On December 1, 2022, the HHS Office for Civil Rights published a bulletin on the use of online tracking technologies by HIPAA covered entities, and updated it in March 2024. The bulletin says, in plain language, that tags and pixels transmitting identifiable information to third parties from pages a patient interacts with can create a HIPAA disclosure. That single document is why your marketing team keeps hearing the word “HIPAA” from people who used to only talk about conversion rate. The rest of the field has responded with fear language and framework posts. This piece publishes the audit procedure instead.
PHI on a marketing site is a data flow question, not a page content question
The 18 HIPAA identifiers (name, address, dates, phone, email, MRN, IP address when tied to health context, and so on) matter less on your marketing site than the direction they travel. Your homepage copy is almost never the risk. The tag firing on your “book an appointment” page is. The distinction that keeps most marketing directors out of trouble is between public marketing pages (usually safe) and pages where a patient interacts with the practice while identifying themselves as a patient (regulated). If your practice is a covered entity, any vendor touching that second category is a business associate and needs a signed BAA (business associate agreement), whether the vendor’s website says “HIPAA compliant” or not.
In a marketing context, treat these as PHI-adjacent:
- URL paths that identify a specialty and provider (/book/oncology/dr-nguyen)
- Form submissions that include name plus reason for visit
- Chat transcripts that ask or accept symptom detail
- Call recordings on any number attached to intake
- Audience list memberships built from condition-page visits
- Any lead field that syncs from marketing CRM to EMR
Educational content about a condition is not PHI. A form that collects one person’s symptoms is.
The five places PHI leaks out of a medical marketing stack
A PHI-leak audit is not a separate deliverable from a technical SEO audit. It is the same tag manager review, form-field walkthrough, and vendor inventory a senior consultant already runs, done with a different lens. The reason competitors do not publish the procedure is that they do not run it. Below, each subsection names the artifact your audit produces: a tag inventory from GTM, a form-field spec, a call recording policy, a remarketing list export, and a CRM field map.
Appointment pages send more to GA4 than most teams realize
Default GA4 event tracking captures page_location and page_title on every pageview. On a booking page, that URL often identifies a specialty and provider before any form is submitted. Add a GTM container that also fires the Meta Pixel on the same page, and you have transmitted a de facto disclosure to two third parties on page load. The portal-subdomain boundary matters here: your marketing site (www.) should not share a GTM container with the portal (my.), because a shared container makes it trivially easy for a marketing tag to inherit onto a page it should never touch. Most GA4 properties on medical sites were configured before the 2022 bulletin, and nobody has reopened the container since. Ask your analytics owner to export a list of every tag firing on your appointment page. That export is the audit’s first artifact.
Remarketing lists are the audit’s fastest failure to find
Open Google Ads or Meta Ads Manager, go to your audience library, and read the definitions of every active list. Any audience built off a rule like “visited /oncology/” or “submitted the fertility consultation form” is the thing the bulletin describes. Hashing an email before it goes to the ad platform does not change what the list membership itself reveals: this person visited a page about a condition. The industry-standard advice (“just do not remarket to condition-specific pages going forward”) is technically correct and operationally useless, because the existing audiences are still in the account, still refreshing, and still being used. The fix is to delete them, document what was deleted, and rebuild only the audiences your compliance team will sign off on. This is a same-week task, not a strategic initiative.
Chat widgets turn intake into a record before anyone consents
The moment a widget asks a question that returns identifying health information, the vendor is functionally a business associate. Whether they signed a BAA determines whether the arrangement is legal, not whether the exposure exists. Third-party chat vendors typically store transcripts on their own infrastructure, with subprocessors of their own. A “HIPAA compliant” badge on a plugin marketplace is a marketing claim. Ask for the signed BAA and the subprocessor list. If the vendor cannot produce both, the widget comes off your appointment and intake pages until they can, or the widget is configured to accept only non-clinical questions (location, hours, insurance accepted). This is a policy the office manager can enforce; it does not require a lawyer to write.
Call tracking creates recordings that behave like clinical notes
Dynamic number insertion for attribution is fine. Recording the call is where a marketing tool becomes a records custodian, and a transcript created from that recording is a record too. A compliant configuration on most vendors is a ten-minute change: attribution on, recording off. If recording has to stay on for training or QA, the vendor needs a signed BAA, and the retention window needs to match the practice’s medical records schedule rather than the vendor’s default of “forever.” Most practices have recordings on because nobody ever turned them on deliberately. It was the vendor’s default at signup, and the account has never been re-audited.
The CRM handoff is where marketing quietly becomes clinical
A lead form on the marketing site captures name, email, phone, and “reason for visit.” The first three are ordinary contact data. The fourth, once it syncs to the CRM and forwards to the scheduling system, has crossed the boundary from marketing into clinical intake. Field mapping between the marketing CRM and the EMR is usually invisible to the marketing team; IT built it two migrations ago, and nobody has drawn the diagram since. The audit’s job here is to produce the field map, mark which fields carry PHI on entry versus which acquire it on sync, and specify what gets stripped on the marketing side before the record moves. That specification is the artifact your dev team can implement without guessing.
How to measure SEO when your primary tool cannot see PHI
Google Search Console is the honest layer of a medical marketing dashboard; GA4 is the constrained one. GSC reports query and page-level impressions and clicks derived from Google’s server logs, with no user-level identifiers, which makes it PHI-safe by construction. GA4 can be configured to stay within the same guardrail, but it takes work. Server-side tagging (a setup where your GTM container runs on your own server rather than in the visitor’s browser, so you decide what leaves) is the foundation. Layer Consent Mode v2 on top so tags respect the visitor’s choices. Turn on IP anonymization as table stakes. Rebuild your conversion events to fire on the fact of a form submission rather than on the contents of the form.
A compliant conversion looks like this end to end: someone clicked a search result, filled a name/email/phone form on a service page, and the practice can attribute that lead to the query and page that drove it, without the analytics record containing a diagnosis. Call tracking runs with recording off unless a BAA is in place. Lead forms capture source, medium, campaign, and landing page as hidden fields, and they do not capture “describe your symptoms” as a marketing field at all. When the compliance team asks what your analytics is collecting, the answer should fit on one page. If the honest answer is “we do not know,” that is the finding, and the tag inventory from earlier is where the work starts. We have run this shape of audit on regulated-vertical sites since 2019, and the pattern is consistent: the reporting layer that emerges from the cleanup is thinner but more defensible, and the SEO decisions it supports are the same ones as before.
Publishing testimonials without confirming who is a patient
Consider two responses to a Google review that reads, “Dr. Smith was wonderful when I came in for my knee surgery consultation.” A non-compliant response: “Thank you so much for trusting us with your knee, Sarah! We are thrilled Dr. Smith could help.” A compliant response: “Thank you for sharing this feedback. We appreciate you taking the time to write. If you would like to speak with our office manager about your experience, please call [number].” The second version acknowledges the feedback, offers an offline channel, and never confirms that the reviewer is a patient of the practice. The HHS OCR position on public acknowledgment applies even when the reviewer volunteered their status themselves. The practice’s response is a separate disclosure.
Solicited testimonials on the practice’s own site need written, revocable consent that is specific to the platform where the testimonial will appear. A blanket “we may use your feedback” checkbox does not cover a homepage video. Before-and-after imagery falls under the FTC Endorsement Guides, which require clear disclosure of typical results and any material connection between the practice and the endorser. What we do not do: incentivize reviews with discounts, gate reviews so only the positive ones publish, or confirm patient status in a public reply. The reason so many practices have compliance-violating responses is that the office manager writes them at 4:47 on a Friday. The fix is a two-line template pinned inside the review platform, not a training program.
The JSON-LD your developer can paste tonight
Below is a working schema block combining Physician, MedicalClinic, and FAQPage. It gives Google a hard entity signal for the provider (via NPI and sameAs links to authoritative directories), for the practice as a local entity, and for the FAQ content that often earns the appointment page its first ranked query. Paste it into the <head> of the relevant page, validate in Google’s Rich Results Test, and confirm the entities render as expected in Search Console’s URL Inspection tool a week after deployment.
<script type=”application/ld+json”>
{
“@context”: “https://schema.org”,
“@graph”: [
{
“@type”: “Physician”,
“name”: “Dr. Jane Nguyen, MD”,
“identifier”: {
“@type”: “PropertyValue”,
“propertyID”: “NPI”,
“value”: “1234567890”
},
“medicalSpecialty”: “Pediatrics”,
“sameAs”: [
“https://npiregistry.cms.hhs.gov/provider-view/1234567890”,
“https://www.healthgrades.com/physician/dr-jane-nguyen”
],
“worksFor”: { “@id”: “#clinic” }
},
{
“@type”: “MedicalClinic”,
“@id”: “#clinic”,
“name”: “Riverbend Pediatrics”,
“address”: {
“@type”: “PostalAddress”,
“streetAddress”: “123 Main St”,
“addressLocality”: “Portland”,
“addressRegion”: “OR”,
“postalCode”: “97201”
},
“telephone”: “+1-503-555-0100”,
“medicalSpecialty”: “Pediatrics”
},
{
“@type”: “FAQPage”,
“mainEntity”: [{
“@type”: “Question”,
“name”: “Do you accept new patients?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Yes. Call our office to schedule a first visit.”
}
}]
}
]
}
</script>
The win here is not the code. It is that a validated Physician block with an NPI is the cheapest way to hand Google an entity signal for a doctor who otherwise reads as a name on a page. We ran this pattern at scale during the Intel engagement, deploying structured data across 20 to 30 TLDs and maintaining a Siteimprove site health score above the technology industry benchmark. The same discipline maps directly onto a multi-provider medical site.
YMYL content needs a clinical reviewer in the workflow, not on the résumé
Google treats medical content as YMYL (Your Money or Your Life), which raises the E-E-A-T bar for whose byline and review the page shows. A workable workflow has three steps: an SEO brief that maps intent and keyword coverage, a clinical draft or a clinical review of an SEO-drafted piece by a credentialed person who signs off in writing, and publish with author schema that names the writer and, where different, a reviewedBy property that names the reviewer with credentials. Clinical review is not the marketing manager forwarding the draft. It is a named MD, DO, DDS, PA, or NP reading the specific claims and signing off on a date-stamped record. Whether a specific clinical claim is defensible is a clinical decision, not an SEO one. Most “medically reviewed by” bylines in the SERP are decorative. If the reviewer is not in the schema and the review is not dated, Google’s raters have no more to go on than the reader does.
Local SEO is where compliance gets easy again
Google Business Profile is the highest-ROI surface for most medical practices because the entity is the practice, not the patient, which keeps the PHI question at bay. Claim the profile, set primary and secondary categories precisely, and load photos: BrightLocal’s research has consistently found that profiles with rich photo libraries earn substantially more direct calls than profiles without them. List the insurance plans the front desk actually verifies, not the aspirational list. NAP (name, address, phone) has to match across the site, GBP, and the healthcare directories worth the effort: Healthgrades, WebMD, Vitals, Zocdoc, and CMS Physician Compare. Two compliance-adjacent notes: GBP Messaging is a chat surface and belongs under the same rules as the widgets discussed earlier, and the insurance display on GBP is a marketing claim your billing team should confirm before it goes live. The specifics of how this looks by vertical are covered on our healthcare SEO service page.
AI drafts are fine, PHI in the prompt is not
Two hard rules govern AI use in a medical marketing workflow. First: no PHI enters an LLM prompt, ever, regardless of the vendor’s enterprise-tier claims, unless there is a signed BAA and the deployment lives inside a compliant environment. Pasting a patient email into ChatGPT to draft a reply is a disclosure. Second: AI-drafted YMYL content requires the clinical review step from the previous section before publish, without exception. What AI is good for in this workflow: outlines built from keyword and competitor research, meta descriptions, first drafts of educational content that contains no patient-specific detail, and synthesis of your own published material into new formats. What it is not for: drafting responses to reviews that reference a specific visit, summarizing intake calls, or writing patient communication that requires personalization. The two failure modes we see are equally common. Some practices ban AI entirely and slow their publishing to a crawl. Others let a vendor auto-publish AI content on YMYL pages. Neither is the workflow. Our position, which the tone of our client work reflects, is AI-assisted, human-reviewed, no auto-publishing.
The 90-day roadmap you can hand to legal and marketing
Most practices we talk to want to do everything in month one. The reason Phase 1 is only three items is that the tag manager audit and the remarketing list purge are the two moves that materially reduce risk before anything else matters. Impact-versus-effort thinking here is unusual because a compliance-adjacent site earns growth by reducing risk first. Each phase names the artifact it produces so the plan can be handed to legal, IT, and marketing without translation.
- Phase 1 (0 to 30 days). Tag manager audit that produces a written inventory of every tag firing on appointment and intake pages. Full purge of URL-based and form-based remarketing audiences in Google Ads and Meta, with a documented deletion log. Deployment of a two-line compliant review-response template inside the practice’s review platform, and a GBP claim and category audit. Artifact: tag inventory, deletion log, response template, GBP audit sheet.
- Phase 2 (30 to 60 days). Server-side tagging setup and Consent Mode v2 configuration on the marketing site. Lead form redesign to remove clinical fields from marketing capture, with the CRM-to-EMR field map documented. Call tracking reconfigured to attribution-only unless a signed BAA is in place. Artifact: server-side GTM container spec, form field spec for dev, call tracking configuration document.
- Phase 3 (60 to 90 days). Physician, MedicalClinic, and FAQPage schema deployed on provider and service pages, validated in the Rich Results Test. Credentialed content workflow live, with author and reviewedBy schema in place on published pieces. Directory profile updates across Healthgrades, WebMD, Vitals, Zocdoc, and CMS Physician Compare. Artifact: validated schema on live pages, three published pieces through the new workflow, updated directory audit.
Questions healthcare marketing leads bring us
How is SEO used in healthcare?
As a workflow, not a benefits list. Intent-mapped keyword strategy sets the target queries, credentialed content earns the ranking, a local and entity architecture (GBP, directories, schema) makes the practice legible to Google, and compliance-safe conversion tracking measures against booked appointments rather than raw form fills. The measurement layer described in the tracking section is what closes the loop between search visibility and revenue.
What can a medical practice do to stay compliant with HIPAA regulations?
Inside marketing scope: audit the marketing stack against the five leak points, configure analytics so PHI cannot reach third parties, and fix review responses to a compliant template. Outside marketing scope: workforce training, risk analysis, breach notification procedures, and business associate management belong to the practice’s security officer or privacy officer, not the marketing team. A serious answer respects that boundary.
What is the 80/20 rule for SEO in a medical practice?
The Phase 1 answer from the roadmap. Tag manager audit and remarketing purge remove the largest risk surface. Review-response template deployment fixes the ongoing exposure most practices create weekly. GBP claim and category audit unlocks the highest-ROI local visibility. This ordering is unusual because a compliance-adjacent site earns growth by reducing risk before adding content.
Can ChatGPT do SEO for a medical practice?
Yes for outlines, keyword synthesis, meta descriptions, and first drafts of educational content that contains no patient-specific detail. No for anything that involves PHI in the prompt, and only with a documented clinical review step before publish for YMYL content. The workflow is AI-assisted, human-reviewed, no auto-publishing.
Do we need HIPAA-compliant website analytics for medical SEO?
You need a measurement stack where GSC carries the SEO signal and GA4 or a privacy-focused alternative is configured so PHI cannot reach it. That means server-side tagging, Consent Mode v2, no user-level tracking on appointment pages, and conversion events that fire on submission rather than on form contents. A vendor with a signed BAA covering the analytics tool is the cleanest path.
How do we track SEO leads without creating PHI?
Capture attribution (source, medium, campaign, landing page) as hidden form fields. Capture only the identifiers the practice already collects for scheduling (name, email, phone). Strip “reason for visit” from the marketing side, or move it behind explicit consent language. Run call tracking with recording off unless a BAA is in place. The lead record that lands in your CRM should let you attribute revenue without describing a diagnosis.
If nothing on your site has been reviewed against the 2022 bulletin
You now have three artifacts to bring into the room with legal and IT: the tag inventory to request, the review-response template to deploy, and the schema block to ship. The one you do not yet have is a validated map of where your specific stack touches PHI, which requires opening your GTM container, your ad accounts, and your CRM together. If that would help, we offer a technical SEO review of the marketing stack that flags where SEO-adjacent work is touching PHI, so your compliance team has a starting inventory rather than a blank page. It is not a HIPAA audit and does not substitute for one. It is the SEO-side artifact that lets the compliance conversation start with facts.
