No. Google will not sign a Business Associate Agreement for Google Analytics, and says so on its own help page. Without that signature, Google Analytics cannot lawfully receive protected health information, and no setting on your side changes it.
That is the whole answer. The rest of this page is the evidence, the part that is more complicated than the headline, and what to do if the tag is already on your site.
What Google actually says
Most articles quote one sentence from Google. Four are worth reading, all from the same page, "HIPAA and Google Analytics," in Google's own help center.
"Google makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service."
"HIPAA-regulated entities using Google Analytics must refrain from exposing to Google any data that may be considered Protected Health Information (PHI)."
"Customers who are subject to HIPAA must not use Google Analytics in any way that implicates Google's access to, or collection of, PHI."
"Authenticated pages are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages."
And then the line that tells you how Google itself feels about the risk:
"Please work with your legal team to identify pages on your site that do not relate to the provision of health care services, so that your configuration of Google Analytics does not result in the collection of PHI."
Read that last one twice. The vendor is telling you to involve a lawyer before you decide where its free product can go. Vendors do not write that sentence casually. Two things follow.
This is structural, not a policy that might loosen. Google Analytics is free, and it is free because of what Google does with the data. A BAA would constrain exactly that. Waiting for Google to change its mind is not a plan.
A BAA somewhere else at Google does not help. Google Cloud and Workspace offer BAAs covering a defined list of services. Analytics is not on it, and a BAA covering one product does not travel to another. If a colleague says "we already have a BAA with Google," ask which agreement and which products it names.
Why no configuration fixes this
This is where most healthcare marketing teams lose a year. Every one of these is a real feature that does something useful, and none creates a business associate relationship, because only Google can do that and Google has declined.
The three that come up most
IP anonymization. GA4 no longer stores IP addresses at all, and it is still not compliant. It still sets a client ID, collects the page path, records the referrer, and captures whatever you put in event parameters. A path like /services/behavioral-health/intake carries the meaning the IP address was only a key for.
Consent Mode and cookie banners. Consent under a privacy statute is a different legal mechanism from HIPAA authorization, which is specific, written, revocable, and names the recipient and purpose. No banner makes a vendor a business associate. Banners are also routinely misconfigured so tags fire before the choice is made, which means the disclosure already happened by the time the visitor declines.
Server-side tagging. It puts a server you control between your site and the destination, which is useful, and it does not change the destination. Relay hosts sign a BAA for the relay, an honest offer about the service they provide, and it binds them, not Google. Put it to any relay vendor in one sentence: does your BAA cover Google? It does not. Server-side tagging won't save you goes through this in detail.
Google Signals
This is the one almost nobody checks, and it is a toggle in your GA4 admin panel. With Google Signals on, GA4 collects data from visitors who have turned on Ads Personalization in their Google account, and Google is then, in its own words, "able to develop a holistic view of how those users interact with an online property from multiple browsers and multiple devices." Google also states that signed-in data expires after 26 months.
Read that as a hospital marketer. Cross-device, cross-browser, tied to a signed-in Google account, retained for a little over two years. That is not pageview counting. That is an identity graph, and your service-line pages are feeding it.
Google's reports show only aggregated data, which is true and beside the point: the question under HIPAA is what the vendor received, not what it shows you.
If you take one action from this page before you finish reading it, open GA4 admin, find Data Collection, and check whether Signals is on.
| Workaround | What it genuinely does | Google signs a BAA? | Stops data reaching Google? |
|---|---|---|---|
| IP anonymization | Removes one identifier | No | NoClient ID, page path and referrer still flow |
| Consent banner or Consent Mode | Satisfies a different law | No | PartlyOnly for visitors who decline, and only if wired correctly |
| Server-side GTM | Gives you a filter point you control | No | PartlyOnly what you configure it to drop |
| Turning off Google Signals | Stops cross-device identity association | No | NoOrdinary collection continues |
| Excluding PHI from event parameters | Necessary, and not sufficient | No | NoThe page path alone can carry it |
| Removing tags from authenticated pages | Follows Google's own instruction | No | YesOn those pages only |
What counts as PHI on a website, after the June 2024 ruling
This is the part most vendor content gets wrong in one direction or the other.
In December 2022, HHS OCR published a bulletin on online tracking technologies, revised in March 2024. Part of it said an IP address combined with a visit to a public page about a health condition or provider could itself be protected information. OCR called that pairing the proscribed combination. On June 20, 2024 the U.S. District Court for the Northern District of Texas vacated that portion in American Hospital Association v. Becerra. HHS filed a notice of appeal in August 2024 and withdrew it about two weeks later. There is no appellate ruling.
The bulletin is still posted on HHS.gov, carrying this note:
"On June 20, 2024, the U.S. District Court for the Northern District of Texas issued an order declaring unlawful and vacating a portion of this guidance document."
The page shows a last-reviewed date of June 26, 2024. No replacement guidance has issued.
What it changed: OCR's most aggressive theory, that a visit to an unauthenticated public page about a health topic is by itself a disclosure of PHI, is gone.
What it did not change:
- The rest of the bulletin stands. Authenticated pages, patient portals, logged-in scheduling and mobile apps are still covered.
- The underlying obligation is untouched. A vendor that receives PHI on your behalf is a business associate and needs a BAA or a patient authorization. That is the Privacy Rule, not guidance.
- Google's own instruction is unchanged. It still says not to tag authenticated pages.
- Every other legal theory is untouched, and those are the ones that produced the money.
One honest caveat: the opinion does not expressly address whether the vacatur operates nationwide or only as to the plaintiffs. Most commentators read vacatur of agency guidance under the Administrative Procedure Act as universal. The court did not say.
We are not lawyers and this is not legal advice. Take the specifics of your site to your privacy officer or outside counsel.
Has anyone actually been penalized for this?
Vocabulary matters, and getting it wrong is how a marketing deck loses the room when a general counsel reads it. A class settlement is not a fine. Consumer refunds are not a penalty. A pending complaint is an allegation.
HHS OCR has never brought an enforcement action premised on website tracking
Not a resolution agreement, not a civil money penalty, not one. We checked OCR's own published enforcement list in September 2026. Its recent actions are ransomware, Security Rule failures, breaches and right-of-access complaints.
The closest it has come is not enforcement at all: in July 2023 OCR and the FTC jointly sent warning letters to roughly 130 hospital systems and telehealth providers about tracking technologies, naming the Meta Pixel and Google Analytics. A warning letter carries no penalty and resolves nothing.
So if you have been told OCR is about to come for your tag, the public record does not support it. Keep reading anyway. The exposure is real and it came from somewhere else.
The FTC has been the active federal enforcer
Not under HIPAA. Under the FTC Act, the Health Breach Notification Rule and consumer protection statutes. GoodRx paid a $1.5 million civil penalty in February 2023. BetterHelp agreed to $7.8 million in consumer refunds the same year. Cerebral settled in April 2024 for $5.1 million in refunds plus a $10 million civil penalty suspended to $2 million. The FTC, Utah and California sued Hims & Hers in July 2026 over alleged sharing of health information with Meta and Snap; that case is pending, nothing has been adjudicated, and the company denies the allegations.
The settlements that named Google Analytics
Most coverage of this topic is about the Meta Pixel. It is the more famous tag, and after three years of litigation it has largely been removed. Google Analytics is the tag that stayed, and it has been named in a long line of cases. These are class settlements; in every one the defendant denies wrongdoing, and none is a finding of liability.
| Matter | Amount | Trackers named | Final approval |
|---|---|---|---|
| Kaiser PermanenteN.D. Cal. | $46M to $47.5M | Google, Microsoft Bing, X. Not Meta | Jul 22, 2026 |
| Sutter HealthSacramento Superior Court | $21.5M | Google Analytics and Meta Pixel on the patient portal login, 2015 to 2020 | Mar 6, 2026 |
| Advocate Aurora HealthE.D. Wis. | $12.225M | Meta Pixel and Google Analytics | Jul 10, 2024 |
| Garnet Health; Northwell Health; Catholic Health of BuffaloKings and Erie County, NY | $15 to $20 per portal user | Meta Pixel and Google Analytics on portals, plus monitoring | Apr 2026 |
Proposed, with final approval hearings held or scheduled. The word is proposed, not paid. Where a hearing date has passed, we have not been able to confirm the outcome on the public record and say so rather than assume it.
| Matter | Amount | Trackers named | Final approval hearing |
|---|---|---|---|
| Allina Health SystemAhlers v. Allina Health System, D. Minn. | $12.5M | Meta and Google pixels; class period Sep 16, 2018 to May 11, 2026 | Sep 24, 2026Hearing held; outcome unconfirmed |
| Atrium HealthRoberts v. The Charlotte-Mecklenburg Hospital Authority, Mecklenburg County Superior Court, NC, No. 25CV057073-590 | Up to $1.8M | Meta and Google on the patient portal | Sep 30, 2026Hearing held; outcome unconfirmed |
| Penn MedicinePhiladelphia Court of Common Pleas | Up to $9.25M | Meta Pixel, Google, other analytics and ad technologies | Nov 12, 2026 |
| Wellstar Health SystemN.D. Ga. | $4.5M | Pixels and tracking tools to Google and Meta | Dec 1, 2026 |
| Cone HealthM.D.N.C. | $1,765,000 | Pixels to Google and Meta on MyChart and submission forms | Nov 5, 2026 |
| Concord HospitalHillsborough Superior Court, NH | $800,000 | Google Analytics and an agency's pixels | Nov 3, 2026 |
Three things worth pulling out of those tables.
California's Invasion of Privacy Act, a wiretapping statute from 1967, is the engine behind several of the largest. Pennsylvania's wiretap act carries Penn Medicine. Allina's complaint ran on the federal Electronic Communications Privacy Act together with the Minnesota Health Records Act and Minnesota's deceptive trade practices statute. The June 2024 federal ruling touched none of it.
Concord Hospital is a small New Hampshire system and its proposed figure is $800,000. That will not make national news and it will still end a marketing department's year.
Eisenhower Health agreed to a two-year ban on the Meta Pixel and other tracking tools plus a standing web governance committee. Penn Medicine agreed that for two years no analytics or advertising technologies run on pennmedicine.org unless its web governance committee determines the use is consistent with applicable law. LifeStance Health agreed to five years of using only tools fully compliant with the HIPAA Rules. Once terms like that exist, the vendor question stops being "is this defensible" and becomes "can I put a signed BAA in front of the committee."
We already sent PHI to Google Analytics. Now what?
This is the most common question we get and the one nobody writing about this answers. It deserves a straight response, including the unflattering parts.
What GA4 deletion actually does
GA4 has a data-deletion request feature. It is real, worth using, and narrower than it sounds. From Google's own documentation:
- Deleted text is replaced with
(data deleted), but the event is still counted in your reports. The row does not disappear. - Numeric parameters are not deleted, nor are text parameters derived from internal trusted identifiers.
- Many auto-collected parameters cannot be deleted individually, only by deleting all parameters on all events.
- Data must be more than 12 days old before it can be deleted.
- A request takes 7 to 63 days to process, the first 7 being a grace period in which it can be cancelled.
- A property can have at most 12 active requests at a time.
Google's documentation does not address what happens to data already exported to BigQuery, or already used for advertising or associated through Signals. That silence is worth noting in your incident write-up.
The honest summary: deletion is a real remediation step and not an undo button. Plan for a partial, slow, incomplete removal and tell your privacy officer that up front rather than after they ask.
The order to do this in
Not legal advice. This is the sequence that keeps you from making it worse, and every step belongs in front of your privacy officer or counsel.
- 01Stop the flow first.
Pull the tags from authenticated pages, appointment flows and condition pages before anything else. Remediation while collection continues is not remediation.
- 02Find out what was sent.
DevTools, Network tab, on your homepage, an appointment page, a condition page and the portal login if it is public. Filter for googletagmanager, google-analytics, gtag and doubleclick. Look at the payloads, not just the requests, and screenshot everything with dates.
- 03Check Google Signals and the Google Ads link.
If either was active, the scope is larger than the Analytics interface alone suggests.
- 04Bring it to your privacy officer the same week.
Whether this is a reportable breach is their determination with counsel, not marketing's and not ours. Bring the network logs and the date range, not a summary.
- 05File the deletion requests, with realistic expectations.
See above. Plan for partial, slow, incomplete removal.
- 06Put the replacement in before the reporting gap gets political.
The failure mode we see most is a team that removes the tag, loses all measurement, and quietly puts something back six weeks later because leadership wants its numbers.
What to use instead
Three architectures, and everything on the market is a variation of one. Replace the tool with a platform that signs a BAA and holds the data under it. Keep GA4 behind a compliance layer that strips identifiers in transit, accepting that you are paying to keep a destination that will never sign and that the filter now carries your posture alone. Or self-host, which does not remove the compliance work so much as hire it, permanently.
There is a fourth thing people do, which is not an architecture: turn everything off. It is the only option that guarantees you cannot answer a board question about which campaigns produce patients, and it is more common than vendors admit. Proving marketing works without tracking individuals is the version of that conversation worth having instead.
If you want the vendor-by-vendor version of this, with which tools sign a BAA and on which plan, two pages go deeper. HIPAA-compliant Google Analytics alternatives is the replacement shortlist with prices attached. The 2026 buyer's guide compares thirteen tools across the whole category.
The question to ask any vendor is not "are you HIPAA compliant?" Every vendor finds a way to say yes. Ask: will you sign a BAA on the specific plan I am buying? That has a yes or no answer, and several vendors that sign only sign on their top tier, so get the plan name in writing. Then four more: where is the data stored, do you hold a BAA with your own hosting provider, is any customer data used for advertising or model training or resale, and can we see the BAA before we commit?
Ghost Metrics is what we built, and our pricing is public, including which plans include the BAA. The answer is all of them.
Frequently asked questions
Is Google Analytics HIPAA compliant?
No. Google states it makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with the service. Because Google will not sign, no configuration on your side makes it compliant for pages that involve PHI.
Does Google sign a BAA for Google Analytics?
No. Google offers BAAs for certain Cloud and Workspace services. Analytics is not among them, and a BAA covering one Google product does not extend to another. If a colleague believes you already have one, ask which agreement and which services it names.
Can hospitals use Google Analytics at all?
Google's own instruction is not to tag authenticated pages, and to work with your legal team to identify which pages do not relate to the provision of health care services. Some organizations read that as permission to run GA on a careers page or a press room. That is a call for your counsel and privacy officer, and it means somebody owns that boundary permanently, including every new service-line page marketing publishes. Most teams find one platform on every page is less work than a boundary they have to defend.
Does IP anonymization make Google Analytics HIPAA compliant?
No. GA4 does not store IP addresses at all and is still not compliant. The requirement is a signed BAA with the recipient, not the absence of one identifier. A client ID, a page path and a referrer carry the same meaning the IP address did.
Didn't a court throw out the HIPAA tracking rules in 2024?
Part of one guidance document, not a rule. On June 20, 2024 a federal court in Texas vacated the portion of the HHS bulletin treating an IP address plus an unauthenticated page visit as protected information. HHS appealed and withdrew weeks later. The rest stands, including its treatment of authenticated pages and the BAA requirement, and it is still posted with a note about the vacatur. More importantly, the large settlements were brought under state wiretap and medical confidentiality law, which that ruling did not touch. Ask your counsel about state law exposure specifically.
We already ran Google Analytics on our portal. What now?
Stop the collection, document what was sent with network logs and dates, check whether Google Signals and a Google Ads link were active, and bring it to your privacy officer the same week. Whether it is a reportable breach is their call with counsel. GA4 data-deletion requests help, and are slower and narrower than they sound: data must be more than 12 days old, processing takes 7 to 63 days, and deleted text is replaced with a placeholder while the event still counts in your reports.
Where to go next
- The replacement shortlist, with prices: HIPAA-compliant Google Analytics alternatives
- The ten-minute audit of your own site: HIPAA guide and audit
- Why this product was never built for healthcare: Google Analytics was never built for healthcare
- A PHI leak in an actual network log: Anatomy of a PHI leak
- The settlements, read closely: Allina and Atrium pixel settlements
- By vertical: hospitals, dental, behavioral health
- How we handle the data: Security
This page is general information about HIPAA and website analytics, not legal advice. Settlement figures and vendor terms were checked against primary sources on October 6, 2026.