Are Standard Google Analytics and TAG Manager/Pixels HIPAA Compliant?

Short answer: No. Standard Google Analytics (including GA4) and Google Tag Manager/pixels are not HIPAA compliant out of the box, and Google will not sign a Business Associate Agreement (BAA) for Google Analytics. Since HIPAA requires a signed BAA with any vendor that could receive protected health information (PHI), that alone rules out standard GA/GTM for any page or flow that touches PHI — no privacy setting, IP anonymization, or consent banner fixes that, because the problem is the missing contract, not a configuration issue.

Why this matters even for “just analytics”

On a healthcare-related site, PHI can include more than names or medical record numbers. HHS/OCR has taken the position that combinations like an IP address plus a visit to a page about a specific condition or provider, or activity on a patient portal, can count as PHI in this context. Tag Manager itself isn’t the issue — it’s a delivery mechanism — but it’s how GA4, Meta Pixel, and ad pixels typically get deployed, so an unaudited GTM container is a common way PHI ends up leaking to vendors that never signed a BAA.

One important nuance (a 2024 development): A federal court (American Hospital Association v. Becerra, June 2024) narrowed OCR’s original 2022 guidance. It vacated the part of the rule that treated an IP address plus a visit to an unauthenticated, fully public page (like a general condition-info blog post or homepage) as automatically PHI. So:

• Public, unauthenticated marketing pages (homepage, general blog, “about us”) — lower risk, GA4 is more defensible here, though state privacy laws (e.g., Washington’s My Health My Data Act) can still apply.
• Authenticated pages, patient portals, booking/intake forms, or any page tied to a specific patient’s care — GA4/GTM-deployed pixels remain a clear HIPAA problem and a live enforcement/litigation risk.

The enforcement track record is real, not theoretical: multiple health systems (Advocate Aurora, Mass General Brigham, Novant Health, Kaiser Permanente, others) have paid multi-million-dollar settlements tied to tracking pixels and Google Analytics on their sites — some settlements have run into the tens of millions.

Breakdown by Tool

Google Analytics 4 (GA4) — NOT COMPLIANT

Turning on “IP Anonymization” or “Data Redaction” settings in GA4 does not make it compliant. Google still receives the raw user request streams to process them. Google’s terms explicitly state that you are contractually prohibited from sending them any personally identifiable information (PII) or health data. 

Meta / Facebook Pixel — NOT COMPLIANT

The Meta Pixel is highly invasive. It tracks user buttons, form inputs, and specific page URLs to build ad profiles. Hospitals and clinics across the US have faced massive fines and class-action lawsuits for allowing Meta Pixels to monitor patient portals and booking flows. 

Google Tag Manager (GTM) — NOT COMPLIANT (Standard Client-Side)

Standard, “client-side” GTM runs directly inside the patient’s web browser. It functions as an unshielded pipe, letting Google Analytics, Meta Pixels, and Google Ads pull data straight out of the page. 

What are my options? I have 4 location healthcare practice – I would like reasonable pricing, BAA from a US located company, and done-for-you setup so my clinic staff are not further stressed?

PatientGain’s SPOSA Plan

• How it works: A dedicated US project manager and technical resource log directly into your website (with your permission). They manually rip out old, dangerous tracking codes and replace them with PatientGain’s “Secure Bubble” infrastructure. This server-side proxy strips out patient IP addresses and medical identifiers before passing clean data to your analytics dashboard. 
• The BAA: Provided on day one by PatientGain (a US-based company).
• Staff Stress: Zero. PatientGain’s staff handles the entire code setup, testing, and implementation within 1 to 5 days. 
• Pricing: Highly cost-effective for a 4-location group. It costs $199/month for the first location + approximately $50 to $100/month for each additional location. For your 4 locations, expect a total of roughly $350 to $500/month with $0 setup fees on a 12-month contract.