Short answer: don't run Google's native lead forms for your clinic or pharmacy. Google's own lead form policy says healthcare-related ads are not allowed for lead forms. And even if that policy changes someday, the form would still store patient details on infrastructure you don't control, with no business associate agreement behind it.
That doesn't mean Google Ads is off the table. It means the form has to live somewhere else. Here's how to think about it, what actually creates HIPAA exposure, and what to build instead.
TL;DR
- Google's policy bars healthcare advertisers from lead form assets, so the question is mostly settled before HIPAA even enters.
- Google Ads as a channel can be fine. The risk is the data you send to Google or collect through it.
- Name plus phone plus a health question equals potential PHI. Don't collect the health question in the ad.
- Send clicks to a landing page on infrastructure you control, with a HIPAA-ready form and a BAA with the vendor.
- Audit your tags, call tracking and CRM exports too. Those leak more often than the form does.
Table of Contents
- Why the answer is no, twice over
- When a lead becomes PHI
- What HIPAA says about marketing and tracking
- Where the leaks really happen
- What to do instead: a landing page you control
- Checklist before you launch
- Our perspective
- Getting it built right
- FAQ
- Sources
Why the answer is no, twice over
There are two separate problems, and it helps to keep them apart.
Problem one is Google's ad policy. The lead form requirements spell out that healthcare-related advertisements aren't allowed for lead forms. The same page also asks for an eligible vertical, a clean policy history and a linked privacy policy. Meeting those doesn't override the healthcare prohibition. So if you're a pharmacy or clinic hoping to find the right setting buried in an account, there isn't one. We cover the broader rulebook in our guide to Google Ads medical policy for clinics and pharmacies.
Problem two is HIPAA itself. Suppose the policy didn't exist. A lead form lets someone submit details directly inside the ad. Google holds those leads for 60 days before you pull them out. For a covered entity, that's patient-adjacent data sitting on a third party's servers. Google doesn't offer BAAs for its search, display or YouTube campaigns, and HIPAA-regulated entities shouldn't expose Google Ads to PHI.
Two locks on the same door. Neither one opens with a clever workaround.
When a lead becomes PHI
A lead form normally asks for a name, email and phone number. Add a custom question and things change fast. According to one compliance write-up, that information becomes PHI when it identifies a person and relates to their past, present or future health, their care, or payment for care.
Look at how that plays out:
| What the form collects | PHI risk |
|---|---|
| Name, email, phone only | Lower on its face, but the fact that this person contacted a specific clinic can still be sensitive in context |
| Name plus "What condition are you seeking treatment for?" | High. Identifier plus health information |
| Name plus "Which medication do you take?" (pharmacy) | High. Same reason |
| Name plus preferred appointment time | Depends on what else the ad or page reveals about the service |
The ad itself matters too. If the ad is for a specific condition and the form is attached to it, the submission says something about the person's health, even if the form never asks.
And you can't filter it afterward. Because Google controls hosting, submission and initial storage, advertisers can't redact clinical details a person types in at the moment of submission. A free-text box is a risk you can't clean up. The only safe move is not to collect that information there.
What HIPAA says about marketing and tracking
Here's the part that surprises owners. HIPAA doesn't ban advertising. It limits what you can disclose while you advertise.
HHS's marketing FAQ says a covered entity generally may disclose PHI for marketing only with the individual's prior written authorization, subject to the Privacy Rule's exceptions. A privacy notice alone doesn't cover it.
HHS's guidance on online tracking technologies goes further. Regulated entities can't use tracking technologies in a way that results in impermissible disclosures of PHI to vendors without HIPAA-compliant authorization. The same guidance says authenticated pages, like a patient portal, generally involve PHI, while a visit to a public, unauthenticated health-related page isn't enough on its own to make PHI. It also says signing a BAA doesn't turn a vendor into a business associate if they don't meet the legal definition.
So the practical read: your risk climbs with how personal the page is. A public "About our pharmacy" page is a different animal from a booking confirmation for a specific treatment.
One more data point worth knowing. An HHS OIG advisory opinion looked at a pay-per-lead chiropractic arrangement where the advertiser didn't collect or retain health information and was paid fair-market-value fees. But the opinion is limited to that requestor and its certified facts. It's not a green light for lead forms, and nobody should wave it around as one.
Where the leaks really happen
Lead forms get the headlines for this keyword. In real audits, the bleeding is usually elsewhere.
Conversion tags and remarketing
The standard setup drops a Google tag on the site and fires events on conversion pages. If the URL contains condition terms and the tag sends it along with cookies or IP data, you may be handing identifiable health context to a vendor with no BAA. Google's own help page is plain: there is no BAA for Analytics, and HIPAA-regulated entities shouldn't use it on HIPAA-covered pages, including likely authenticated ones.
Make the call page-by-page. Keep tags off patient portals, booking confirmations that name a service, and anything behind a login.
Call tracking and recordings
Calls are the lifeblood of an independent pharmacy, and the phone is what breaks first. Google skips call recording automatically for advertisers identified as healthcare unless you manually enable it by accepting its Call Ads Supplemental Terms. Don't turn it on casually. That's a call-recording setting, not permission to run healthcare lead forms.
The export step
Lead data has to go somewhere. Google lets advertisers export through CSV download, email notification, the API or webhooks. Default destinations like a shared spreadsheet or a general inbox are exactly where PHI ends up unprotected. Anything that touches patient information needs to land in a system with access controls and a BAA.
Your own website forms
Google requires personal information to be collected through a secure SSL server. That's a floor, not a HIPAA program. A standard contact form plugin that emails submissions in plain text fails the HIPAA test even with a padlock in the browser bar.
What to do instead: a landing page you control
The safer pattern is simple. The ad promises something. The click goes to your page. Your page collects the details on your terms.
A landing page on infrastructure you control lets you qualify the lead behind a boundary you own. That's the core idea. Here's how to build it, step by step.
- Write the ad around a service, not a diagnosis. "Same-day flu shots" or "New patient appointments" beats copy that names a condition and implies the viewer has it. Check your wording against our six-point healthcare policy checklist.
- Send the click to a dedicated page on your own domain. Keep it hosted where you control the logs, scripts and access.
- Use a HIPAA-ready intake form. The vendor should sign a BAA and provide encryption in transit and at rest, access controls, audit logging and secure delivery and storage. EHR-integrated intake and patient portals are other options.
- Collect the minimum up front. Name, phone, preferred contact method. Save the clinical questions for a secure intake step after you've spoken with the person.
- Route submissions into a compliant CRM or inbox. Not a personal Gmail, not a shared sheet.
- Strip or limit tags on the page. Decide what the Google tag can see, and keep condition terms out of URLs.
- Follow up fast, by phone first. Speed wins the patient, and a call is cleaner than a long text thread about symptoms.
That last point isn't only about compliance. A lead that waits a day is a lead that ghosted you. Revenue that never walked in.
A quick example
A two-location pharmacy wants more new transfer prescriptions. The risky version is a lead form ad asking "Which medication do you need to transfer?" The better version is an ad for "Transfer your prescriptions in minutes" that lands on the pharmacy's own page. The page asks for name, phone and a preferred pharmacy location. A staff member calls back and gathers medication details over a secure channel or inside the pharmacy's system. Same goal, much smaller footprint.
Checklist before you launch
- Is any ad tied to a lead form asset? Remove it.
- Does the landing page ask for conditions, medications or symptoms in a free-text field? Take them out.
- Does your form vendor sign a BAA and offer encryption, audit logs and access control?
- Where does each submission land? Name every system and confirm each is covered.
- Which pages fire Google tags? Confirm none sit on authenticated or service-specific confirmation pages.
- Is call recording off unless a documented decision turned it on?
- Do your staff know who calls back, how fast and what they're allowed to write down?
If you run Bing too, the same audit applies to its tag. See our piece on auditing UET before disapproval.
Our perspective
We work only with healthcare, mostly independent pharmacies and clinics, and this question comes up constantly. Owners see a competitor's ad with a slick one-tap form and wonder why they can't have the same thing. Usually the competitor is either not a covered entity, is in a different category, or is one policy review away from a disapproval.
Our view is blunt. The lead form was never the growth lever for a local pharmacy. What wins is a tight local offer, a fast page, a human who picks up the phone and a follow-up system that doesn't lose people. Compliance built in from day one makes that cheaper, not slower, because you never have to rip out a form and tracking setup after a scare.
We'd rather you spend a few extra hours on the landing page than a few months explaining a data flow to a lawyer. If a vendor tells you HIPAA "doesn't really apply to ads," ask them where the data goes and who signed what.
— Opinly
Getting it built right
If you'd like this handled end to end, our healthcare PPC service covers campaign structure, policy-safe ad copy and landing pages that send leads to systems built for patient data. We pair it with HIPAA-compliant web design so the page the ad points to is part of the plan, not an afterthought. For the follow-up side, see how HIPAA-compliant marketing automation keeps callbacks and reminders on track. You can start from KLYR Media and tell us where your leads go today.
FAQ
Are Google Ads lead forms HIPAA compliant?
Not for healthcare advertisers. Google's policy doesn't allow healthcare-related ads to use lead forms. Separately, lead form data is stored on Google's side before export, and standard Google Ads isn't covered by a BAA, so collecting health details there creates disclosure risk.
Does HIPAA allow healthcare providers to use Google Ads at all?
Yes, advertising itself isn't prohibited. The issue is what data you disclose. HHS says PHI generally can't be disclosed for marketing without the individual's prior written authorization, so keep identifiable health information out of ad platforms and tracking tools.
Can I use a lead form if I only ask for name and phone number?
The policy question comes first, and healthcare ads aren't allowed to use the format. Beyond that, a name and phone number tied to a health-related ad can still reveal something about a person's care. A landing page you control avoids both problems.
Does Google sign a BAA for Google Ads?
No. Google doesn't offer BAAs for its search, display or YouTube campaigns, and it says the same for Analytics. Plan your data flow so PHI never reaches those tools.
What's the safest way to capture a prospective patient's details?
Send them to a page on your own domain with a HIPAA-ready intake form from a vendor that signs a BAA. Collect only contact basics first, then gather clinical details through a secure channel.
This article is general information, not legal advice. Before changing your tracking or intake setup, have your HIPAA privacy officer or healthcare attorney review the data flow.
Sources
- Lead form requirements, Google Advertising Policies Help
- Best practices to integrate lead form ads with your CRM, Google Ads Help
- Manage your call recording settings and eligibility, Google Ads Help
- Data collection and use, Google Advertising Policies Help
- HIPAA and Google Analytics, Analytics Help
- Use of Online Tracking Technologies by HIPAA Covered Entities, HHS.gov
- Marketing, HHS.gov
- HHS OIG Advisory Opinion 08-19
- HIPAA and Google Ads Lead Forms
- Google Lead Form Extensions: PHI-Safe Routing
- Is Google Ads HIPAA compliant?
- Best Ways to Collect Patient Information Online