HIPAA-Aware Google Ads: What Dental Practices Can and Can't Do

Google Ads can be the fastest way to fill a schedule, and the fastest way to create a compliance problem if it is set up carelessly. The good news: HIPAA-aware advertising is entirely doable with the right guardrails.

Most practices are not confused because the rules are complicated. They are confused because they have been told two contradictory things: that advertising as a dental practice is a legal minefield, and that it is fine because everyone does it. Neither is right. The real picture is more manageable than the first story and more demanding than the second.

Where the risk actually lives

The risk usually is not the ad copy, it is the tracking. Sending identifiable patient data to ad platforms through misconfigured pixels and forms is where practices get into trouble.

• Do not pass personal health information into ad platform tracking.
• Use a Business Associate Agreement with vendors that touch patient data.
• Keep forms secure and gate what conversion data you share.

The reason that matters is worth understanding rather than memorizing. When a patient submits a form, a careless tracking setup can forward more than you intended: the page they were on, which might be a specific procedure, alongside identifiers such as an email address, phone number, or IP address. The combination is the problem. 'Someone visited a page' is not sensitive. 'This identifiable person inquired about this procedure' potentially is.

Nearly every real incident traces to a handful of mundane causes rather than anything exotic: a tracking tag pasted sitewide, including on confirmation pages that echo submitted details in the URL; form fields for symptoms or reason for visit captured by analytics; a chat widget logging conversations to a third party with no agreement in place; or call tracking recording calls without appropriate consent and safeguards.

What the government has actually said

The Office for Civil Rights at HHS enforces HIPAA. In December 2022 it published a bulletin on online tracking technologies and updated it in March 2024. Its core has not been disturbed: the HIPAA Rules apply when information you collect through tracking technologies, or disclose to tracking vendors, includes protected health information. Disclosing PHI to tracking vendors for marketing purposes without a HIPAA-compliant authorization would be an impermissible disclosure.

The bulletin also draws a distinction that matters to a dental practice. On pages a patient must log into, a patient portal for instance, tracking technologies generally do have access to PHI, and OCR is clear those pages must be configured accordingly. It also states that a tracking vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, so a BAA is required. OCR's own example involves a patient booking an appointment through a clinic website where the site transmits appointment information and the visitor's IP address to a tracking vendor.

The part most articles leave out: a court struck some of this down

This wrinkle explains why advice written in 2023 sounds more alarming than advice written now.

The most contested piece of OCR's guidance concerned unauthenticated public pages, the ordinary pages anyone can browse without logging in. OCR took the view that combining a visitor's IP address with a visit to a page about a specific health condition or provider could itself constitute individually identifiable health information. The American Hospital Association and co-plaintiffs sued. On June 20, 2024, the US District Court for the Northern District of Texas held that this expansion exceeded the agency's authority under HIPAA and vacated it, finding that such metadata from an unauthenticated public page does not by itself meet the statutory definition.

Before anyone relaxes, note carefully what that decision did not do. It did not vacate the entire bulletin; OCR's position on authenticated pages, such as patient portals, was not disturbed. The court declined to issue a permanent injunction. It is a single district court, so OCR could still advance its interpretation elsewhere. And HIPAA is far from the only exposure here: the FTC has its own authority, state privacy laws apply independently, and private class actions over website pixels and cookies have continued regardless of what OCR's guidance says.

Google's own rules are a separate constraint

This is the piece practices most often miss entirely: even setting HIPAA aside, Google has its own advertising policies, and health is treated as a sensitive interest category. Those policies restrict how you may target, independent of any federal law.

Under Google's personalized advertising policy, advertisers promoting content in sensitive interest categories cannot use advertiser-curated audiences, because those may inadvertently contain sensitive user signals. You can still use predefined Google audiences, which are configured to exclude those signals.

For a dental practice, the most consequential line in that table is Customer Match. Uploading your patient list to build an audience or a lookalike is a common tactic in other industries and is exactly what these restrictions exclude. It is also, separately, the kind of disclosure that raises HIPAA questions. Two independent reasons not to do it.

Note as well that Google's healthcare and medicines policies restrict certain content outright and require certification for others. General dentistry advertising is not usually affected, but if you promote anything adjacent to restricted categories, check the policy for every location you target rather than assuming.

What you can and cannot do

The middle column is where judgment is required and where a conversation with your attorney is genuinely worth the hour. Remarketing, for example, is not inherently a problem, but remarketing to everyone who visited your dental implant page is a different proposition than remarketing to everyone who visited your homepage.

A setup checklist

1. 1Inventory every third party that receives data from your site: analytics, ad platforms, chat, call tracking, scheduling, forms. Most practices have more than they remember.
2. 2Get a BAA with any vendor that could touch PHI, and treat refusal as disqualifying rather than negotiable.
3. 3Keep tracking tags off patient portal and other authenticated pages entirely.
4. 4Make sure confirmation page URLs carry no submitted details, since URLs get passed along in ways nobody intends.
5. 5Do not collect symptoms, conditions, or reason for visit in a first-contact form. Collect enough to call the person back and gather clinical detail through a secure channel.
6. 6Turn off any feature that sends hashed or plain customer data to an ad platform, including enhanced conversions built on patient contact details, unless your counsel has specifically approved it.
7. 7Report conversions as anonymous counts, so you know how many leads a campaign produced without the platform learning who they were.
8. 8Write down what you decided and why. If anyone ever asks, a documented, reasoned approach is worth a great deal.
9. 9Review it annually and after any website or vendor change, because this is exactly the kind of configuration that drifts.

Growing safely

Local targeting, conversion-focused landing pages, and transparent reporting let you grow aggressively while staying inside the lines. You should always know your cost per lead and booked rate.

The encouraging part is that the compliant approach is also close to the highest-performing one. Dental demand is overwhelmingly local and intent-driven: someone searching for an emergency dentist in your town is already qualified by their search, so tight geographic targeting plus specific keywords does most of the work. The sophisticated audience tooling you are asked to give up matters far more to national e-commerce than to a practice serving a ten-mile radius.

On measurement, published benchmarks put cost per new patient from paid search in the range of roughly 150 to 350 dollars for general dentistry, with strong performers lower and poorly run accounts considerably higher. Treat that as a sanity check rather than a target, because it varies enormously by market and competition. What matters more is the ratio between what you pay to acquire a patient and what that patient is worth over time, and whether your front desk converts the leads you are already paying for.

What this article cannot tell you

• Whether your specific configuration is compliant. That depends on your site, your vendors, and your contracts, and it needs a professional review.
• What the law will be next year. OCR could revise its guidance, appeal, or enforce a different interpretation in another circuit.
• Your state's requirements. State privacy and call-recording laws vary considerably and apply on top of federal rules.
• Whether your vendors are doing what they claim. A signed BAA is a contract, not a technical audit.
• Anything about non-HIPAA exposure such as FTC action or private class actions, which have proceeded on their own logic.

If that sounds like a lot of uncertainty, it is, and honesty about it is more useful than false confidence. The reassuring news is that the conservative configuration described above is not burdensome, and it holds up regardless of how the legal picture develops.

How DentalQore fits in

Our paid advertising is HIPAA-aware from setup to reporting, managed by a certified Google Partner, and we sign a BAA. Practically, that means the tracking configuration is built conservatively from the start rather than retrofitted after someone notices a problem, and reporting is designed to tell you what you need, cost per lead and booked rate, without shipping patient identifiers to ad platforms to get it.

The boundary matters here more than anywhere else on this site. We are not your attorneys, and we will not tell you a configuration is legally compliant, because that is not ours to certify. What we can do is keep the technical setup on the conservative side of a genuinely unsettled area, tell you plainly when something you have been asked to do carries risk, and give you documentation your counsel can actually review. Decisions about acceptable risk stay with you and your attorney.

Key takeaways

• The risk is in the tracking, not the ad copy. Almost every problem comes from sending identifiers plus procedure context to an ad platform.
• OCR's guidance holds that tracking vendors handling PHI on your behalf are business associates requiring a BAA, and that authenticated pages such as patient portals generally involve PHI.
• In June 2024 a federal court vacated OCR's position that an IP address combined with a visit to an unauthenticated public health page is itself identifiable health information, finding the agency exceeded its authority.
• That ruling was narrow: authenticated pages were untouched, no injunction issued, and FTC authority, state privacy laws, and private class actions all remain in play.
• Google's own policies are a separate constraint. Health is a sensitive interest category, so Customer Match, your own data segments, audience expansion, and lookalikes are not available, while predefined Google audiences are.
• The compliant setup is also close to the best-performing one, because dental demand is local and intent-driven rather than dependent on audience data.
• Get a BAA from every vendor touching patient data, keep tags off portal pages, avoid collecting clinical detail in first-contact forms, and document your reasoning.
• None of this is legal advice. Have a healthcare privacy attorney review your actual configuration.

Not sure what your current setup is sending?

Most practices genuinely do not know, usually because tags were added over several years by different people. That is a fixable problem, and finding out is the first step. DentalQore offers a free website audit, competitor analysis, and custom growth strategy. Request a demo, or call 866-664-5216, and we will look at how your advertising and tracking are configured today and where we would tighten it.