No Google does not make a business associate agreement (BAA) available on any Google Analytics plan, and the exclusion covers all measurement, especially tags on authenticated pages and on pages related to providing health care services. This applies to Google Analytics 4 (GA4) as well. Verdict date and last verified: 2026-10-28.
Short answer
Google states in its help article "HIPAA and Google Analytics" that it does not offer BAAs for Google Analytics. Customers must not use the product in a way that creates HIPAA obligations for Google or exposes protected health information (PHI). Google's guidance is that tags should not be set on HIPAA-covered pages, and that authenticated pages are likely to be covered.
The status is therefore "no BAA available on any plan." The question "how do I make Google Analytics HIPAA compliant?" has a direct answer: it cannot be done by configuration, because there is no BAA to sign. If you need the status of Google's office suite instead, Google Workspace HIPAA status is a separate check. It says nothing about Google Analytics. For other tools, see All HIPAA vendor checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Analytics (standard) | Not available | Not offered by Google | Not published by the vendor |
| Google Analytics 360 | Not available | Not offered by Google | Not published by the vendor |
Paying for Google Analytics 360 does not change the answer. Neither tier has a BAA.
What the BAA covers and what it excludes
Covered: nothing. No BAA is offered, so no Google Analytics service is covered.
Excluded:
- All Google Analytics measurement, on every tier.
- Tags on authenticated pages, such as a patient portal login area, an appointment dashboard or a billing page behind a password.
- Tags on pages related to providing health care services, such as a booking page for a specific specialty or a page where a visitor describes symptoms.
A marketing page that only describes your clinic's opening hours is a different case from an authenticated or care-related page. Google's own wording, quoted in the sources below, draws the line at HIPAA-covered pages. The privacy officer decides which pages fall on which side.
Security controls the vendor publishes
On the pages checked, Google does not publish these controls for Google Analytics:
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Even if any of these were published, security controls do not substitute for a BAA. Without one, PHI should not flow into the product.
How to use Google Analytics with PHI
You cannot use it with PHI. What you can do is keep PHI out of it. Run this checklist with your privacy officer:
- Keep Google Analytics tags off authenticated pages and off pages related to providing health care services.
- Review tag managers and website plugins on patient-facing sites. A single tag added by a web agency or a WordPress plugin can load analytics on every page, including login and booking pages.
- Decide with the privacy officer which pages are HIPAA-covered, and write the decision down page by page.
- Remove or replace tags wherever PHI could be collected.
- Record the outcome in the vendor inventory, including the fact that no BAA exists for Google Analytics.
- Train marketing staff and outside agencies not to add analytics, pixels or tags to covered pages without approval.
Compliance depends on a signed BAA, configuration and policies. For Google Analytics, no BAA is available. For terms such as PHI, BAA and business associate, see the HIPAA glossary. For policy and inventory guidance, see the HIPAA guides.
Alternatives with a BAA
These analytics and marketing tools publish BAA terms. The verdicts below come from each vendor's own page, and the list is not an endorsement.
- ActiveCampaign: conditional, BAA from the Enterprise plan.
- Constant Contact: conditional, BAA on all plans on request.
- GoHighLevel: conditional, any plan with the HIPAA Compliance add-on.
- HubSpot: conditional, Marketing Hub Enterprise.
- Piwik PRO: conditional, Enterprise plan.
"Conditional" means a BAA is available only on the named plan or terms and must be signed before PHI is handled. See HIPAA-compliant marketing software for the full category.
Sources
- HIPAA and Google Analytics — Help article, checked 2026-10-28. "Google makes no representations that Google Analytics satisfies HIPAA requirements"
- HIPAA and Google Analytics — Help article, checked 2026-10-28. "does not offer Business Associate Agreements in connection with this service."
- HIPAA and Google Analytics — Help article, checked 2026-10-28. "Customers must refrain from using Google Analytics in any way that may create obligations under HIPAA for Google."
- HIPAA and Google Analytics — Help article, checked 2026-10-28. "Authenticated pages are likely to be HIPAA-covered and customers should not set Google Analytics tags on those pages."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is Google Analytics 4 (GA4) HIPAA compliant?
No. Google's help article makes no distinction between GA4 and earlier versions. It states that Google does not offer BAAs for Google Analytics, so the verdict for GA4 is no.
How do I make Google Analytics HIPAA compliant?
You cannot make it so by configuration, because no BAA is available on any plan. The workable approach is to keep the tags off HIPAA-covered pages, remove them where PHI could be collected, and move those pages to an analytics tool that offers a BAA.
Can a practice use Google Analytics on its website at all?
Google's guidance is that tags should not be set on HIPAA-covered pages and that authenticated pages are likely covered. Whether a particular public page is covered is a decision for the practice's privacy officer. Document that decision in the vendor inventory.
Does Google Analytics 360 offer a BAA?
No. Google Analytics 360 is listed with the BAA as not available, the same as standard Google Analytics. The paid tier does not change the status.