Are UTM Parameters PHI? A HIPAA Guide for Clinic Ads

A UTM parameter is not PHI on its own, because it describes the campaign that sent a visitor, not the visitor. It becomes a problem when the same URL also carries a name, an email address or a health detail and reaches an ad or analytics vendor along with the visitor's IP address or click ID, since HIPAA lists names, email addresses, IP addresses and any other unique identifying code among the identifiers that must be removed to de-identify data (45 CFR 164.514; HHS). Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checks every event for PHI-like patterns, including emails in URLs and condition names, and strips PHI before data reaches an ad platform.

Book a call. Want to know what your landing page and thank-you URLs are telling Meta and Google? Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Book a call with Curve.

What UTM parameters and click IDs are

Google explains the purpose: "By adding utm campaign parameters to the destination URLs you use in referral links and ad campaigns, you can view which campaigns refer traffic" (Google Analytics Help). You choose the values, so they are the same for everyone who clicks a given link. Click IDs work the other way. The ad platform adds them, and each one points to a single click.

Parameter	What it holds, in the platform's words	What to watch for
utm_source	"Referrer, for example: google, newsletter4, billboard" (Google)	Low risk; name the platform.
utm_medium	"Marketing medium, for example: cpc, banner, email" (Google)	Low risk; name the channel.
utm_campaign	"Product, slogan, promo code" (Google)	A drug, condition or treatment name in the value.
utm_term	"Paid keyword" (Google)	Search keywords that name a condition.
utm_content	"Use to differentiate creatives" (Google)	Creative names that describe a condition.
gclid	"Google Click ID (GCLID) is a URL parameter passed with ad clicks" (Google Ads Help)	A code for one click, added when auto-tagging is on.
fbclid	Meta's click ID value can be generated "from a fbclid query parameter" (Meta)	A code for one click, stored in the _fbc cookie.

Google's auto-tagging example shows the mechanics: after an ad click, "the final URL will look like www.example.com/?gclid=123xyz" (Google Ads Help). HIPAA's identifier list ends with "Any other unique identifying number, characteristic, or code" (45 CFR 164.514), and HHS lists "any unique identifying code" among the data a tracker may receive (HHS). So treat a click ID tied to a booking like any other identifier.

When a URL carries health information

A URL travels further than most teams expect. Google says that on a site using its ad or analytics services, "your web browser automatically sends certain information to Google. This includes the URL of the page you're visiting and your IP address" (Google). Meta's Conversions API asks for the event_source_url, "The browser URL where the event happened," and says it "is required for website events shared using the Conversions API" (Meta). Whatever sits in the URL goes along. Five patterns put health details there:

• Condition-named campaigns. A link such as utm_campaign=anxiety_therapy is fine on a billboard report. On the booking page of an identifiable patient, it tells the receiving vendor what they came for.
• Form answers in query strings. Forms that submit with GET write answers into the address, such as a reason for visit or a date of birth.
• Emails on thank-you pages. A redirect that adds ?email= to the confirmation URL hands the address to every tag on that page.
• Site search. Google warns that "Website visitors and users sometimes enter PII into search boxes and form fields" (Google). A search for a symptom lands in the URL.
• Page paths. A path like /conditions/hiv/book needs no query string at all to tell every tag on the page what the visitor came for. Google Analytics applies its PII rule to paths too: "Both the URL path and parameters must be free of PII" (Google).

HHS's booking example is the clearest case. A tracker that collects "an individual's email address, or reason for seeking health care typed or selected by an individual" during an appointment request means "the regulated entity is disclosing PHI to the tracking technology vendor" (HHS). Meta's terms also bar sharing data that "includes or is based on, directly or otherwise, health information," and say event and conversion names "must not reflect, imply or be based on" it (Meta Business Tools Terms). For the full list of identifiers, see the 18 HIPAA identifiers.

A safe naming convention for clinic campaigns

• Use neutral codes for campaigns. Name the campaign c14_spring or consult_q4 rather than after a drug or condition, and keep the lookup table inside your team.
• Keep source and medium generic. Google's own advice is to "Use only one unique utm_source for each distinct platform" and to "Use lowercase as a standard practice" (Google).
• Think twice about utm_term. If you pass the paid keyword into the URL, a condition keyword rides along to every tag on the page. Leave it out for sensitive services.
• Number your creatives. Set utm_content to a creative ID or format, not a description of the condition in the ad.
• Never put a person in a URL. No names, emails, phone numbers, dates of birth or form answers in any path or parameter. Google says: "Be sure not to include PII in custom campaign parameters utm_source, utm_medium, utm_term, utm_campaign, and utm_content" (Google).
• Name events neutrally too. Send a booking as a neutral event name rather than one that names the service, which also fits Meta's rule on event names above.

How to find leaks you already have

1. Run the free Curve Compliance website scan to list the pixels and trackers on your landing, booking and thank-you pages.
2. Export landing page URLs from your ad platforms and analytics, and search them for @, %40, email=, name=, phone=, dob= and the names of your services.
3. Submit each form once with test details and read the address bar on the page that follows.
4. Run a site search for a symptom and check the URL it produces.
5. Follow every booking link to the end, including third-party schedulers; see the booking widget PHI leak audit.

Fix what you find at the source: change the form method, drop parameters from redirects and rename campaigns. Then send each vendor only what it needs under the minimum necessary rule; if the Meta pixel is the tag reading those URLs, see how to remove it. How these rules apply to your site depends on your facts, so talk to your counsel. If you want help reading the results, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve checks every event for PHI-like patterns, such as emails in URLs, condition names and form answers, and flags them so they can be stopped at the source. It strips PHI before data reaches an ad platform, each platform receives only a fixed list of fields, and events can use neutral names. Contact identifiers are off by default on Meta, Google Ads and TikTok, and Event Logs show what Curve sent to each platform and what the platform accepted.

Curve keeps ad attribution when a visitor leaves to book in tools such as IntakeQ, Calendly, Acuity and Jane App, and the booking is still credited to the original ad click. Curve collects this data under the BAA it signs on every plan (BAA Directory entry), Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.514; HHS, guidance on de-identification; HHS, online tracking technologies bulletin; Google Analytics, collect campaign data with custom URLs; Google Analytics, best practices to avoid sending PII; Google Ads, GCLID definition; Google Ads, about offline conversion imports; Google Ads, about auto-tagging; Google, how Google uses information from sites that use its services; Meta, customer information parameters; Meta, server event parameters; Meta Business Tools Terms.

Frequently Asked Questions

Are UTM parameters PHI?

Not on their own, because UTM values describe the campaign rather than the person. On a covered provider's site, a URL that also carries a name or an email, or a health detail sent with the visitor's IP address or click ID, can be PHI, since those are on HIPAA's identifier list (45 CFR 164.514).

Can I put the treatment name in utm_campaign?

It is safer not to. The value travels with the page URL to every tag that reads it (Google), and on a booking page it ties a treatment to an identifiable visitor. Use a neutral campaign code and keep the lookup table in-house.

Are click IDs like gclid PHI?

Google gives a unique ID "for every click that comes to your website from an ad" (Google). On its own it carries no health detail, but HIPAA lists "Any other unique identifying number, characteristic, or code" as an identifier (45 CFR 164.514), so treat one tied to a booking as identifying data.

What about emails in a thank-you page URL?

Remove them. Email addresses and URLs are both on HIPAA's identifier list (45 CFR 164.514), and HHS treats an email collected with an appointment request as PHI (HHS). Google Analytics' rule is that "Both the URL path and parameters must be free of PII" (Google).

Does server-side tracking fix URL leaks?

Not by itself. Meta says event_source_url "is required for website events shared using the Conversions API" (Meta), so a server-side event still carries a URL, and it has to be clean before it is sent. See the missing event_source_url warning.

Do Google and Meta allow health details in URLs?

Google Analytics says page URLs and campaign parameters must be free of PII (Google). Meta's terms bar sharing data that "includes or is based on, directly or otherwise, health information" (Meta).

Is a page URL with a condition name PHI?

Not by itself. It supplies the health half when it is tied to an identifiable person seeking care, as on a booking page. See what counts as PHI on a website and PHI vs PII.

Talk to Curve Compliance

Book a call. Curve Compliance checks every event for PHI-like patterns, including emails in URLs, and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.