UTM builder for healthcare campaign links
A UTM builder adds utm_source, utm_medium and utm_campaign parameters to a link so analytics can tell which campaign sent each visitor. On a healthcare site, keep those values about the campaign, never about the patient or the condition. Curve Compliance built this one to flag health details before you copy a link.
Fill in the fields and the link builds in your browser as you type. The warning is a simple word and pattern check: a reminder, not a compliance check.
The page your ad, post or email links to.
Where the click comes from, such as google, facebook or newsletter.
The channel, such as cpc, paid_social or email.
A neutral campaign code, not a treatment or a condition.
Optional. The ID you use when you upload campaign data.
Optional. The paid keyword. Leave it out for sensitive services.
Optional. A creative ID or format, such as ad_03 or video.
What each UTM parameter means
Google Analytics reads these parameters from the landing page URL and reports them as the session's source, medium and campaign. Google says “When you add parameters to a URL, you should always use utm_source, utm_medium, and utm_campaign.” It also notes that “Parameter values are case sensitive”, so pick one spelling and keep it.
Source: Google Analytics Help: URL builders, collect campaign data with custom URLs
| Parameter | What Google says it is | Clinic-safe example |
|---|---|---|
| utm_source | “Referrer, for example: google, newsletter4, billboard” | google, facebook, newsletter |
| utm_medium | “Marketing medium, for example: cpc, banner, email” | cpc, paid_social, email |
| utm_campaign | “Product, slogan, promo code, for example: spring_sale” | c14_spring, consult_q4 (a code, not a drug or treatment name) |
| utm_id | “Campaign ID. Used to identify a specific campaign or promotion.” | c14 |
| utm_term | “Paid keyword” | Leave it out for sensitive services |
| utm_content | “Use to differentiate creatives.” | ad_03, video_a |
Naming rules for clinic campaigns
Use neutral codes for campaigns. Name the campaign c14_spring or consult_q4 rather than after a drug, a treatment or a condition, and keep the lookup table inside your team.
Keep source and medium generic. Google says “Use only one unique utm_source for each distinct platform such as Facebook, Instagram, TikTok.”
Write everything in lowercase. Google's advice is to “Use lowercase as a standard practice.” The builder does this for you unless you turn it off.
Number your creatives. Set utm_content to a creative ID or format, not a description of what the ad says.
Think twice about utm_term. If the paid keyword names a condition, it rides along in the URL to the tags that read the page address. Leave it out for sensitive services.
Words to keep out of URLs
Never put patient or health details in a UTM. Google's rule for Analytics is direct: “Be sure not to include PII in custom campaign parameters utm_source, utm_medium, utm_term, utm_campaign, and utm_content.” It adds that “The basic Analytics page tag collects the page URL and page title of each page that is viewed” and that “Both the URL path and parameters must be free of PII.” (Google Analytics Help)
Analytics is rarely the only tag reading the URL. HHS notes that “Websites commonly use tracking technologies such as cookies, web beacons or tracking pixels, session replay scripts, and fingerprinting scripts”. (HHS)
- Names, email addresses and phone numbers
- Dates of birth and appointment dates
- Condition, symptom, diagnosis and medication names
- Treatment or service names tied to a booking or thank-you page
- Insurance, member or medical record numbers
- Form answers of any kind
For the HIPAA rules behind this list, read Are UTM parameters PHI? A HIPAA guide for clinic ads.
UTMs, auto-tagging and click IDs
UTMs are tags you add by hand. Ad platforms also add their own click IDs. Google says “Google Click ID (GCLID) is a URL parameter passed with ad clicks”, added when auto-tagging is on, and “Auto-tagging is turned on by default for new accounts.”
Google describes auto-tagging as a feature that is needed to “Track conversions on your website on all browsers.” It also says “in Google Analytics 4 (GA4), auto-tagging is prioritized over manual tagging due to the absence of an override option.” So for Google Ads traffic in GA4, auto-tagging does the work. UTMs matter most for links Google's auto-tagging doesn't cover: other ad platforms, social posts, emails and partner links.
A click ID carries no health detail on its own, but it ties a visit to a specific ad click, so the same rule applies: keep the rest of that URL free of health details.
Sources: Google Ads Help: Google Click Identifier (GCLID); Google Ads Help: About auto-tagging
Checking links you already run
Export the final URLs from your ad platforms, and the landing page URLs from your analytics.
Search them for @, %40, email=, phone=, dob= and the names of your services and conditions.
Submit each form once with test details and read the address bar on the page that follows.
Follow every booking link to the end, including third-party schedulers.
Run the free Curve Compliance website scan to list the pixels and trackers that load on those pages.
How Curve Compliance keeps health details out of what ad platforms receive
PHI-like patterns caught before they leave
Curve Compliance detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
Server-side conversions with a fixed field list
Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and events can use neutral names.
Event Logs you can check
Event Logs show what Curve sent to each platform and what the platform accepted.
A BAA on every plan
Curve signs a BAA on every plan, and Curve's team does the setup for you, typically live in about a week.
Frequently asked questions
What is a UTM builder?
A UTM builder adds campaign parameters such as utm_source, utm_medium and utm_campaign to a link, so analytics can tell which campaign sent each visitor. This one, from Curve Compliance, also flags values that look like an email, a phone number, a date or a health term before you copy the link.
Are UTM parameters PHI?
A UTM value describes the campaign, not the person, so it isn't PHI on its own. It becomes a problem when the same URL carries a name, an email or a health detail tied to an identifiable visitor. Curve Compliance's guide to UTM parameters and PHI covers the rules. Are UTM parameters PHI?
Which UTM parameters are required?
Google says “When you add parameters to a URL, you should always use utm_source, utm_medium, and utm_campaign.” It also says “Missing UTM parameters will result in (not set) values being present in reporting.”
Do I need UTMs if Google Ads auto-tagging is on?
Not for Google Ads traffic in GA4. Google says “in Google Analytics 4 (GA4), auto-tagging is prioritized over manual tagging due to the absence of an override option.” Use UTMs for other ad platforms, social posts, emails and partner links.
Can I put the treatment name in utm_campaign?
It's safer not to. Analytics and ad tags read the page URL, and on a booking or thank-you page a treatment name in that URL sits next to an identifiable visitor. Use a neutral campaign code and keep the lookup table inside your team.
Does this builder check my link for PHI?
It flags values that look like an email, a phone number, a date, a long ID number or a common health term. It is a simple word and pattern check that runs in your browser, a reminder rather than a compliance check, so review every link yourself.
How does Curve Compliance help with UTMs and URLs?
Curve Compliance detects PHI-like patterns, including emails in URLs, before data reaches an ad platform and flags them so they can be stopped at the source. It sends conversions server-side with a fixed list of fields for each platform, and signs a BAA on every plan. Book a call to see what your own URLs send.
Sources checked November 2, 2026: Google Analytics Help: URL builders, collect campaign data with custom URLs; Google Analytics Help: Best practices to avoid sending PII; Google Ads Help: About auto-tagging; Google Ads Help: Google Click Identifier (GCLID); HHS: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
See what your URLs already tell ad platforms
Book a call with Curve's team. We'll review what your website sends to Meta, Google and TikTok with you, show what's likely triggering a flag, and set up server-side conversions under a BAA on every plan.