Every time a patient visits your practice’s website, something invisible happens. A small piece of code sends their IP address, browser information, and the pages they viewed to Google’s servers. If they’re researching “dental implants” or “anxiety medication,” that behavior is now part of their advertising profile.
This is a HIPAA problem.
The Connection Between IP Addresses and PHI
Under HIPAA, Protected Health Information (PHI) includes any information that:
- Relates to health care
- Can identify an individual
When someone visits a healthcare website, their visit relates to healthcare. And their IP address—which Google Analytics captures—can identify them. Google literally runs the world’s largest identity resolution system. They can connect that IP to a real person.
Put those together, and you have PHI being sent to a third party without a Business Associate Agreement.
“But Everyone Uses Google Analytics”
True. And that’s why this is such a widespread problem. Healthcare organizations installed Google Analytics because it was free and “everyone does it.” But regulatory guidance has caught up:
- HHS guidance (2022) clarified that IP addresses combined with health-related website visits can constitute PHI
- FTC enforcement actions have targeted healthcare organizations for tracking pixels
- State attorneys general are investigating healthcare data practices
Being common doesn’t make it compliant.
The Real Cost of Non-Compliance
HIPAA violations aren’t theoretical risks:
- $100 - $50,000 per violation for unknowing violations
- Up to $1.5 million per year for willful neglect
- Personal liability for executives
- Reputation damage that money can’t fix
And here’s the thing: every single patient visit to your GA-tracked website could be considered a separate violation.
What You Should Do
Option 1: Remove Analytics Entirely
The safest approach is no analytics at all. But then you’re flying blind—no idea which pages work, where traffic comes from, or how to improve your marketing.
Option 2: Use Privacy-First Analytics
This is why we built Zero Trust Analytics. We give you the insights you need without the compliance headaches:
- No IP addresses stored - We hash them immediately with a daily-rotating salt, then discard the original
- No cookies - No consent banners, no tracking across sessions
- No third-party data sharing - Your data stays yours
- HIPAA-compatible by design - We can’t leak data we never collected
You still see visitor counts, top pages, traffic sources, and device breakdowns. You just don’t risk your practice to get them.
The Switch Takes 5 Minutes
- Sign up at ztas.io/register
- Add one line of code to your website
- Remove Google Analytics
- Sleep better
Your patients trust you with their health. Don’t let a free analytics tool compromise that trust.
Ready to make your practice’s website compliant? Start your free 14-day trial - no credit card required.