, provider/patient relationships, services for accessing personal health information, or health-related products and services” (Meta Business Help Center).
  • For a restricted category, Meta's restrictions include “Core Setup: Restricts the sharing of custom parameters and parts of URLs following the domain.” and “Restriction on certain standard events: Restricts the sharing of specific mid and lower funnel events.” (Meta Business Help Center).
  • Google says “Content related to Health is a sensitive interest category” in its personalized advertising policy (Google Advertising Policies Help).
  • Google's personalized advertising policy lists, as health content, “Counseling services for mental health issues like depression, anxiety, and addiction” (Google Advertising Policies Help).
  • Federal rules at 42 CFR Part 2 also “impose restrictions upon the use and disclosure of substance use disorder patient records” (42 CFR 2.2).

A neutral alias such as event_1 names a step in the funnel, not the care behind it. Terms such as data source category, click ID and neutral event alias are defined in the HIPAA marketing glossary.

How Curve Compliance sets this up

  1. Curve Compliance's team reviews what your website sends to Meta, Google and TikTok with you, and the free website scan lists the pixels and trackers on any page.
  2. One Curve Compliance script replaces the browser ad pixels. Conversions go server-side to Meta and Google Ads as event_1 and event_2, each with a fixed list of fields.
  3. Bookings on your own site are sent server-side as they happen. Curve Forms, HIPAA-hosted intake and lead forms with ad attribution attached, can host the form.
  4. Completed visits come back from your CRM or EHR through incoming webhooks, offline conversion uploads or, for EHR and intake tools such as Healthie, IntakeQ and Jane, through Keragon. Each is credited to the original ad click.
  5. Curve Compliance checks every event for PHI-like patterns before it reaches an ad platform, and Event Logs show what was sent to each platform and what the platform accepted.

All of it runs under a BAA Curve Compliance signs on every plan, and most customers are live in about a week. Book a call to have Curve Compliance's team set up this plan for you.

Make this plan yours

This page uses fixed example inputs. Open this plan in the tracking plan tool to share or print it, or book a call and Curve Compliance's team will build the plan for your own booking tool, CRM, ad platforms and conversions.

More example plans:

Frequently asked questions

What should an addiction treatment provider send to Meta?

Only neutral custom events: here event_1 for a booked appointment and event_2 for a completed visit, sent through the Meta Conversions API from a HIPAA-compliant server-side tool under a BAA, with a fixed list of fields. Never page URLs that name a condition or treatment, page titles, form answers or contact details.

Which conversions should an addiction treatment provider track?

This example tracks two: an appointment booked, sent as event_1, and a visit completed, sent as event_2. The booking comes from your website's booking form; the completed visit comes from your CRM or EHR, through an incoming webhook or offline upload, credited to the original ad click. You or your agency choose which one each campaign optimizes on.

How do bookings on our own site count as ad conversions?

Leads and bookings happen on your own site, so there is no hop to a separate booking tool to bridge. Host forms with a tool that signs a BAA. Curve Forms from Curve Compliance are HIPAA-hosted intake and lead forms with ad attribution attached.

Can Curve Compliance set this up for us?

Yes. Curve Compliance's team does the setup under a BAA signed on every plan, and most customers are live in about a week. Event Logs then show what was sent to each platform and what the platform accepted.

Put this plan to work

Curve Compliance replaces browser ad pixels with server-side delivery, keeps attribution through your booking tool, and shows what each platform accepted.

  • BAA signed on every plan
  • Set up by Curve Compliance's team
  • Typically live in about a week
Have Curve Compliance set this up