Introduction
The HIPAA compliant analytics situation can get confusing quick but the question that tends to start off the discussion is the title of this blog post. While you should consult with a lawyer for your compliance needs, I hope this post provides a little context into helping you make a good decision.
Can I Configure Common Web Analytics Solutions like GA4 to be HIPAA compliant?
Short answer: Not anymore.
You used to be able to do this but the HHS Guidance from March 2024 specified that the very CAPTURE of the data by a 3rd party is the non-compliant part. If you configure GA4 to capture and then delete certain parts of the data to attempt to remain compliant, that will not be enough. The analytics solution either needs to route through a CDP so that the analytics provider never captures the data in the first place or it must be an analytics solution that is willing to sign a BAA.
HIPAA compliant analytics gets tricky (read:expensive) really quick because the companies that are willing to offer a BAA have to abide by the requirements set forth by HHS to be HIPAA compliant. Additionally, if they’re signing a BAA, they want to protect themselves financially from the legal liability or risk they are agreeing to.
Do I need HIPAA Compliant Analytics or a CDP? Can I just use GA4?
If you want to be any sort of effective with your marketing efforts, you certainly need either a CDP or a HIPAA Compliant analytics provider.
Before diving into the specific providers, it’s essential to assess your organization’s needs and determine whether a Customer Data Platform (CDP) is necessary.
First, you will need a CDP if you plan to do any sort of remarketing efforts as the CDP will facilitate what info can be sent to the remarketing ad platform (typically Google Ads).
Additionally, a CDP gives you ultimate freedom and control of your patient marketing data. You may think of this as insurance against future HIPAA changes in regards to 3rd party analytics and provide a more comprehensive view of your audience. Further, the additional control over the data allows your marketing team more freedom to know what’s working and what isn’t.
If you do not need remarketing efforts, you should be fine with a standalone HIPAA compliant analytics solutions such as that of Mixpanel.
Frequently Asked Questions
- Can I just use GA4 for my healthcare website?
- Only on pages that have no PHI risk. GA4 is not HIPAA-eligible — Google does not sign a BAA for it — so deploying GA4 on patient-facing pages where condition, treatment, or identifiable patient data could be inferred is a compliance gap. Many practices do this anyway. The OCR has been increasingly active here, and several health systems have settled over GA4 (and Meta pixel) deployments on patient-facing properties.
- What is a CDP, and do healthcare groups need one?
- A Customer Data Platform unifies first-party data from multiple sources (web, CRM, scheduling, EHR adjuncts) into a single profile per patient or prospect. For multi-location healthcare groups doing serious paid-media or lifecycle work, a CDP is increasingly the right tool — it gives you HIPAA-compliant customer profiles that can power audiences, attribution, and segmentation. For groups just starting out with website analytics, a CDP is overkill — a HIPAA-compliant analytics platform is the right first step.
- How do HIPAA-compliant analytics and a CDP fit together?
- Layered. HIPAA-compliant analytics handles real-time event capture on the website with PHI filtering. A CDP handles the persistence and unification — joining web events to scheduling outcomes, CRM activity, and other first-party signals over time. Most healthcare groups start with the analytics layer. The CDP enters the picture once they need cross-channel attribution or audience activation that requires unified profiles.
- How much does a HIPAA-compliant analytics setup cost?
- $150–$2,000+ per month depending on traffic volume, the number of properties, and whether you need a CDP layer on top. Most multi-location healthcare groups land between $400 and $1,500/month for a properly-configured HIPAA-compliant analytics stack. The implementation cost is usually a one-time $5K–$25K project depending on scope.
More on HIPAA Compliance
- HIPAA A Guide to HIPAA Compliant Online Forms for Your Healthcare Website
- HIPAA A Guide to HIPAA Compliant Online Forms for Your Healthcare Website
- HIPAA Mastering HIPAA-Compliant Web Analytics: A Comparison Guide for Healthcare Executives
- HIPAA Purchasing HIPAA Compliant Analytics Solutions Through an Agency
- HIPAA What Are the Compliance Requirements for HIPAA in Web Analytics and Third-Party Trackers