What should a practice actually measure?
Not traffic. A chiropractic office can double its visits from a blog post about desk posture and gain no patients at all. The number that matters is new patients, and your website cannot see most of them directly, because the booking happens on the phone, in a scheduling tool, or at the front desk.
So measure the last step the website can see: a click on the phone number, a completed contact form, or a click on the button that opens the booking tool. Everything else is context.
Setting up key events in GA4
Google Analytics 4 records everything as events. You tell it which events matter by marking them as key events, which used to be called conversions. Google’s instruction is short: find the event under Admin, then Events, and mark it as a key event by clicking the star icon next to it. You can create a new event and switch on "Mark as key event" in the same screen. A standard property can hold up to 30 key events.3
Use three or four. A dental practice might star phone_click, form_submit and booking_click, and nothing else.
UTM tags: the habit that makes the reports readable
GA4 guesses where a visitor came from. For links you place yourself, stop it guessing. Google’s guidance is to always use utm_source, utm_medium and utm_campaign on any tagged URL, and it warns that missing parameters show up in reports as (not set).4 Tag the link on your Google Business Profile, your newsletter links, your Instagram bio and any directory listing you control.
A simple rule that works for small practices: utm_source is the place (google, instagram, newsletter), utm_medium is the kind of channel (organic, social, email), and utm_campaign is the specific effort (gbp, spring-newsletter). Write the scheme down once so everyone tags the same way. Why the Business Profile link matters so much is covered in the Google Business Profile guide.
One thing a UTM tag must never contain is a patient’s details. Google’s own policy says the URL path and parameters must be free of personally identifiable information, and it names utm parameters specifically.5 That rules out links such as a reminder email that carries the patient’s email address in the URL.
Where Google Analytics must not go
This is the part most practice websites get wrong. Google’s support page on HIPAA and Google Analytics says it "makes no representations that Google Analytics satisfies HIPAA requirements and does not offer Business Associate Agreements in connection with this service."2 The same page tells HIPAA-regulated businesses not to put Google Analytics on authenticated pages and not on unauthenticated pages related to the provision of health care services.2
The HHS Office for Civil Rights bulletin on online tracking points the same way. It describes a tracking technology as a script or code that gathers information about users as they interact with a website. It says trackers on pages that require a login generally have access to PHI, such as IP addresses, medical record numbers and dates of appointments. And it gives the example that matters most to a practice: when a patient books an appointment through a clinic website that runs third-party tracking, the tracking vendor is a business associate and a BAA is required.1
One part of that bulletin no longer stands. In June 2024 a federal court in Texas vacated the guidance to the extent it said HIPAA obligations are triggered when a tracker connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers.1 The login and booking examples were not part of that ruling. My position: treat your public service pages as lower risk, and treat anything behind a login or inside a booking flow as off limits for analytics unless the vendor signs a BAA.
| Page | Google Analytics? | Why |
|---|---|---|
| Home, about, blog posts | Yes | No care is being provided and no one is identified |
| Service pages for a condition | With care | Google advises against it; the related HHS guidance was partly vacated in 2024 |
| Booking or scheduling steps | No | HHS says a tracker receiving appointment details makes the vendor a business associate |
| Patient portal or telehealth login | No | HHS says trackers there generally have access to PHI |
| Contact form thank-you page | Yes, if the URL carries no personal details | Count the event, never the content of the form |
Call tracking without collecting health information
Call tracking tools assign a different phone number to each source so you can see which marketing rings the phone. The risk is what the tool keeps. A count of calls from the number on your Google Business Profile tells you what you need. A recording of a caller describing their symptoms, stored by a vendor with no BAA, is a different thing.
The HHS bulletin is clear that when a tracking vendor receives PHI on behalf of a covered practice, the practice must have a BAA with it.1 The practical setup: count calls by source, switch off recording and transcription unless the vendor signs a BAA, and never send caller numbers onward to an advertising platform.
A measurement setup a small practice can keep
- Star three or four key events in GA4, and delete or ignore the rest.
- Tag every link you control with the same three UTM parameters, from a written scheme.
- Remove analytics and ad pixels from the portal, the booking steps and any page that shows appointment details.
- Add one question to your intake form: how did you first hear about us? Compare the answers with GA4 each month.
- Review once a month, not once a day. Small practices have small numbers, and daily swings mean nothing.
The intake question matters more than any tool. Analytics sees clicks; patients tell you about the sister, the podcast, the AI assistant that named you. How those AI answers are formed is in becoming the practice AI recommends, and the separate question of advertising pixels on booking pages has its own post in this series.
If you want the analytics set up and the tracking removed from pages where it should not be, that is part of a technical and compliance rebuild. This post explains the published guidance. It is not legal advice, and a practice unsure about its own obligations should ask a healthcare attorney.