No. Google publishes no BAA for Google Ads, so campaigns, audiences and conversion data should never carry PHI. The only Google advertising BAA is for Local Services Ads, a separate product.
Is Google Ads HIPAA compliant? BAA by plan, covered services and exclusions
No (checked 2026-10-28) No BAA is available for any Google Ads account type. The main exclusion is that campaigns and conversion data cannot carry PHI. Local Services Ads is a separate product with its own BAA.
This directory is published by Chanty, Inc. Chanty has no relationship with Google or this vendor. For terms such as BAA, Covered Entity and Business Associate, see the HIPAA glossary. Other vendor verdicts are in Is it HIPAA compliant? All vendors.
Short answer
Google has published no BAA for Google Ads. Its Call Ads supplemental terms require the advertiser to warrant that it is not a Covered Entity or Business Associate and that it will not use the features with PHI. A clinic that is a Covered Entity cannot make that warranty.
The Local Services Ads BAA applies only to Covered Services under its own agreement. It does not extend to Google Ads campaigns. Google also signs BAAs for some other products, such as Google Workspace, but those terms do not cover Google Ads.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Ads (all account types) | Not available | No BAA published | Not published by the vendor |
| Local Services Ads (separate product, not Google Ads) | BAA exists | Signed under the Local Services process. Health-vertical advertisers without a signed BAA can't use Local Services Ads. | Not published by the vendor |
What the BAA covers and what it excludes
Covered: nothing in Google Ads. The Local Services Ads BAA applies only to Covered Services under its Agreement(s).
Excluded:
- Search, Display, Video, Performance Max and Call Ads campaigns.
- Conversion tracking and Customer Match uploads.
- Local Services Ads, which is a separate product with its own BAA and is not Google Ads.
In practice, a clinic cannot upload a list of patients who had a procedure into Customer Match. It also cannot fire a conversion event named after a diagnosis or service when a visitor books a visit.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absent published controls do not change the verdict. It rests on the lack of a BAA.
How to use Google Ads with PHI
Without a BAA, avoidance is the control. Compliance depends on a signed BAA, configuration and policies, and none exists for Google Ads. A checklist for clinics and the agencies that run their ads:
- Keep PHI out of ad copy, audiences, keyword lists, landing page URLs and conversion events. A URL such as
/thank-you-oncology-consultor a keyword list built from patient inquiries can reveal health information tied to a person. - Do not upload patient lists through Customer Match.
- Do not use Call Ads in any way that involves PHI.
- Review conversion tracking setups, including tags on appointment-confirmation pages. For the analytics side, see Is Google Analytics HIPAA compliant?
- If you are in the health vertical and use Local Services Ads, sign the Local Services BAA before use.
- Record the decision in your vendor inventory: the product, the verdict, the date and the owner.
- Train marketing staff and outside agencies on what may never enter an ad account.
Alternatives with a BAA
These are email, CRM and analytics tools, not ad platforms. They can support patient communication and measurement where a BAA is in place, but they do not replace paid search. Each BAA depends on the plan and on configuration.
- ActiveCampaign: conditional, BAA from Enterprise.
- Constant Contact: conditional, BAA on all plans on request.
- GoHighLevel: conditional, any plan with the HIPAA Compliance add-on.
- HubSpot: conditional, Marketing Hub Enterprise. See Is HubSpot HIPAA compliant?
- Piwik PRO: conditional, Enterprise.
See all categories in HIPAA-compliant software by category.
Sources
- Call Ads Supplemental Terms – Google Ads Help — Terms, checked 2026-10-28. "solely responsible for any applicable compliance with HIPAA"
- About Business Associate Agreements for medical Local Services providers – Local Services Help — Help article, checked 2026-10-28. "Health-vertical advertisers who haven't signed a BAA with Google can't use Local Services Ads."
- Local Services Ads HIPAA Business Associate Agreement – Local Services Help — BAA page, checked 2026-10-28. "This BAA (a) only applies to Covered Services provided under the Agreement(s)"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Google sign a BAA for Google Ads?
No. Google publishes no BAA for any Google Ads account type. The only advertising BAA is for Local Services Ads, a separate product.
Can I use Google Ads call features or conversion tracking with PHI?
No. The Call Ads supplemental terms require the advertiser to warrant that it is not a Covered Entity or Business Associate and that it will not use the features with PHI. Conversion tracking and Customer Match uploads are outside any BAA, so they should not carry PHI either.
Is Local Services Ads the same as Google Ads for HIPAA purposes?
No. Local Services Ads is a separate product with its own BAA, which applies only to Covered Services under its Agreement(s). It does not cover Search, Display, Video, Performance Max or Call Ads campaigns.
Can health-vertical advertisers run Local Services Ads without a BAA?
No. Health-vertical advertisers without a signed BAA can't use Local Services Ads.