Does Google Analytics on a therapy website violate HIPAA?

What did the June 2024 ruling change?

The HHS Office for Civil Rights (OCR) publishes guidance on how HIPAA applies to online tracking technologies¹. It defines a tracking technology as a script or code that gathers information about users or their actions, and names cookies, web beacons or tracking pixels, session replay scripts and fingerprinting scripts as common examples.

The part most therapists heard about said HIPAA applied whenever a tracker connected a visitor’s IP address with a visit to a public page about specific health conditions or providers. Hospital groups sued. On June 20, 2024, in American Hospital Association v. Becerra, a federal court in the Northern District of Texas declared that part unlawful and vacated it. OCR’s page now opens with a notice saying so.

HHS filed a notice of appeal to the Fifth Circuit on August 19, 2024. The district court docket² records that the appeal was dismissed on September 4, 2024, on the government’s own motion. The narrowed guidance is the current federal position.

Where does HIPAA still apply on a practice website?

The ruling removed one theory. The rest of OCR’s guidance still stands, and it draws a line you can build to:

• Public information pages. OCR says trackers on many pages that don’t require a login have no access to protected health information (PHI), and HIPAA then doesn’t regulate them. Home, about and specialty pages may fall here, though Google’s own guidance, below, is more cautious about pages that describe care.
• Booking and contact pages. OCR says a tracker on a public page where people schedule appointments may collect an email address, or a reason for seeking care that someone typed or selected. That can be PHI, and for a covered practice, HIPAA applies.
• Logged-in areas. Client portals were never part of the court challenge. Trackers there may only use and disclose PHI as the Privacy Rule permits, and a vendor that receives PHI needs a signed business associate agreement.

Two shortcuts don’t work. OCR says a cookie banner asking visitors to accept or reject tracking is not a valid HIPAA authorization, and mentioning the tracking in a privacy policy or terms of use doesn’t permit the disclosure either.

One condition sits underneath all of this. HIPAA covers a health care provider who transmits health information electronically³ in connection with a covered transaction. That means any HIPAA standard transaction, such as an insurance claim, an eligibility check or a claim status inquiry, including one a billing service or clearinghouse sends for the practice. Some cash-pay practices never do any of these and may not be covered entities at all. Whether yours is covered is a legal determination: CMS’s covered-entity guidance⁴ includes a decision tool, and an attorney can confirm the answer. California privacy law applies either way, so the practical advice below holds.

What does Google say about Analytics on health websites?

Google’s own HIPAA and Google Analytics⁵ page is direct. Google makes no representation that Analytics satisfies HIPAA and doesn’t offer business associate agreements for it. Customers subject to HIPAA must not expose PHI to Google through Analytics, and “may only use Google Analytics on pages that are not HIPAA-covered.”

The same page is more cautious than OCR about public pages. It says unauthenticated pages “related to the provision of health care services” are more likely to be HIPAA-covered, and that customers shouldn’t set Analytics tags on HIPAA-covered pages. It asks customers to work with their legal team to identify the pages that don’t relate to providing health care.

Most pages on a therapy practice’s site describe the care you provide. Our reading, for a covered practice: Google’s guidance is a reason to choose a different analytics tool rather than sort pages one by one. If you use Analytics anyway, keep it off anything that collects contact details or a reason for care, including the confirmation page someone sees after sending a form, and settle which pages count as covered with your attorney.

If HIPAA isn’t the main risk, what is?

For a California practice, in our reading, it’s state privacy law. The California Invasion of Privacy Act (CIPA) is a 1967 wiretapping law that is now being applied to website code. It makes it a crime to read or learn the contents of a communication in transit without the consent of all parties⁶. Penal Code 637.2⁷ lets anyone injured by a violation sue for $5,000 per violation or three times their actual damages, whichever is greater, and they don’t have to show actual harm.

The Assembly Privacy and Consumer Protection Committee’s analysis of SB 690⁸, prepared for its July 1, 2026 hearing, describes a recent surge of CIPA litigation over website tracking. It names three Penal Code sections at issue, 631 (wiretapping), 632 (confidential communications) and 638.51 (pen registers), and calls pen-register claims the primary vehicle for these suits. It explains how the code involved works:

• Ad pixels send information back to an advertising company’s server as a page loads, which lets advertisers link browsing to user profiles.
• Session replay records how a visitor scrolls and what they type, and some courts have found that such scripts may violate wiretapping law.
• Third-party scripts are the basis of pen-register claims under Penal Code 638.51⁹. Any script a page loads from another company’s server receives the visitor’s IP address. These claims argue that a site owner who installs code relaying IP addresses to a third party has installed a pen register. The analysis notes that these claims generally involve the ordinary operation of websites, and that courts have reached very different results on them.

In our view, a chat widget run by a third party belongs with these. It receives what a visitor types as they type it, which is the kind of capture the wiretapping claims are about.

State law also has a health-specific layer. California’s Confidentiality of Medical Information Act¹⁰ (Civil Code 56 and following) covers anyone licensed under Division 2 of the Business and Professions Code, which includes LMFTs, LCSWs, LPCCs and psychologists, whether or not HIPAA covers them. Civil Code 56.10¹¹ bars a provider from disclosing a patient’s medical information, which includes information about their mental health or treatment, without authorization. For BBS licensees, a violation of the Act is also a citable offense under 16 CCR 1886.40¹².

SB 690¹³ would narrow one part of this. As enrolled and sent to the Governor on September 4, 2026, it would let only the Attorney General sue a private business over the pen-register section when the conduct happens on a website or app, and it would reach back to pending cases filed within two years before it takes effect. It doesn’t change the wiretapping and recording sections or the medical information law. When we checked the Legislature’s bill history on September 24, 2026, the Governor had not yet signed or vetoed it; the deadline is September 30, 2026.

What is a lower-risk setup for a therapy website?

• First-party analytics on public pages. Statistics from your own server logs, or an analytics tool you host yourself, count visits without sending visitors’ IP addresses or page views to another company. They answer the questions a practice actually has: which pages people read, where they came from and whether they find the contact page. A hosted cookieless service is a step down, because its script still receives each visitor’s IP address, the detail pen-register claims are built on. For search traffic, our SEO for therapists guide explains how to read the free Search Console and Bing Webmaster Tools reports.
• No trackers on the contact or booking page. Keep analytics, pixels and embedded scripts off any page that collects a name, email, phone number or reason for reaching out, and off the confirmation page after it. If you use a scheduling tool from your practice-management vendor, confirm it is covered by that vendor’s business associate agreement. If SimplePractice is that vendor, our guide to adding SimplePractice booking to your website covers the privacy limits of its widget.
• A contact form that asks for less. Name, a preferred way to reply and an optional free-text box, with a short note that the form isn’t for emergencies or clinical detail.
• No ad pixels, session recording or third-party chat widgets by default. If you want one, perhaps to measure an ad campaign, make it an informed, written decision. Know what the code sends and to whom, keep it off form pages and put a real consent step in front of it. CIPA claims turn on consent, but OCR is clear that a banner is not a HIPAA authorization.

We build every practice website this way unless a client asks otherwise in writing.

This post is general information, not legal advice. Check the primary texts, OCR’s tracking guidance and California Penal Code 631, and for your own situation ask your professional association’s legal or ethics line or an attorney.