Google Tag Manager
Analytics
One container that loads every other tag. Tag Manager itself collects no visitor data, but every tag inside it can.
Analytics
Google Analytics 4 and your treatment center website
Web analytics by tag. Google offers no BAA for Analytics, and says where its tags should not go on HIPAA-covered sites.
- Read against the vendor's own pages
- No BAA
- Checked October 15, 2026
What it is
Google's web analytics. A tag on your pages reports visits and events to Google.
How it connects to a website
- Embed
The Google tag goes on your pages directly or through Google Tag Manager. Other tools can also send events to GA4 through its Measurement Protocol.
What KhanWork does with it
- Set GA4 up so it receives no form contents, names, phone numbers or email addresses.
- Turn on data redaction for email addresses and for any query parameters that could carry details.
- Agree with your compliance lead which pages carry the tag at all, using Google's own guidance as the starting point.
- Record conversions as events, such as a form submitted or a call button tapped, with nothing personal attached.
Setup, as the vendor documents it
- In GA4, open Admin, then Data streams, and select your web data stream.
- Under Events, choose Redact data and turn on email redaction and query parameter redaction, listing the parameters to strip.
- Use the Test data redaction section to check the result before relying on it.
Source: Google Analytics Help, Data redaction. Menus and labels change; follow what you see in your account.
What to watch out for
Where patient details can slip out with Google Analytics 4, and what the vendor's own documents say to switch on, switch off or ask for.
Google's own line on HIPAA
Google says HIPAA-regulated entities should not expose data to Google that may be PHI, that authenticated pages are likely HIPAA-covered, and that unauthenticated pages related to providing health care services are more likely covered too, so its tags should not go on either.
Personal information leaks through URLs
Google's policy bars sending data it could recognize as personally identifiable, and warns that it often slips in through URLs, page titles, form fields and search boxes. A thank-you page with a name in the address is the classic leak.
Redaction is best effort
GA4 data redaction finds email addresses on a best-effort basis and does not cover data sent through the Measurement Protocol, which is how many call tracking and chat tools send events.
The federal guidance shifted, not vanished
In June 2024 a federal court vacated one part of HHS's bulletin on tracking technologies: treating an IP address plus a visit to a public page about health conditions or providers as protected health information. Per Morrison Foerster's summary, the rest remains in effect, including that tracking should not run on authenticated pages without a BAA.
State law reaches further
Washington's My Health My Data Act, per the state attorney general, protects health data that falls outside HIPAA from being collected and shared without the consumer's consent.
Frequently asked questions
Google says HIPAA-regulated entities should not expose PHI to Google, and that its tags should not go on authenticated pages or pages related to providing health care services. Which of your pages that leaves is a question for your counsel; either way we send no form contents or identifiers.
Google says it does not offer Business Associate Agreements for Google Analytics.
Where your counsel agrees it should run: page views without personal details in URLs or titles, and conversion events such as a form submitted, with no field values.
Sources
- Google Analytics Help, HIPAA and Google Analytics (opens in a new tab) (checked )
- Google Analytics Help, Best practices to avoid sending PII (opens in a new tab) (checked )
- Google Analytics Help, Data redaction (opens in a new tab) (checked )
- Morrison Foerster, Federal judge vacates portions of OCR guidance on online tracking (opens in a new tab) (checked )
- Washington State Attorney General, My Health My Data Act (opens in a new tab) (checked )
- Google for Developers, GA4 Measurement Protocol (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with Google. Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
