HIPAA-Compliant Google Analytics Alternatives: What to Switch To in 2026

Short answer: Google will not sign a Business Associate Agreement for Google Analytics, and says so in its own documentation. If your website collects, displays or routes protected health information, that rules GA4 out on those pages. The replacements that will actually sign a BAA are Ghost Metrics, Piwik PRO, Freshpaint, Adobe Customer Journey Analytics, Celebrus, and a handful of product-analytics tools built for software rather than health systems. The differences that matter are which plan the BAA comes with, whether pricing is public, and whether the vendor hosts your data or hands you a server to harden yourself.

Google's own support documentation says it plainly:

"Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service."

The same page tells covered entities they "must not use Google Analytics in any way that implicates Google's access to, or collection of, PHI, and may only use Google Analytics on pages that are not HIPAA-covered."

That is not a gap Google plans to close. It is a product decision, and it has been consistent for years. We go through the whole question, including every workaround people try, in Is Google Analytics HIPAA compliant?

Meta's Business Tools Terms take the same shape from the other direction, prohibiting the sharing of data that "includes or is based on, directly or otherwise, health information."

So the question is not whether you can configure your way into compliance with a vendor that has declined to be your business associate. The question is what you replace it with.

What the enforcement record actually says

Two things get confused here constantly, and getting them straight will save you an argument with your general counsel.

The June 2024 ruling did not clear this. In AHA v. Becerra (N.D. Tex., June 20, 2024), the court vacated one specific piece of the HHS OCR bulletin on tracking technologies: the theory that an IP address combined with a visit to an unauthenticated public health page is itself protected information. A permanent injunction was denied. HHS filed a notice of appeal on August 19, 2024 and withdrew it about ten days later, so no appellate ruling exists. Everything else in the bulletin is still posted, including the guidance on authenticated pages and on vendors needing a BAA.

The money never came from HIPAA anyway. Almost every large payment in this area came from state wiretap statutes, medical confidentiality laws, common-law privacy claims and the FTC's deception theory. The AHA ruling touched none of those.

Several hearings on the calendar right now are worth watching, because the forward-looking terms are the part that changes what a marketing department is allowed to install: Mount Sinai Medical Center of Florida (October 13, 2026), LifeStance Health (October 16, 2026, $3,027,874, five years of using only tools fully compliant with the HIPAA Rules), Bayhealth (October 29, 2026), Concord Hospital (November 3, 2026, $800,000, a matter that named Google Analytics and Geonetric pixels), and Penn Medicine (November 12, 2026, up to $9.25 million, two years with no analytics or advertising technology unless a web governance committee approves it).

None of this is legal advice, and none of it tells you what your organization's exposure is. That is a conversation for your privacy officer and your counsel. What it does tell you is which direction the risk is moving.

Every roundup on this topic lists tools. Almost none of them names the three architectural choices underneath, and the choice you make there determines which tools are even on your list.

Replace it. Take Google Analytics off the site and put a platform that signs a BAA in its place. One script swap. You get the reporting back immediately and you stop sending anything to Google. This is what most health systems end up doing.

Wrap it. Keep GA4 and put a BAA-backed privacy layer in front of it that strips or blocks what it decides is PHI before it reaches Google. Freshpaint, Geonetric's Privacy Filter and Unlock Health sell this. It is genuinely easier politically, because nobody has to give up their Google Ads workflow.

It is also a bet. Google's own text says covered entities may use Analytics "only on pages that are not HIPAA-covered." A filter changes what reaches Google. It does not change what Google says about the product, and it does not make Google your business associate. Concord Hospital's proposed $800,000 settlement named both Google Analytics and Geonetric pixels. That is one matter, not a verdict on the category, but it is worth knowing before you sign.

Turn it off. Some organizations pull every tag and run blind. It is compliant and it is expensive: you are now buying paid search without knowing which pages convert, and the usual ending is that something quietly goes back on the site six weeks later because leadership wants its numbers. Proving marketing works without tracking individuals is the better version of this conversation.

One thing worth saying about where the exposure actually sits. Most of the public attention has been on the Meta Pixel, and after three years of litigation it has largely come off healthcare sites. The Google stack is the tag that stayed, usually GA4 paired with Google Ads conversion or remarketing tags, and it is the one named in the Sutter, Kaiser, Advocate Aurora, Allina and Concord matters above. If you are auditing your own site, start there rather than with Meta.

This is the table the other roundups will not print. "Signs a BAA" is not a yes or no. It matters enormously which plan the BAA comes with, because on several of these platforms the answer is "the one with no published price."

Four things fall out of that table.

Ghost Metrics is website analytics for healthcare organizations. We sign a Business Associate Agreement with every customer on every plan, including the $299 one. Each customer's data is logically isolated on US-hosted infrastructure, and identifiers are stripped before storage. Nothing is shared, sold or used for advertising, because there is no advertising business on the other end of it. We hold SOC 2 Type II.

What is in the product on every plan: real-time visitors, acquisition and campaign reporting, custom events for appointment requests and form submissions, conversions and goals, and a reporting API. Premium and Enterprise add funnels, heatmaps and session recording, A/B testing, cohorts, form analytics and a custom report builder. Also in the product: a tag manager with live, staging and dev environments, bot and cloud-IP filtering, and rollup reporting across sites for groups and systems. How the hosting, encryption and audit logging work is on the security page, and the data terms are in our DPA.

Pricing is on the website because hiding it wastes everyone's time:

The embed is a standard JavaScript snippet, so the swap itself is an afternoon, not a project. There is no free trial, and that is deliberate: a BAA has to be signed before real traffic flows, so we demo on a live instance instead. Full detail is on the pricing page and the product page.

Where we are not the answer: if you are a software company that needs product analytics on an application, buy a product analytics tool. If you are committed to keeping GA4 and the Google Ads stack and want a filter in front of it, that is Freshpaint's pitch and they do it well, and you should read Section 2 before you decide.

Nobody else on this result set will tell you this, so here it is straight.

Six steps, in order. Most teams can do the first three in an afternoon and the rest inside a week.

• The full category comparison, thirteen tools: the 2026 buyer's guide
• The Google question in full: Is Google Analytics HIPAA compliant?
• Audit your own site in ten minutes: HIPAA guide and audit
• What a PHI leak looks like in a network log: Anatomy of a PHI leak
• The settlements, read closely: Allina and Atrium pixel settlements
• See it on a live instance: book a demo

This page is general information about HIPAA and website analytics, not legal advice. Settlement figures and vendor terms were checked against primary sources on October 6, 2026.