Short answer: If HIPAA covers your clinic, the service that stores your form’s answers needs a business associate agreement (BAA) with you. Before a tracking vendor’s tag can read those answers, HHS asks for a BAA with that vendor and a Privacy Rule permission. Otherwise, each patient’s HIPAA authorization comes first. Google offers no BAA for Google Analytics, and its lead forms don’t allow healthcare ads. Meta’s instant forms can’t ask health questions without its written permission.
Before you read: This guide covers what HHS, the FTC, Google and Meta publish about tracking and about forms on clinic websites and in ads. It is general information, not legal advice. Whether HIPAA covers your clinic, and how each form should work, is for your attorney or privacy adviser to decide.
When a form collects protected health information
HHS gives the case of a page where people book an appointment without logging in. A tracker on that page might collect the person’s email address, or the reason for the visit that they typed or selected.
In that example, HHS says, the clinic is disclosing protected health information to the tracking vendor, so the HIPAA Rules apply.
Another HHS example is a covered health clinic whose website runs third-party trackers. When a patient books there, details of the appointment and the patient’s IP address may reach the tracking vendor. HHS says that vendor is then a business associate, and a BAA is required.
Pages behind a login, such as a patient portal, are the clearest case. HHS says trackers on them generally have access to protected health information.
The HHS page opens with its own note on a court order. In June 2024, a federal court in Texas declared unlawful and vacated part of this guidance.
Per that note, the court vacated the guidance to the extent it said HIPAA applies in one situation: when a tracker connects an IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers.
HHS says it is evaluating its next steps, and its page still shows the booking examples above.
In our view, treat any form that asks about a treatment, a symptom or the reason for a visit as one that collects protected health information.
The service behind the form needs a BAA
HHS lets a covered clinic store or process patient information with an online service only under a HIPAA-compliant BAA with that service. The clinic must also follow the rest of the HIPAA Rules, its guidance on cloud computing adds.
In our view, that includes the form builder, the hosting that keeps the entries your site saves and the email service that delivers each submission. Our guide to HIPAA in patient messages covers email.
Encryption alone doesn’t settle it. HHS says encryption greatly reduces the risk that unauthorized people see the data. On its own, though, it can’t protect the confidentiality, integrity and availability of that data as the Security Rule requires.
Google lists Google Forms, as part of Google Drive, among the Google Workspace services included in its BAA. Its help page says an administrator must review and accept that BAA before anyone uses protected health information in Google services.
In our view, get the signed BAA from each of those services before a form goes live, and keep a copy with your HIPAA records.
Tracking tags on form pages
A privacy policy doesn’t make the sharing allowed. HHS says that telling visitors in your privacy policy, notice or terms that you share patient data with a tracking vendor isn’t enough for the Privacy Rule to permit it.
Before a tracking vendor receives protected health information, HHS says it must have signed a BAA, and the disclosure needs a Privacy Rule permission. Without those, each patient’s HIPAA authorization is required first.
A banner asking visitors to accept or reject cookies isn’t a valid HIPAA authorization, HHS adds. Nor is a vendor’s promise to remove or de-identify the data after it arrives.
HHS mentions another option: a vendor such as a customer data platform signs a BAA, de-identifies the data and passes only that to trackers whose vendors won’t sign one.
Google makes no claim that Google Analytics meets HIPAA requirements, and it doesn’t offer a BAA for the service. It tells HIPAA-regulated customers to keep Analytics tags off authenticated pages, which are likely to be covered.
Unauthenticated pages related to providing health care are more likely to be covered too, Google adds, and covered pages shouldn’t carry those tags either.
Meta’s rules for its business tools, the Meta Pixel among them, prohibit sharing health information. Its examples include medical procedures, treatments and testing, and body specifications. The names you give events, conversions and custom audiences must not reflect or imply that information.
The systems Meta runs are designed to block and remove prohibited information they detect, but Meta says you are ultimately responsible for the data you share. Its core setup holds back custom parameters and anything in a URL after the domain, and Meta calls that no substitute for your own compliance.
Google Ads has a similar rule for its own tags. Its data collection policy doesn’t allow sharing personally identifiable information through remarketing or conversion tracking tags. Its example is an email address in the URL of a page with a remarketing tag.
That rule doesn’t apply to Google Ads services under its Data Processing Terms, such as enhanced conversions and Customer Match. In our view, that exception is Google’s policy, not a HIPAA permission.
In our view, if a page carries ad or analytics tags, its form shouldn’t ask about health at all: ask about the treatment on the call instead. Our website contact form guide covers which fields to ask for.
Forms inside Meta and Google ads
Meta keeps a list of questions an instant form can’t ask. It includes health information: current or past physical or mental ailments, the person’s or their family’s, medical treatments, side effects from medication, and medical conditions or disabilities.
Insurance information is on the same list, from the insurer’s name to plan details and policy numbers. If a question breaks these rules, Meta says the lead ad won’t run. Under its Advertising Standards, these questions need Meta’s prior written permission.
Google’s lead form requirements say ads for healthcare-related content aren’t allowed to use lead forms, and they point to the Google Ads healthcare and medicines policy.
In our view, an instant form for a med spa needs no more than a name, a phone number and a good time to call. On Google, point the ad at a form on your site that follows the rules above.
If HIPAA doesn’t cover your clinic
HIPAA covers health care providers that conduct certain billing and payment transactions electronically, HHS says. Our HIPAA social media guide explains how to check whether that includes your clinic.
For a clinic outside that group, the FTC says companies not covered by HIPAA still have to protect against unauthorized disclosure of personal health information. That holds even when a third party built their website or app.
In 2023, the FTC and HHS sent a joint letter to about 130 hospital systems and telehealth providers about trackers such as the Meta pixel and Google Analytics. The FTC added that unauthorized disclosure of health information through such trackers may violate the FTC Act.
In our view, the same setup of forms and tags protects patients either way, so build it as if HIPAA applied.
How to set up your clinic’s forms
- List every form on your site and in your ads, with what each one asks.
- Get a signed BAA from each service that stores or sends the answers, or move the form to one that signs.
- Take analytics and ad tags off every page where a form asks about health, unless the vendor signed a BAA and your attorney approved it.
- Remove health and insurance questions from Meta instant forms unless Meta gave you written permission. Send Google ads to a form on your site.
- Check thank-you pages and URLs for names, emails or treatments that a tag could pick up.
Steps 2, 3 and 4 follow the HHS, Google and Meta rules quoted above. Steps 1 and 5 are our advice, based on those same pages.
Before a form goes live
- Every service that stores or sends form answers has signed a BAA with you.
- No Google Analytics tag runs behind a login or on a page whose form asks about health.
- Pixel events, conversions and audiences carry names that say nothing about health or treatments.
- No instant form asks about health or insurance without written permission from Meta.
- No URL on your site carries a name, an email address or a treatment.
- Your attorney or privacy adviser has reviewed the forms and the tags.
RememberA form that asks about health needs a service that signs a BAA, and any tracker that can read it needs one too, with a Privacy Rule permission. Google offers no BAA for Analytics and keeps healthcare ads out of its lead forms. Meta’s instant forms can’t ask health questions without its written permission.
Our marketing for med spas runs Facebook and Instagram ads that end in a WhatsApp chat, and Google Search campaigns in an account in your name.
Questions about HIPAA compliant forms
Can I use Google Forms for patient information?
Google lists Google Forms, as part of Google Drive, among the Google Workspace services included in its BAA. Customers subject to HIPAA must sign that BAA to use those services with protected health information, and an administrator has to accept it first, Google says.
Can I use Google Analytics on a clinic website?
Google makes no claim that Google Analytics meets HIPAA requirements, and it doesn’t offer a BAA for the service. Customers subject to HIPAA must not use it in any way that gives Google access to protected health information, and may use it only on pages HIPAA doesn’t cover.
Can I use the Meta Pixel on a page with a form?
In our view, only where the form can’t reveal anything about health. Meta prohibits sharing health information, medical treatments included, through its business tools. HHS says a tracking vendor that receives a patient’s booking details is a business associate, and a BAA is required.
Does a cookie banner count as a patient’s consent?
Not under HIPAA. HHS says a banner asking visitors to accept or reject tracking technologies, such as cookies, isn’t a valid HIPAA authorization. Without a Privacy Rule permission and a vendor that is your business associate, each patient’s HIPAA authorization comes first.
Can a Facebook instant form ask about medical history?
Not without Meta’s prior written permission. Its list of questions you can’t ask includes current or past ailments, medical treatments, side effects from medication, and medical conditions or disabilities. If a question breaks those rules, the lead ad won’t run.
Sources
Read on November 7, 2026. From the U.S. Department of Health and Human Services (HHS): Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates and Guidance on HIPAA & Cloud Computing. From the Federal Trade Commission: FTC and HHS Warn Hospital Systems and Telehealth Providers about Privacy and Security Risks from Online Tracking Technologies. In Google’s Analytics Help and Advertising Policies Help: HIPAA and Google Analytics, Lead form requirements and Data collection and use. In Google’s Workspace and Cloud documentation: HIPAA Compliance with Google Workspace and Cloud Identity and HIPAA compliance on Google Cloud and Google Workspace. From Meta: About Prohibited Information, Questions Prohibited on Your Instant Form and Introduction to the Advertising Standards. We also used our med spas page and our guides on HIPAA in patient messages, HIPAA on social media and website contact forms.