HIPAA and Google Ads Remarketing for Clinics

The short answer: do not build health remarketing lists

Clinics should not create Google Ads audiences from visits to condition, treatment, appointment or patient pages. Google classifies health as a sensitive interest and says advertiser-curated audiences—including Customer Match and “your data” segments, the current term for remarketing lists—are not supported for covered health promotion.

That platform restriction is separate from HIPAA. A clinic can violate Google policy even when HIPAA does not apply, and a HIPAA-regulated clinic can create a disclosure problem through tracking even when it never activates a remarketing campaign. The safe workflow is to review what data is collected, who receives it, why it is sent and which rule authorizes the use.

1. Apply two separate rule sets

Do not use “HIPAA compliant” as shorthand for “allowed by Google,” or vice versa. Run both reviews and document the result.

2. Confirm whether HIPAA applies to the clinic

HIPAA does not automatically cover every wellness business or every health-related website. It applies to covered entities and business associates. Many healthcare providers are covered entities, but status depends on the organization and its activities. Even if HIPAA does not apply, the FTC Act, the Health Breach Notification Rule, state consumer-health laws and general privacy rules may.

Start with counsel's written determination of the clinic's status. Then identify business associates and vendors that create, receive, maintain or transmit PHI on the clinic's behalf. A marketing label, security badge or vendor claim does not answer that legal question.

HHS says that when a tracking vendor is a business associate, a regulated entity must ensure the disclosure is permitted and enter into an appropriate business associate agreement. A BAA is not magic: it does not make an impermissible purpose permissible, and signing BAA-like terms does not turn a vendor into a business associate when the legal definition is not met.

3. Map the data flow, not just the tag name

A website tag can transmit more than the event label shown in a dashboard. Audit the network request and configuration for:

• full page URLs, titles, query strings and referring pages;
• IP addresses, device identifiers, cookies and advertising IDs;
• form field names, values, validation messages and error text;
• appointment date, practitioner, service, location or reason for visit;
• email addresses, phone numbers, record numbers and login identifiers;
• custom dimensions, data-layer variables and user IDs; and
• session replay, chat, call tracking and embedded scheduling data.

Review direct tags, tag-manager containers, plugins, embedded forms, booking tools and scripts injected by the website platform. A conversion event named “form_complete” may still carry a URL that identifies a condition, or a scheduling widget may transmit fields before submission.

4. Review authenticated and public pages differently

HHS says tracking technologies on authenticated patient portals and telehealth pages generally have access to PHI. Appointment details, record numbers, email addresses, diagnoses and billing information can be exposed there. Advertising tags should not be placed on these pages without a documented legal, vendor and security analysis.

Public pages require a fact-specific review. HHS's guidance says many general unauthenticated pages—such as visiting hours or job listings—may not expose PHI. It also says appointment forms, symptom tools and portal login or registration pages can expose individually identifiable health information.

A condition-page visit may also remain unusable for Google Ads remarketing because Google's sensitive-interest policy is an independent rule.

5. Understand Google's health-audience restriction

Google lists health as a sensitive interest category. For covered health promotion, its current table marks Customer Match, your data segments, audience expansion and lookalike segments as unsupported. Predefined Google audiences can be used because Google says sensitive user signals are excluded, subject to other policy limits.

This means a clinic should not try to:

• remarket to everyone who visited a hormone, fertility, mental-health or chronic-condition page;
• upload patient, lead or newsletter lists to reach or resemble those people;
• use a negative audience as a workaround for positive personalization; or
• rename a health audience with a generic label and assume the underlying signal changes.

Google evaluates the site, app, ads and targeting—not only the audience name. For the broader platform review, see our Google Ads healthcare policy guide for clinics.

6. Keep sensitive and identifying data out of Google Ads

Google's personalized-ad rules prohibit using personally identifiable information with pseudonymous data and sharing PII through audience tags or associated feeds. Independently, HIPAA may restrict a regulated clinic from disclosing PHI to a tracking vendor.

Do not place names, email addresses, phone numbers, patient IDs, appointment reasons, diagnoses, medications or free-text symptoms in URLs, event names, parameters or audience uploads. Do not hash data and assume the privacy analysis disappears; pseudonymization and hashing are not the same as HIPAA de-identification.

Also avoid sending “qualified lead” details that reveal why a person sought care. Operational feedback can often use a non-sensitive status or aggregated count, but the exact design needs review. Our clinic call-tracking guide explains why recordings, caller details and qualification notes need their own access and retention controls.

7. Build a safer measurement hierarchy

There is no universal tag configuration that makes every clinic compliant. A safer plan minimizes data and separates ad optimization from clinical information.

Server-side tagging, a consent platform or a proxy can improve control, but none is automatically HIPAA compliant. HHS states that a privacy notice alone does not authorize PHI disclosure, and a cookie banner is not a HIPAA authorization. Review the actual data before and after any transformation and confirm each vendor relationship.

8. Use acquisition methods that do not depend on health remarketing

• Search by intent: target permitted service queries without building an audience from prior health-page visits.
• Location targeting: use the clinic's eligible service area and current Google requirements.
• Useful landing pages: answer the searcher's question without asserting that Google or the clinic knows their diagnosis.
• Predefined audiences: where strategically useful and permitted, use Google's eligible predefined segments rather than clinic-curated health audiences.
• Contextual placement: evaluate relevant content contexts without targeting an individual based on a health history.
• Aggregate evaluation: compare campaign-level cost with de-identified operational totals after compliance review.

Our broader functional medicine Google Ads guide shows how keyword-led Search can become the acquisition foundation without a remarketing list.

9. Clinic tracking audit checklist

1. Confirm whether the organization is a HIPAA covered entity or business associate.
2. Inventory every website, app, portal, form, scheduler, chat, call and replay technology.
3. Capture the data each tool actually transmits, including URLs and identifiers.
4. Classify authenticated, public information, condition, appointment and login pages separately.
5. Document each vendor, recipient, purpose, permission and contract or BAA analysis.
6. Remove advertiser-curated audiences from sensitive health campaigns.
7. Remove PII, health details and sensitive free text from ad events and URLs.
8. Keep primary conversion goals limited to reviewed, meaningful actions.
9. Test consent behavior, but do not confuse a cookie choice with HIPAA authorization.
10. Have privacy counsel and security specialists approve the design and re-review material changes.

Frequently asked questions

Can a clinic use Google Ads remarketing for health services?

Google does not support advertiser-curated audiences for covered sensitive health promotion. That includes Customer Match and your data segments. Use acquisition methods that do not depend on a visitor's health-page activity.

Does a cookie banner solve HIPAA?

No. HHS says a tracking banner does not constitute HIPAA-compliant authorization. It may serve other consent obligations, but the clinic still needs a valid HIPAA basis for any PHI disclosure.

Is every clinic covered by HIPAA?

No. Covered-entity and business-associate status is fact-specific. Other privacy and consumer-protection laws may apply even when HIPAA does not.

Can a clinic run Search ads without remarketing?

Yes. Search campaigns can target permitted queries and locations without creating a clinic-curated audience from health-page visitors.

Is server-side tracking automatically safe?

No. It changes data handling, not the legal classification or purpose. Inspect every field, recipient, agreement and transformation.

Measure less, but measure deliberately

A clinic does not need health remarketing to run useful Google Ads. Start with search intent, collect only reviewed data, keep clinical details out of advertising systems and evaluate outcomes at the safest useful level. When the answer is unclear, stop the tag and obtain qualified advice before collecting more data.

Wellness Practice Marketing can map campaign tags, conversion actions and landing-page flows for review by your compliance team. To discuss a privacy-conscious Google Ads setup, book a strategy call.

This article provides general marketing education, not legal, privacy, security or regulatory advice. Requirements change and depend on the clinic, data, jurisdiction and implementation.

Authoritative sources

1. HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
2. Google Ads Policy: Health in personalized advertising
3. Google Ads Policy: Restricted targeting in personalized advertising
4. Google Ads Policy: Data use in personalized ads
5. Google Ads Policy: Data collection and use
6. HHS: Business associate contract provisions