HIPAA-SAFE REPORTING AND ATTRIBUTION
Know which marketing works, without patient information leaving your walls.
We set up tracking and reporting that shows where inquiries and bookings come from, built so no protected health information reaches an ad or analytics platform.
TL;DR
HIPAA-safe reporting is a way to measure marketing without sending patient information to companies like Meta or Google. Standard tracking setups often share page visits and form activity that can tie a person to a health interest. We replace that with tracking that keeps identifying details out and reports in totals. You still see which channels bring in bookings.
Part of See What Works
WHERE IT LEAKS
What goes wrong without it.
An ad pixel sits on the booking page because that is how the last agency always did it.
Session recordings capture what patients type into forms.
Analytics tools receive page addresses that name a condition or treatment.
Reports show clicks and impressions, and nobody can say what led to a booking.
No one has a list of which tools are on the site or what they collect.
WHAT WE DO
The pieces, and what each one does.
Tracking audit
First we find out what is running on your site and what it sends.
- Every tag, pixel and script on the site listed, page by page
- What each one sends, and to whom, written down
- Trackers on booking, intake, portal and condition pages flagged
- Each vendor checked for whether it will sign a Business Associate Agreement
- A prioritized list of what to remove, replace or keep
HEALTHCARE NOTES
The rules this runs under, and how we handle them.
Regulators have warned about tracking tools
The federal health privacy regulator has published guidance on online tracking technologies, and the Federal Trade Commission has acted against health companies that shared visitor data with ad platforms. Parts of that guidance have been challenged in court, so the details continue to shift. We build to the cautious reading.
No protected health information to ad platforms
Ad platforms generally do not sign Business Associate Agreements. So we do not send them anything that could identify a patient together with a health detail: no form contents, no appointment types, no page addresses that name a condition next to an identifier.
Business Associate Agreements with every vendor that needs one
Any vendor that handles protected health information for you should have a signed agreement in place. We check each tool, tell you which ones do and do not offer one, and sign one ourselves where our work calls for it.
This is not a legal opinion
We give you a clear record of what runs on your site and what it sends, and we build the safer version. Whether a given setup meets your obligations is a decision for you and your advisors. We work alongside your compliance counsel throughout.
We work alongside your compliance counsel. We aren’t lawyers, and nothing here is legal advice. How we handle HIPAA and ad rules
WHAT YOU GET
In your hands, in your accounts.
- A written inventory of every tracker on your site and what it sends
- Removal or replacement of risky tracking on patient pages
- An analytics setup that keeps identifying details out
- Source tagging on inquiries and call tracking on covered tools
- A list of vendors and their Business Associate Agreement status
- A monthly report by channel
- A written record of what changed, for your files
WHO USES IT
Specialties that lean on this most.
- Functional and Integrative MedicineRoot-cause, integrative and longevity practices
- TelehealthVirtual-first care, online prescribing and memberships
- Mental and Behavioral HealthTherapy, psychiatry and behavioral health practices
- Health TechDevices, labs and platforms selling to clinicians and patients
- Med Spas and AestheticsInjectables, lasers, skin and body treatments
BEFORE YOU ASK
Frequently asked.
It can create risk, depending on which pages it is on and what it sends. A pixel on a booking or condition page can link a person to a health interest and pass that to a company that has not signed a Business Associate Agreement. We are not lawyers, so we flag the risk, remove it where you agree and leave the legal judgment to your counsel.
Google has said its analytics product should not be used with protected health information and it does not offer a Business Associate Agreement for it. Many practices move to an analytics tool that does offer one, or limit Google Analytics to pages with no patient activity. We help you choose and set up either route.
They keep running. Ad platforms get fewer automatic signals, which can make their own optimization less precise. We make up for it with careful campaign structure and by measuring results in your own systems.
Yes. Where our work could involve protected health information, we sign one before that work starts. We also set things up so we handle as little of that information as possible.
Run our free Tracker Scan for a quick look at the public pages. The free audit goes further, with a real browser check of your booking and intake pages.
WORKS WITH
Google and Meta Ads
We plan, write and manage your Google and Meta ads inside the rules those platforms set for health, in ad accounts you own, with tracking that keeps patient information out.
ExplorePractice Websites
We build fast, clear practice websites with treatment, provider and location pages, and we set up the forms and tracking the way healthcare requires.
ExploreProvider Directories
We build provider directories with a page for each clinician, filters for specialty and location, and structure that search engines and AI assistants can read.
Explore
See where patients are slipping away.
Get a free Patient Growth Audit in 2 business days. It includes a tracker and compliance scan. No obligation.