One 2026 clarification before the playbook: a federal court partially vacated OCR's online-tracking guidance in June 2024 — specifically the claim that an IP address plus a visit to an unauthenticated health page is automatically PHI. That narrowed one theory. It did not touch HIPAA itself, the FTC's authority, or state laws like Washington's My Health My Data Act. Disclosing identifiable health information to Google without authorization remains what it always was.

This is the complete workflow: policy certification and privacy architecture as one system, because in practice they're configured by the same people in the same account.

Problem 1: Google's healthcare policies (the account-suspension side)

Google restricts healthcare advertising through several stacked policies, and practices trip them constantly:

• Healthcare and medicines policy. Prescription-drug terms are restricted to certified advertisers. The 2026 hot zone is GLP-1 brand names: a med spa or weight-loss clinic bidding on or writing ads containing "Ozempic," "Wegovy," or "semaglutide" without the right certification gets disapprovals that escalate to account suspension. Write to the service ("medical weight loss program") and let the landing page carry the clinical detail.
• LegitScript certification. Telehealth providers, addiction-treatment facilities, and pharmacies must obtain LegitScript certification and register it with Google before running ads. Addiction treatment has its own certification track (a legacy of the rehab lead-gen scandals). Budget 4–8 weeks and real document preparation; it's a prerequisite, not a formality.
• Personalized-advertising policy. This is the one marketers miss: Google prohibits remarketing based on health conditions outright. You cannot build a remarketing list from visitors to your sleep-apnea page — not because of HIPAA, but because Google's own policy bans using health status for personalization. Any agency proposing "site-visitor remarketing" for a medical practice is proposing a double violation: Google policy and HIPAA. (Compliant alternatives live in our healthcare retargeting playbook.)
• Performance Max sprawl. PMax auto-generates assets, expands into placements you didn't choose, and (with auto-generated final URLs on) can send traffic to pages you never vetted. In healthcare, that's a policy-trip machine: an auto-assembled asset pairing your brand with a restricted-term crawl of your blog can flag the account. If you run PMax at all, disable URL expansion, supply every asset yourself, and review search-term and placement reports weekly.

Policy compliance is table stakes. Now the half that actually creates legal exposure.

Problem 2: the default Google conversion stack is a HIPAA problem

Set up Google Ads "the recommended way" and here's what's on your site: the gtag.js library, a Google Ads conversion tag, a remarketing tag, and — if you clicked yes when the interface nudged you — enhanced conversions, which scrapes email addresses and phone numbers from your forms, hashes them, and sends them to Google to match against signed-in Google accounts.

Every layer of that is a disclosure to a company that will not sign a BAA for its ads products:

• The tags send page URLs, and your URLs describe conditions and treatments.
• Cookies and device signals make the visitor identifiable to Google.
• Enhanced conversions sends the patient's own contact identifiers. The "it's hashed, so it's anonymous" defense fails on its face: the hash exists so Google can re-identify the person. Hashing an identifier for a matching system is a disclosure of that identifier with extra steps — it is not de-identification under HIPAA's standard, which requires the information not be re-identifiable. Re-identification is enhanced conversions' entire job.
• Remarketing tags build audiences from patient-page visits — the thing both HIPAA and Google's own personalization policy prohibit.

A consent banner fixes none of this: HIPAA marketing disclosures require signed, specific authorization per individual, which no cookie popup produces. And routing the same data through server-side Google Tag Manager just relocates the disclosure to your server before making it anyway — see Is Google Tag Manager HIPAA compliant? for why "server-side" is a transport detail, not a compliance answer. Same story for analytics: Is Google Analytics HIPAA compliant?

What still works — and works well

Strip the illegal parts and Google Ads remains the highest-intent channel in healthcare, because search is where patients declare need: "emergency dentist open now," "couples therapist near me," "lip filler cost." What survives, cheerfully:

• Search campaigns on intent. Keyword targeting discloses nothing about any individual — it's you choosing queries, not Google profiling patients. This is 70–90% of a compliant healthcare account.
• Call-only and call-extension ads. High-intent healthcare converts by phone. Track calls with pool-based dynamic number insertion handled compliantly (numbers swap based on paid-click recency; call data stays in your BAA-covered stack) — details in HIPAA-compliant call tracking.
• Offline conversion imports via GCLID — the load-bearing pattern. Google appends a click ID (gclid, or wbraid/gbraid on iOS) to every ad click. Capture it first-party, hold it in your own system, and when that click becomes a booked patient, upload the click ID plus a conversion event back to Google. Google learns "click X converted" — never who, never for what. Smart Bidding optimizes on real booked-patient signal. This is the entire trick: conversion events flow out; patient data never does.
• PMax, carefully, with self-supplied assets and URL expansion off — useful for multi-location groups with strong creative discipline, skippable for most single-location practices.

The one workflow: certification + privacy together

Here's how PilotPractice runs it, as a single setup sequence per practice:

Policy track:

1. Classify the practice against Google's healthcare policy (telehealth? addiction services? prescription terms anywhere in the funnel?).
2. Complete LegitScript/Google certifications where required before building campaigns.
3. Scrub keywords, ads, and landing pages for restricted drug terms; write to services, not molecules.
4. Structure campaigns without any health-based audience personalization; document it, because Google's automated flags are appealed with documentation.

Privacy track:

1. Remove gtag, conversion, and remarketing tags from the site. All of them.
2. Deploy the single first-party tracking script — served from the practice's own site, capturing attribution through a strict allowlist: UTM parameters and click IDs (gclid, wbraid, gbraid, and their Meta/Microsoft equivalents). No page-content capture, no fingerprinting, no third-party cookies.
3. A hidden visitor ID stitches the click to the eventual form submission or booking inside PilotPractice's platform — under a signed BAA, where the record is handled as PHI.
4. Server-side offline conversion uploads send Google the click ID + event + value. Form contents, names, phone numbers, conditions: never transmitted. Retraction jobs can pull an uploaded conversion back (test lead, wrong event) instead of leaving bad disclosures and bad data in place.
5. Analytics continues via our HIPAA-safe GA4 forwarding, so leadership keeps its dashboards without the GA4 tag's disclosures.

One team, one workflow, one diagram you could hand an auditor: clicks in, PHI-free events out, everything identifiable held inside the BAA boundary.

Where accounts actually fail: policy and privacy collide

Run enough healthcare Google Ads accounts and you see the same failure modes on repeat — usually where the two compliance tracks intersect:

The re-enable creep. Google's interface is engineered to restore the defaults you removed. "Improve your conversion measurement" prompts re-enable enhanced conversions; a new agency hire accepts a recommendation bulk-apply and remarketing is back; auto-applied suggestions flip settings while nobody's looking. Turn auto-apply recommendations off account-wide and treat the quarterly re-audit as non-optional. Half the violations we find in inherited accounts were introduced after someone did a compliant setup.

The agency-import problem. A practice hires a generalist PPC agency; the agency imports its standard e-commerce template — gtag, enhanced conversions, site-visitor remarketing, dynamic remarketing feeds. Everything works beautifully, which is the problem: the account performs while quietly disclosing patient data on every click. If an agency's pitch deck brags about "advanced audience strategies" for your practice, ask them to diagram the data flow. The right answer fits on a napkin.

The suspension spiral. A disapproval gets ignored, the pattern repeats, and Google escalates to account suspension — which in healthcare can be near-impossible to reverse because appeals require demonstrating policy understanding the account history contradicts. Practices then create a fresh account to "start over," which violates the circumventing-systems policy and gets the new account suspended faster. Fix disapprovals when they're cheap: at the ad level, with documentation.

The landing-page mismatch. Certification covers the advertiser, but Google's crawlers evaluate the destination. A compliant ad pointing at a page whose blog sidebar mentions restricted drug names, or whose old tag-manager container still fires a remarketing tag, inherits both problems. Landing pages need the same two-track audit as the account — which is one reason we build and host them rather than pointing spend at unaudited sites.

Frequently asked

Does Google sign BAAs? For some Google Cloud and Workspace services, yes. For Google Ads, GA4, and the advertising stack: no. That asymmetry is the entire reason this architecture exists.

Are offline conversion imports themselves a disclosure? You're sending Google a click ID it generated, an event name you chose, and a timestamp. No identity, no health information, no form contents. Structure the event names generically ("booked_appointment," not "booked_vasectomy_consult") and there's nothing in the payload that describes a person's health.

Will Smart Bidding work with fewer signals? Better, usually. Offline imports feed it booked patients rather than form views and button clicks, so tCPA/tROAS optimize toward the thing you actually sell. Expect a learning-phase adjustment after cutover, then equal or improved efficiency on a cleaner target.

Can we keep GA4 alongside this? Not the standard GA4 tag — same disclosure problems, same absent BAA. PilotPractice is building a HIPAA-safe GA4 Measurement Protocol forwarder into the platform (synthetic client IDs, PII scrubbing, whitelisted parameters) so your team can keep GA4 reporting without the tag. Details in the GA4 verdict article.

What about Microsoft/Bing ads? Same logic end to end: no UET tag on the site, capture the msclkid first-party, report conversions server-side. Bing's older, insurance-heavier demographics make it a quiet winner for dental and specialty practices.

The HIPAA-compliant Google Ads checklist (ungated)

1. Confirm certification requirements (LegitScript, addiction-services, pharmacy) before spending.
2. Purge restricted drug terms — including GLP-1 brand names — from keywords, ads, and assets.
3. No health-condition remarketing lists. None. It violates Google policy and HIPAA simultaneously.
4. Remove gtag/conversion/remarketing tags from every page; verify in the network tab, not the tag manager UI.
5. Turn enhanced conversions off. Hashed identifiers sent for matching are still disclosed identifiers.
6. Capture gclid/wbraid/gbraid first-party with an allowlist; store under BAA.
7. Report conversions via server-side offline imports: click ID + event only, with a retraction path.
8. Forms post server-to-server into a BAA-covered CRM; nothing form-related readable by any third-party script.
9. If running PMax: URL expansion off, all assets self-supplied, weekly placement review.
10. Track calls through compliant DNI, not a call-tracker's default JavaScript-and-recordings setup.
11. Re-audit quarterly — Google's interface actively nudges accounts back toward enhanced conversions and remarketing.
12. Get every vendor's data flows in writing, plus a BAA or a documented reason none is needed.

Want the site side checked in minutes? Run the free 10-minute PHI leak self-audit.

Do the marketing (or we do it for you)

The compliant Google Ads account isn't a hobbled one. Search intent is untouched, Smart Bidding trains on booked patients instead of form views, and your reporting shows cost per booked patient by campaign — all with a data flow you'd volunteer to show a regulator. Pair it with the Meta side (the pixel verdict, plus vertical playbooks for med spas, dental practices, and therapy practices) and you've covered the two channels that matter. The whole architecture — site, forms, analytics, ads, SMS — is mapped in the HIPAA-Compliant Marketing Guide (2026), with the OCR-guidance backstory in what still applies after the vacatur.

Or skip the build. PilotPractice runs Google Ads for medical practices end to end: certification, campaign management, the first-party tracking script, server-side conversion uploads, and the BAA — with SOC 2 and HIPAA compliance documentation live at trust.pilotpractice.com.

Book a demo — we'll show you a live account's conversion pipeline and exactly what Google receives.