Is GA4 HIPAA compliant?
Google will not sign a business associate agreement for Google Analytics, and its own help page says not to tag pages covered by HIPAA. Logged-in portals, intake forms and booking steps are the pages most likely to be covered. Many teams find this out after the tags have been live for years.
We audit every tag, pixel and URL parameter on the site and map what each one sends. Tracking moves to a server-side container that strips identifiers and health context before anything reaches an ad or analytics platform. Patient-level data goes to a warehouse on a cloud service that offers a BAA.