Google Analytics 4
Analytics
Web analytics by tag. Google offers no BAA for Analytics, and says where its tags should not go on HIPAA-covered sites.
Analytics
Google Tag Manager and your treatment center website
One container that loads every other tag. Tag Manager itself collects no visitor data, but every tag inside it can.
- Read against the vendor's own pages
- No BAA
- Checked October 15, 2026
What it is
Google's tag management system. One container snippet on your site loads and controls the other tags, such as analytics, ads and call tracking.
How it connects to a website
- Embed
The container snippet goes on every page. Call tracking tools such as CallRail and CTM document installing their code through it.
What KhanWork does with it
- Keep one container, with every tag in it named and owned.
- Set triggers so tags fire only on the pages agreed with your compliance lead.
- Configure consent mode so tags respect the visitor's choice.
- Avoid Custom HTML tags that read form fields.
Setup, as the vendor documents it
Tag Manager setup depends on the tags you run. The documented pieces we follow are Google's consent mode and, where it makes sense, server-side tagging.
What to watch out for
Where patient details can slip out with Google Tag Manager, and what the vendor's own documents say to switch on, switch off or ask for.
The container is only as clean as its tags
Google says Tag Manager itself does not collect, retain or share information about visitors to your site, other than standard HTTP request logs it deletes within 14 days. The tags it loads do: analytics, ad pixels, call tracking. Audit each one.
No personal data, by policy
Google's Tag Manager use policy prohibits uploading data that personally identifies an individual, or data Google could reasonably link to it.
Know which consent mode you run
In basic consent mode, Google tags are completely blocked until consent. In advanced consent mode, they load and send measurements without cookies when consent is denied. Choose deliberately for intake pages.
Custom HTML tags see the whole page
A Custom HTML tag runs script on the page, which can read what a visitor types into a form. Keep them to vendors you trust and have reviewed.
Server-side tagging is a filter, at a cost
Google says server-side tagging keeps data on a server only you can access until you send it on, and lets you shape and route it. It is also one more system to run and maintain.
Frequently asked questions
Google says Tag Manager itself does not collect, retain or share visitor information. The tags you load through it can, which is why each tag is reviewed.
Google documents none. Its use policy prohibits uploading data that personally identifies an individual.
Not always. It helps when you want to strip data before any vendor receives it, and it adds a server to run. We talk it through with you before suggesting it.
Sources
- Google, Tag Manager Use Policy (opens in a new tab) (checked )
- Tag Manager Help, Data privacy and security (opens in a new tab) (checked )
- Google for Developers, Consent mode (opens in a new tab) (checked )
- Google for Developers, Server-side tagging (opens in a new tab) (checked )
- Google for Developers, Tag Manager API (opens in a new tab) (checked )
Not legal advice. This page reports what the vendor publishes. Nothing here implies a partnership with Google. Confirm plans and the BAA in writing with the vendor, and let your compliance lead or counsel decide what counts as PHI in your workflows. For the terms, see BAA, PHI, HIPAA and 42 CFR Part 2 in the glossary.
