Guide · Healthcare
HIPAA-compliant conversion tracking for Google Ads is a way for a healthcare practice to tell Google Ads which ad clicks became leads or patients without sending protected health information (PHI) to Google, which does not sign a business associate agreement (BAA) for Google Ads. This guide compares every option we found as of October 2026, from healthcare tracking platforms such as Freshpaint to free offline conversion imports, with prices, setup effort, and whether a practice without an IT department can realistically run each one. This guide is educational only and is not legal advice. Confirm any tracking setup with a healthcare attorney or your compliance officer before you use it.
Every compliant option works the same way at the end: Google receives only the ad click ID, a timestamp, an optional value and a neutral conversion name, never anything that identifies the patient or the care they asked about. What differs is who does the work and what it costs. A Google Ads offline conversion import is free but takes staff time. Managed healthcare platforms such as Curve and Ours Privacy do the setup for you, from roughly $900 to a few thousand dollars a month. Freshpaint and the enterprise CDPs typically cost tens of thousands of dollars a year. For a practice whose ad budget doesn’t justify those costs, Manual CPC judged by new-patient growth is a sound alternative.
This guide is desk research from public sources, not a hands-on test of each platform. Read the prices and policy points with these gaps in mind:
A healthcare practice can’t safely use the standard Google Ads conversion tag because the tag sends Google the visitor’s IP address, page URLs and browser identifiers, and Google does not sign a business associate agreement (BAA) for Google Ads. Without a BAA, no PHI may reach Google.
| Send | Never send |
|---|---|
| The click ID (GCLID, GBRAID or WBRAID) | Name, email or phone number, even hashed |
| The conversion time | IP address or full page URLs |
| An optional value | Pages, titles or form fields that name a condition or treatment |
| A neutral conversion name such as “Lead” or “New patient” | Conversion names that reveal the service, such as “IVF consult booked” |
A healthcare practice has five kinds of options for HIPAA-compliant Google Ads conversion tracking: a healthcare tracking platform, an enterprise CDP with a BAA tier, server-side Google Tag Manager on a host that signs a BAA, a free Google Ads offline conversion import, and HIPAA call tracking for phone leads. Freshpaint is one healthcare tracking platform, not the only one.
| Option | BAA | Price | Setup effort | Without IT staff? |
|---|---|---|---|---|
| Healthcare tracking platforms | ||||
| Curve | Every plan | $899/mo Vendor claim | Low. Curve does the configuration and says practices can be live in about a week. | Yes |
| Ours Privacy | From the Essential plan (up to 50,000 monthly tracked users) | Contact sales. Low to mid four figures a month Estimate | Low to medium. Connect Google Ads, add a site script and map events. Hands-on setup is a paid add-on. | Mostly. Someone, such as the web designer, has to add the script. |
| Freshpaint | Yes | Contact sales. $35,000/yr median, range $27,800–$50,200 Vendr | Medium. Standard onboarding on the Comply plan. | With vendor onboarding, at a higher price |
| Enterprise CDPs and analytics with a BAA tier | ||||
| Piwik PRO | Enterprise tiers only, not Business | Enterprise from €366/mo without a BAA Published. BAA tiers: contact sales. | Medium. An implementation specialist sets it up. | With vendor help, at enterprise prices |
| Twilio Segment | Business tier only | $55,600/yr median Vendr | High. Needs a developer. | No |
| RudderStack | Enterprise only | $50,958/yr median Vendr | High. Needs a developer. | No |
| Tealium | Private Cloud and HIPAA cloud, not Public Cloud | Contact sales. No credible figure found. | High. Enterprise CDP. | No |
| Server-side Google Tag Manager on a host that signs a BAA | ||||
| Google Cloud Run | Google Cloud BAA covers Cloud Run | About $45/mo per server, two or more recommended Published, plus a consultant | High. Deploy manually in a BAA-covered project and write the rules that strip PHI. | No |
| Stape | Custom plan only | Contact sales. Standard plans ($0–$167/mo) have no BAA. Published | High. Stape hosts; you configure the PHI stripping. | No |
| Google Ads feature | ||||
| Offline conversion import (click ID only) | Not needed if only the click ID is sent | Free | Low to medium. The website form has to capture the click ID. | Yes |
Addingwell and TAGGRS, two other managed server-side GTM hosts, do not offer a BAA according to Dumbdata. We found no BAA for Jitsu, and could not verify one for mParticle. Server-side GTM is a filter, not a way around the missing Google BAA: whatever leaves the server for Google still has to be free of PHI.
HIPAA-compliant conversion tracking for Google Ads costs anywhere from nothing to about $55,000 a year, depending mostly on who does the setup and upkeep.
| Tier | Typical cost | What you’re paying for |
|---|---|---|
| Offline conversion import | $0, plus staff time | Nothing: Google doesn’t charge for imports |
| Server-side GTM on Cloud Run | About $90+/mo hosting, plus a one-time consultant setup | Hosting; a consultant writes and maintains the PHI-stripping rules |
| Managed healthcare platform | About $900 to a few thousand dollars a month | The vendor’s BAA, setup and ongoing maintenance |
| Freshpaint or an enterprise CDP | About $27,000–$56,000 a year (Vendr medians and ranges) | A full data platform, usually sized for larger organizations |
Server-side GTM consultants publish little pricing. Packaged setups start at a few hundred euros according to Data Marketing School, and full projects start in the low five figures according to Pilot Digital. Both are vendors selling the service.
A practice without an IT department has three realistic paths: pay a managed healthcare platform to do the work, run a free offline conversion import with existing staff, or skip conversion-based bidding and run Manual CPC. The right choice depends on how the tracking cost compares with the ad budget.
Server-side GTM and the enterprise CDPs need a developer or analytics consultant to set up and maintain, so they fit practices that already work with one.
A Google Ads offline conversion import records a conversion by uploading the ad click ID (GCLID) and the conversion time, so Google learns which clicks produced patients without receiving any patient data. Google doesn’t charge for it. Primary Google Ads Help
The hard step is the second one: if the booking tool can’t store the GCLID, there is nothing to upload. Also keep in mind the open question in What this guide could not verify: Google’s sensitive-category rule names enhanced conversions and store sales, and we could not confirm whether it also covers click-ID-only imports.
Enhanced conversions are risky for a healthcare practice because Google’s own policy excludes health-related conversions from them. Google’s customer data policy says conversions in sensitive categories, which include “health or medical information,” can’t be used for measurement in enhanced conversions or store sales uploads. Primary Google Ads Help
Enhanced conversions send a hashed email address or phone number. The FTC has said that hashing does not make data anonymous. FTC, July 2024
Some healthcare tracking platforms, including Curve and Freshpaint, describe enhanced conversions with PHI removed in their own materials. If a vendor offers it, ask the vendor how it fits Google’s policy, and have your counsel review the answer before turning it on.
To track phone calls from Google Ads under HIPAA, use a call tracking service that signs a BAA and send Google only the call conversion, never call recordings, transcripts or caller details. A BAA with the call tracking vendor does not extend to Google.
| Vendor | BAA | Price | Setup |
|---|---|---|---|
| CallRail | Healthcare plans only | From $150/mo Published | Self-serve, 14-day trial |
| CallTrackingMetrics | From Marketing Pro | Marketing Pro $179/mo Published | Self-serve |
| Invoca | Yes | $27,880/yr median, plus onboarding Vendr | Implementation team; built for larger organizations |
Industry summaries report that CallRail’s Healthcare plan restricts integrations that send call data outside the BAA. Freshpaint and Ours Privacy both publish CallRail integrations for practices that already use one of those platforms.
Starting June 15, 2026, Google moved offline conversion imports and enhanced conversions for leads to the Data Manager API and blocked them in the Google Ads API for new integrations. Primary Google Ads Help
Manual CSV and Google Sheets uploads still work, so the change matters most to practices that wanted a custom API connection. Vendors with existing integrations, such as RudderStack, say their connections are unaffected.
Manual CPC can work well without conversion tracking when a practice judges Google Ads by the relationship between ad spend and new-patient growth over time, instead of by a tracked conversion count. Smart Bidding strategies such as Maximize conversions need conversion data to bid; Manual CPC doesn’t.
In Copy for Originals’ client work, a Manual CPC campaign with high-six-figure spend held its own against the same campaign’s results on Maximize conversions the previous year, once the benchmark was the practice’s actual new-patient growth rather than a tracked “conversion.” That is one client’s experience, not a controlled study, but it shows the tradeoff is about measurement, not about whether a practice can compete.
To run Google Ads this way, track monthly ad spend next to new patients from the practice management system, ask new patients how they found the practice, and watch how new-patient numbers move when spend goes up or down. The Lead Gen Search Campaign Checklist assumes conversion tracking; a Manual CPC checklist is coming soon.
No. Google does not sign a business associate agreement (BAA) for Google Ads, so a healthcare practice can use Google Ads only if no protected health information reaches Google. In practice that means sending only the ad click ID, a timestamp, an optional value and a neutral conversion name.
No. Curve and Ours Privacy are healthcare tracking platforms that compete directly with Freshpaint, enterprise CDPs such as Segment, RudderStack, Tealium and Piwik PRO offer a BAA on their top tiers, server-side Google Tag Manager can run on a host that signs a BAA, and Google Ads offline conversion imports are free.
A Google Ads offline conversion import that sends only the click ID is free. The practice captures the GCLID in its website form, then uploads the click ID, a neutral conversion name and the conversion time by CSV or Google Sheets within 90 days of the click. The cost is staff time, not a subscription.
Yes. A practice can run Manual CPC and judge Google Ads by the relationship between ad spend and new-patient growth over time instead of by a tracked conversion count. Smart Bidding strategies such as Maximize conversions need conversion data, but Manual CPC does not.
All sources accessed October 5, 2026. Page dates are shown where the page gives one.