Never put PHI in a URL or query string
Names, conditions, and identifiers in landing-page URLs leak into ad-platform logs and analytics. Keep them out entirely — including in UTM parameters and form-redirect strings.
§ / Resources · Guide
HIPAA-Safe Google Ads.
How to run paid search for treatment without tripping compliance — what to track, what to suppress, and what to never send.
Plain English
This is practical guidance from running behavioral-health accounts — not legal advice. Confirm your specific setup with your compliance counsel and signed agreements.
You can run paid search in behavioral health and stay compliant — thousands of providers do. The trap isn’t advertising; it’s letting protected health information flow into tools that were never built to hold it. The fix is architectural: decide what leaves your systems, and make sure it’s only ever an anonymized signal that an admit happened — never who the person is.
§ / Six rules
The checklist we run every account through.
Track server-side, not just in the browser
Client-side pixels send raw event data straight to the ad platform. Route conversions through a server endpoint you control so you decide exactly what leaves your systems.
Turn off broad data-sharing toggles
Disable features that ship granular user data to the platform by default. Send the conversion signal — not the person behind it.
Get a signed BAA before any vendor touches PHI
Most major ad platforms will not sign a Business Associate Agreement. Architect your stack so the tools that see PHI are ones that will — and the ad platforms only ever see anonymized conversions.
Mind call tracking and recordings
Recorded admissions calls are PHI. Use compliant call-tracking that lets you pass the source of a call without exposing its content to third parties.
Write ads that respect the moment
Beyond compliance: families in crisis don’t respond to hype. Calm, specific, honest copy converts better and keeps you on the right side of platform health-and-medical policies.
Want your stack pressure-tested?
We’ll audit your current Google Ads setup for PHI exposure and conversion accuracy — on a fit call.
HIPAA-safe · 9 years in behavioral health · Every dollar tracked, or we fix it