If you’re running Google Ads for a healthcare client, the campaign structure is rarely the problem. The tracking is. Most healthcare accounts we’ve audited are either leaking protected health information through standard conversion tags, or they’ve disabled tracking so aggressively out of compliance fear that Smart Bidding has nothing to learn from. Both mistakes tank conversions, just in opposite directions.
The compliance layer most agencies skip
Standard Google Ads and GA4 tracking wasn’t built with HIPAA in mind. A form submission tag that captures the full form payload, an auto-tagged URL that reveals a visitor went from a Google ad to /services/mental-health-intake/, or Google Signals cross-device tracking on a page about a specific condition — any of these can count as PHI exposure. The Office for Civil Rights has made clear in recent guidance that “we didn’t know” isn’t a defense.
The fix isn’t to stop tracking. It’s to track differently.
Safe to track: form submission events (without passing field contents), click-to-call actions, direction requests, and generic thank-you page views. Not safe: health condition audience targeting, hashed patient emails alongside condition-specific conversion events, or Google Signals left on for a site with condition-specific URLs.
In GA4 specifically, that means turning off Google Signals, tightening data retention to the minimum useful window, and auditing every data stream for anything that could tie a person to a health condition — not just a name, but a URL path or page title that implies one.
Google’s own ad policies add a second layer
Beyond HIPAA, Google restricts what healthcare ads can say at all. No prescription drug names in copy without certification. No speculative claims — “guaranteed relief” or “cures your condition” will get an ad rejected, and for good reason. And personalized targeting based on health conditions is off the table even through Google’s own audience categories, since health status sits in Google’s sensitive interest classification.
None of this is optional, and none of it should surprise anyone who’s run healthcare accounts for more than a quarter.
Performance Max needs volume it often doesn’t have
Here’s the part that catches SMB healthcare clients specifically: Smart Bidding and Performance Max both want real conversion volume to optimize against — often cited around 30 conversions a month per asset group before the algorithm has enough signal to work well. A single-location clinic running a modest budget frequently doesn’t generate that volume, which means PMax can end up optimizing toward cheap, low-value actions like page views instead of actual bookings.
The practical answer: start on Maximize Conversions to build a data baseline before switching to Target CPA, and feed the system offline conversion data — which appointments actually happened, not just which forms got submitted — wherever the client’s booking system allows it. Better signal in, better budget allocation out.
Where the real advantage is right now
Most competitors in this space are still running standard, non-compliant tracking because it’s easier. Getting the compliance layer right isn’t just risk mitigation — patients increasingly notice when a healthcare provider treats their data carefully, and that shows up in trust before it shows up in a spreadsheet. Clean, compliant data also happens to be exactly what Smart Bidding needs to perform. The two goals point the same direction, which isn’t always true in marketing.
FAQ
Does using Google Ads violate HIPAA? No — running ads isn’t the violation. Improper conversion tracking that exposes protected health information is where the risk actually sits.
Can I still use Performance Max for a healthcare client with low ad spend? Yes, but expect a longer learning period, and prioritize feeding it clean offline conversion data over increasing budget alone.
Ratnawat Global runs Google Ads campaigns and HIPAA-aware analytics setups for healthcare and behavioral health clients across the US. If your current tracking setup hasn’t been audited recently, get in touch — it’s usually the first thing worth checking.