Do YouTube and Google Maps Embeds Share Patient Data?

YouTube and Google Maps embeds share visitor data with Google: Google says that when a page embeds YouTube video, the visitor's browser automatically sends Google the page URL and IP address, and its privacy policy says it collects the IP address and referrer URL when browsers interact with its services, which include embedded Google Maps (Google; Google Privacy Policy). Whether that data is PHI depends on the page. HHS says tracking technologies on a page where people schedule appointments or use a symptom checker may have access to PHI in certain circumstances (HHS). Curve Compliance, which signs a BAA on every plan, runs a free scan that lists the pixels and trackers on a page, so you can start with what your site loads today.

Book a call. Run the free scan on your booking and service pages, then talk to Curve. Curve's team reviews what your website sends to Meta, Google and TikTok with you, and Curve signs a BAA on every plan. Book a call with Curve.

What a YouTube embed sends to Google

Google's page on how it uses information from partner sites is direct: "when you visit a website that uses advertising services like AdSense or Google Ads, including analytics tools like Google Analytics, or embeds video content from YouTube, your web browser automatically sends certain information to Google. This includes the URL of the page you're visiting and your IP address." It adds: "We may also set cookies on your browser or read cookies that are already there" (Google).

The page URL is easy to overlook. A URL such as a fertility consult page or a booking page with a reason in the query string tells Google what the visitor was looking at, next to their IP address. See what counts as PHI in website tracking and whether UTM parameters are PHI. YouTube also reminds site owners that "The YouTube API Terms of Service and Developer Policies apply to all access and use of the YouTube embedded player" (YouTube Help).

What privacy-enhanced mode changes, and what it does not

YouTube's help page explains the switch: "To use Privacy Enhanced Mode: Change the domain for the embed URL in your HTML from https://www.youtube.com to https://www.youtube-nocookie.com." In that mode, "the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize the YouTube browsing experience," "If ads are served on a video shown in the Privacy Enhanced Mode of the embedded player, those ads will likewise be non-personalized," and the view "will not be used to personalize advertising shown to the viewer outside of your site or app" (YouTube Help).

That is a limit on personalization. YouTube's page does not say the visitor's browser stops contacting Google. The same page tells network administrators to "add youtube-nocookie.com to the firewall allowlist," which means the player still loads from a YouTube domain (YouTube Help). Privacy-enhanced mode is a sensible default for any YouTube embed you keep. It is not a reason to put a player on a booking or intake page.

Google Maps embeds and the Maps Platform Terms

There are two common ways to put a Google map on a page. From Google Maps, you click "Share or embed map," then "Embed a map" and "Copy HTML" (Google Maps Help). Developers use the Maps Embed API to "Place an interactive map or Street View panorama on your web page" (Google for Developers).

The Google Maps Platform Terms say, in section 3.2.1, that a customer will not access or use the Services "to transmit, store, or process health information subject to United States HIPAA regulations" (Maps Platform Terms). Google's list of services under those terms includes the Maps Embed API and the Maps Static API, and Google says only the services on that list are covered by those terms (Google). Google's privacy policy lists "Products that are integrated into third-party apps and sites, like ads, analytics, and embedded Google Maps" among its services, and says it collects "information about the interaction of your apps, browsers, and devices with our services, including IP address, crash reports, system activity, and the date, time, and referrer URL of your request" (Google Privacy Policy).

A map of your street address on a general contact page is a different case from a map on a page that confirms a patient's appointment. Where a map sits, and what the page around it reveals, decides the risk. How these terms apply to your own pages is a legal question, so talk to your counsel.

Which clinic pages matter most

HHS says tracking technologies on user-authenticated pages, such as a patient portal or telehealth platform, "generally have access to PHI," and that tracking on an unauthenticated page that permits people "to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances" (HHS). A banner on the same page notes that on June 20, 2024, a federal court in Texas vacated part of the guidance, to the extent it says HIPAA obligations are triggered when technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers (HHS).

Page	Why it matters	What to do with embeds
Booking, appointment request and booking confirmation	HHS names scheduling pages as ones where tracking may have access to PHI (HHS)	No embeds. Link out to video and directions
Intake forms, quizzes and symptom checkers	HHS names symptom-checker tools (HHS); visitors type or select health details	No embeds
Patient portal and telehealth	HHS says tracking on logged-in pages generally has access to PHI (HHS)	No embeds
Condition and treatment pages	The URL names a condition; HHS's guidance on these pages was vacated in part (HHS)	Privacy-enhanced YouTube, or a thumbnail that links out
Contact and location	Usually a street address, not a health detail	Your address with a directions link; decide on a live map with counsel
Blog and general education	Least sensitive, but the URL still reaches Google with the IP address	Privacy-enhanced YouTube

How to check your site in five minutes

• Run the free scan. Enter your homepage, your booking page and your top service pages in Curve's free compliance scanner. It lists the ad pixels, analytics, session recording and other trackers it finds on each page. See how free HIPAA website scanners compare.
• Find the embeds. View the page source and search for "youtube.com/embed", "youtube-nocookie.com" and "google.com/maps/embed". Note which pages carry each one.
• Watch what loads. Open your browser's developer tools, go to the Network tab, reload the page and filter for "google" and "youtube" to see what loads before anyone presses play.
• Start with the sensitive pages. Booking, intake, symptom checker, portal and confirmation pages first, then condition and treatment pages.
• Decide page by page. Keep it in privacy-enhanced mode, replace it with a link, or remove it.

Safer patterns

• Link out on booking and intake pages. Show a thumbnail image hosted on your own site and a link to the video on YouTube. A plain link loads nothing from YouTube until the visitor clicks it.
• Use privacy-enhanced mode where you keep YouTube. Swap the embed domain to https://www.youtube-nocookie.com, as YouTube describes (YouTube Help).
• Replace the live map with an address and a link. Show your street address, a photo of your entrance and a link to directions on Google Maps. Google lists the Maps Static API under the same terms as the Maps Embed API, so a static map image from that API is not a way around them (Google).
• Host sensitive video with a vendor that signs a BAA. Vimeo says "Eligible Vimeo Enterprise clients can configure their account to support HIPAA-compliant video delivery after signing a Business Associate Agreement (BAA)." Wistia says "Wistia is not HIPAA compliant and does not sign BAAs." (Vimeo; Wistia).
• Keep ad pixels off the same pages. An embed is one of several things on a page that can contact a third party. See how to remove the Meta pixel from a healthcare website.

How Curve Compliance helps

Start with the free scan: it lists the pixels and trackers on a page, so you can see what your site loads before you decide what to change. Curve's team then reviews what your website sends to Meta, Google and TikTok with you.

For the ad side, Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Event Logs show what Curve sent and what each platform accepted. Curve's consent management runs alongside the tracking. Curve signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. See HIPAA compliant Meta pixel alternatives.

Sources, checked October 26, 2026: Google, How Google uses information from sites or apps that use our services; YouTube Help, Embed videos and playlists; Google Privacy Policy; Google Maps Platform Terms of Service; Google Maps Platform services list; Maps Embed API overview; Google Maps Help, Share, send, or print directions; HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates; Curve's BAA Directory.

Frequently Asked Questions

Do YouTube and Google Maps embeds share patient data with Google?

They share visitor data with Google: Google says a YouTube embed makes the browser send it the page URL and IP address, and its privacy policy covers embedded Google Maps (Google; Google). Whether that is patient data depends on the page, so keep embeds off booking, intake and portal pages.

Is embedding a YouTube video on a clinic website a HIPAA violation?

HIPAA turns on whether PHI is disclosed, not on the embed itself. HHS says tracking on pages where people schedule appointments or use a symptom checker may have access to PHI in certain circumstances, so a video on an education page is a different case from one on a booking page (HHS).

Does youtube-nocookie.com stop all tracking?

YouTube says privacy-enhanced mode keeps views from personalizing YouTube or ads (YouTube Help). Its page does not say the browser stops contacting Google, and the player still loads from youtube-nocookie.com, so treat it as a safer default, not a fix for sensitive pages.

Can I embed Google Maps on my contact page?

A map of your street address on a general contact page is a different case from a map on a booking or confirmation page. If you build it with the Maps Embed API, Google's Maps Platform Terms say you will not use the services "to transmit, store, or process health information subject to United States HIPAA regulations" (terms; services). Your street address with a link to directions on Google Maps gives patients the same help and loads nothing from Google until they click.

Does a cookie banner cover YouTube and Maps embeds?

Not for HIPAA. HHS says "Website banners that ask users to accept or reject a website's use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization" (HHS). See consent management vs HIPAA authorization.

Which pages should not carry embeds?

Booking and appointment request pages, intake forms and quizzes, symptom checkers, patient portals, telehealth pages and booking confirmations. HHS names scheduling and symptom-checker pages, and says tracking on logged-in pages generally has access to PHI (HHS).

Which video hosts sign a BAA?

Vimeo says eligible Vimeo Enterprise clients can set up HIPAA-compliant video delivery after signing a BAA, and Wistia says it does not sign BAAs (Vimeo; Wistia). The BAA Directory covers more tools.

Talk to Curve Compliance

Book a call. Run the free scan to see what your pages load, then book a call. Curve's team reviews what your website sends to Meta, Google and TikTok with you, and Curve sends your conversions server-side under a BAA on every plan. Book a call with Curve.