Is Google Analytics HIPAA Compliant? What Healthcare Sites Must Do in 2026
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/is-google-analytics-hipaa-compliant
Last updated: October 20, 2026
Is Google Analytics HIPAA compliant? No. Google will not sign a Business Associate Agreement (BAA) for Google Analytics. HIPAA requires a BAA before a business associate, a vendor that handles protected health information (PHI) for you, can receive it (45 CFR § 164.308(b)). So the answer to "is Google Analytics HIPAA compliant" is settled by Google itself. Google's Analytics help page, checked October 20, 2026, says Google does not claim that Google Analytics meets HIPAA requirements. It also offers no BAA for the tool. No setting changes that. The real question is which of your pages collect PHI. Booking pages, intake forms, and patient portals do. On those pages, GA4 has to go.
TL;DR: Is Google Analytics HIPAA compliant?
Google Analytics is not HIPAA compliant. Google will not sign a BAA for it, and 45 CFR § 164.308(b) requires one before a vendor handles PHI on your behalf.
A federal court vacated part of the HHS tracking guidance on June 20, 2024. It covered only IP addresses on public health pages. Trackers that send portal, booking, or intake data to a vendor with no BAA still violate HIPAA.
The lawsuit risk is real money. In 2026, courts approved pixel class action settlements, including $47.5 million (Kaiser) and $12.5 million (Allina Health). The Allina suit named Google Analytics.
You can check your own site in about 15 minutes with browser dev tools. Watch which third parties get data when a booking or intake page loads.
Safer tools exist, including self-hosted analytics and vendors that sign BAAs. Dropping GA4 does not mean losing your traffic data.
Want outside help with the check? We sell a client-side compliance review, so weigh our view with that in mind.
Google will not sign a BAA, and that settles it
HIPAA treats a vendor that creates, receives, maintains, or transmits PHI on your behalf as a business associate (45 CFR § 160.103). Before that vendor touches one record, 45 CFR § 164.308(b) and § 164.504(e) require a signed BAA. Google does sign BAAs for some products. Google Workspace and Google Cloud each cover a set list of services. As of October 20, 2026, neither Google Analytics nor Google Tag Manager is on either list. Google's HIPAA page for Analytics also says Google offers no BAA for the service. Google's productivity suite is a different story from Analytics; the BAA path is in Google Workspace HIPAA compliance. File storage sits on the covered side of that list. Our answer to is Google Drive HIPAA compliant covers what the Workspace BAA does and does not fix for stored files.
Google's terms add a second wall. The Google Analytics terms ban sending Google any data it could tie to a person. So even with a BAA, the tool is not built to hold health data. No plugin or IP masking feature makes Google Analytics HIPAA compliant. A setting cannot fix a missing contract.
When does analytics data become PHI?
PHI is health information that points to a person, or could, under 45 CFR § 160.103. On a website, identity and health context combine fast. A tracking script on a booking page can grab a visitor ID, the page URL, the provider picked, and the visit type in one request. Together, that says a known person sought care for a condition. That is PHI. Sending it to a vendor with no BAA is an impermissible disclosure under 45 CFR § 164.502(a).
The highest-risk spots are patient portals and other pages behind a login. So are booking and scheduling flows, and intake or contact forms that ask about symptoms. Condition pages that feed a booking funnel belong on the list too. Chat widgets and AI chatbots on those pages raise the same BAA question, as our guide to HIPAA compliant AI hosting explains. A blog post read by an unknown visitor is a different case. That is where the 2024 court ruling comes in.
The 2024 ruling narrowed OCR guidance, not your lawsuit risk
In American Hospital Association v. Becerra (N.D. Tex., June 20, 2024), a federal court vacated one part of OCR's tracking guidance. OCR, the HHS Office for Civil Rights, had said an IP address plus a visit to a public health information page is PHI by itself. HHS appealed, then asked the Fifth Circuit to dismiss its own appeal. The appeal was dismissed on September 4, 2024, so that part of the guidance is gone. HHS says it is still evaluating its next steps.
Here is what did not change. Trackers on login-protected pages, like patient portals, still trigger HIPAA. Trackers that send form entries, visit details, or health answers to a vendor with no BAA still break the rules. And the ruling did nothing to stop class actions, state privacy laws, or Federal Trade Commission cases. It also did not change the answer to "is Google Analytics HIPAA compliant."
The lawsuits show where the money goes. These are class actions brought by patients, not HHS fines. Each one ended in a court-approved settlement, not a finding of liability:
Kaiser Foundation Health Plan, $47.5 million (2026). A federal judge in California granted final approval on July 14, 2026. Patients alleged that code on Kaiser's website and apps let third parties, including Google, intercept their health information.
Allina Health, $12.5 million (2026). A federal judge in Minnesota granted final approval on September 24, 2026. The suit alleged that Allina used the Meta Pixel and Google Analytics on its websites.
Advocate Aurora Health, $12,225,000 (2024). A federal judge in Wisconsin granted final approval on July 10, 2024. Patients alleged that pixels on its websites, app, and patient portal sent their data to Meta and Google.
Novant Health, $6.66 million (2024). A federal judge in North Carolina entered the final approval order and judgment on June 17, 2024. It covered data that tracking tools on Novant's websites and MyChart patient portal allegedly disclosed.
Trackers are easy to miss, because nothing visibly breaks when they send data. That is why they also appear in our roundup of eight unintentional HIPAA violations.
Where Google Analytics can and cannot run
Since Google Analytics is not HIPAA compliant, GA4 cannot run on patient portals or any page behind a login. It cannot run on booking flows, intake forms, or thank-you pages that confirm a visit. Those pages tie a known visitor to a care decision. It should not run on condition pages that collect any user input. Google agrees: its help page says authenticated pages are likely HIPAA-covered, and that customers should not put Google Analytics tags on them. Google Analytics is one piece of a bigger picture; for every tracker you run, see our guide to HIPAA tracking technologies.
After the 2024 ruling, GA4 on plain public pages, like a general blog, carries lower HIPAA risk. It is not zero risk. Washington's My Health My Data Act covers consumer health data more broadly than HIPAA, and people can sue under it. Privacy suits over health-related tracking keep coming. Two leaks are easy to miss. One is a forgotten Google Tag Manager container that loads GA4 and ad pixels on every page, including a booking flow. The other is a GA4 tag that was "removed" from the theme but still loads through a plugin.
How to check your own site in 15 minutes
Open your booking or intake page in Chrome. Press F12 and select the Network tab. Reload the page. Then filter requests by "google-analytics," "googletagmanager," "facebook," and "doubleclick." Each match is a third party getting data from that page. Next, submit a test form entry and watch for new requests. If a request contains your test name, email, or answers, that data is leaving your site. Repeat this on every page where patients type anything. Last, open your tag manager account and look for tags you do not know. Agencies, old plugins, and theme demos all leave trackers behind.
This quick check finds the obvious leaks. It will not catch everything. Scripts can load only on some devices, or pass data through server-side proxies and chained tags that a manual check misses.
When to bring in a professional review
If your site takes booking requests, intake details, or any patient information, a one-time review should document what each page sends, and to whom. If you want outside help, ask about our client-side compliance review. HIPAA Compliant Hosting sells this service, so we have a commercial interest here. We still publish the manual check above, because a practice that finds its own pixel problem this week beats one that waits. Whoever does the review, keep a written record of each tracker you found and how you fixed it.
Safer ways to measure your traffic
Dropping GA4 from patient-facing pages does not mean flying blind. Self-hosted Matomo On-Premise keeps visitor data on your own server, so no analytics vendor gets it. Your host still holds that data, so on pages with PHI the server needs a BAA too. Some vendors offer a BAA instead. Piwik PRO's help center says HIPAA use needs its Enterprise plan and a signed BAA. Freshpaint sells a BAA-covered tracking layer for healthcare marketing. Cookieless, count-only tools collect so little that they can avoid identity problems on info pages. Whichever you pick, get the BAA answer in writing before the tag goes live. If an agency manages your analytics, HIPAA compliance for marketing agencies explains what it must do to stay compliant.
Server logs can answer basic traffic questions with data you already hold. When they record visits to portal, booking, or intake pages, they can hold PHI, so they belong on hosting that signs a BAA. Our guide to HIPAA audit logs covers what to record and how long to keep it. Our HIPAA cloud hosting runs on single-tenant AWS, with a BAA signed within 24 hours of signup and six-year audit logging.
Frequently asked questions
Is Google Analytics HIPAA compliant?
No. Google will not sign a BAA for Google Analytics. HIPAA requires one under 45 CFR § 164.308(b) before a vendor can handle PHI on your behalf. No setting changes this.
Can I use GA4 if I turn on IP masking?
Not on pages that handle PHI. GA4 has no IP masking switch to turn on, because Google says GA4 does not log or store IP addresses. That still does not help, because the missing BAA is the failure, not the IP address. GA4 also collects device IDs and page context beyond IP. It does not make Google Analytics HIPAA compliant.
Did the 2024 ruling make tracking pixels legal on health sites?
Only partly. The court vacated OCR's position on IP addresses and public health pages. HHS appealed, then asked the Fifth Circuit to dismiss its own appeal. The appeal was dismissed on September 4, 2024. Trackers that send portal, booking, or form data to a vendor with no BAA still violate HIPAA. Class actions and state laws apply either way.
Have hospitals been sued over Google Analytics?
Yes. Patients sued Allina Health over alleged use of Google Analytics and the Meta Pixel on its websites. The class action settled for $12.5 million, with final approval on September 24, 2026. Kaiser's $47.5 million settlement covered claims about code from several third parties, including Google.
Is Google Tag Manager HIPAA compliant?
No. As of October 20, 2026, Tag Manager is not on Google's lists of BAA-covered services either. Our guide to what the Google Workspace BAA does not cover lists it among the gaps. Tag Manager is also an easy leak source, since one container can load many third-party tags that staff edit without review.
What analytics tools can healthcare websites use?
Self-hosted Matomo, vendors that offer a BAA such as Piwik PRO (Enterprise plan) or Freshpaint, cookieless count-only tools on info pages, and server log reports. Confirm BAA coverage in writing before you deploy any of them.
Recap: is Google Analytics HIPAA compliant?
To recap, Google Analytics is not HIPAA compliant, because Google will not sign a BAA for it. The 2024 ruling trimmed OCR's tracking guidance for public pages. But trackers on portals, booking flows, and intake forms can still create violations. Pixel class action settlements in 2026 alone included $47.5 million (Kaiser) and $12.5 million (Allina Health). Run the 15-minute check above. Remove GA4 from every page that touches patient data. Replace it with a self-hosted or BAA-covered tool. If you want outside help checking whether your setup is Google Analytics HIPAA compliant or not, ask about our client-side compliance review.
This article is general information, not legal advice. Details reflect the HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164) and the OCR tracking guidance after American Hospital Association v. Becerra. Google's HIPAA position is as published on October 20, 2026. Settlement figures come from the court records listed in Sources. Confirm your obligations with qualified legal counsel.
Sources
Google, HIPAA and Google Analytics (checked October 20, 2026)
Google, IP masking in Universal Analytics (GA4 does not log or store IP addresses)
Google Cloud, HIPAA compliance and covered Cloud and Workspace services
American Hospital Association v. Becerra, N.D. Tex. No. 4:23-cv-01110 (docket) and Fifth Circuit No. 24-10775 (appeal dismissed September 4, 2024)
45 CFR § 160.103, definitions of business associate and PHI (eCFR)
Ahlers v. Allina Health System, D. Minn. No. 0:24-cv-03674, final approval order (September 24, 2026) and plaintiffs' preliminary approval memorandum, Doc. 56 ($12,500,000 fund; Meta Pixel and Google Analytics, May 8, 2026)
In re Novant Health, Inc., M.D.N.C. No. 1:22-cv-00697 (docket; order and judgment June 17, 2024) and settlement agreement, Doc. 52-1 ($6,660,000 fund)
Washington RCW 19.373.090, My Health My Data Act enforcement