Google Analytics for Medical Practices: What a Compliant GA4 Setup Actually Looks Like

Most podiatry practices run Google Analytics wrong. Not wrong in the sense that it undercounts sessions or misattributes traffic sources. Wrong in the sense that it exposes patient data in ways that create HIPAA risk, and it tracks things that do not matter while missing the one conversion that does: the phone call.

In a GA4 audit we ran across 16 podiatry practice websites, Google Signals was switched on for 14 of 17 properties in one partner group before its compliance cleanup. Google Signals connects analytics data to Google accounts, which means Google knows not just that someone visited your diabetic foot care page, but who they are. That is a HIPAA problem. The good news is that turning it off did not change Google Ads bidding at all, because the conversion signal was calls and CRM uploads, not analytics.

Here is what a compliant GA4 setup looks like for a clinic, and why most practices need to rebuild theirs from scratch.

Why Google Signals Must Be Off

Google Signals links your analytics data to the signed-in Google accounts of your site visitors. It allows cross-device tracking, remarketing audiences, and demographic reports. It is also fundamentally incompatible with HIPAA.

When someone visits your bunion surgery page while logged into their Google account, and Google Signals is on, Google knows who they are. Their session data is no longer anonymous. That creates a disclosure risk under HIPAA, and it happens by default in many GA4 properties.

The fix is simple. Open your GA4 property settings, navigate to Data Settings, then Data Collection. If Google Signals is enabled, turn it off. You lose the ability to build remarketing audiences in GA4 and to see aggregated demographic data. You should not be doing either of those things on a clinic website anyway. Session recording tools, heat maps, and Facebook pixels all carry the same risk. We have written about why pixels and session recording create wiretapping problems for medical practices before. The principle is the same: if a tool connects identifiable patient behavior to a third party, it does not belong on a clinic site.

What Key Events Should Actually Track

Most podiatry practices inherit the default GA4 setup, which tracks events like page_view, scroll, and session_start automatically. Those events tell you almost nothing about whether your website is booking patients.

In our audit of 16 podiatry practice websites, 15 could not see a single phone call in analytics. Most still had the default generate_lead event, which silently reports zero until it is configured to fire on something real. The event exists in the property, but nothing triggers it, so the practice thinks they are tracking leads when they are tracking nothing.

A compliant GA4 setup for a podiatry practice should track three things:

Phone calls. Across a 15-clinic podiatry group in August 2026, 4,729 new patient opportunities were logged in the CRM. Sixty-nine percent were phone calls, 21 percent were calls from Google Ads, and 10 percent were website forms. Nine in ten new patients call. If your analytics cannot see calls, you are blind to the one conversion that matters.

Form submissions. Not all patients call. Some fill out the contact form or the appointment request form. Those submissions should fire a key event in GA4, labeled clearly so you can separate them from phone calls in your reporting.

Booked appointments uploaded from the CRM. The best signal is not the call or the form. It is the booked patient. If your CRM can export a list of new patients with a Google click ID attached, you can upload those conversions back into GA4 and into Google Ads. That tells you exactly which campaigns, keywords, and landing pages are filling the schedule, not just which ones are driving calls.

Most practices stop at page views and session counts. Those numbers do not pay the lease.

Why Turning Off Google Signals Does Not Hurt Your Google Ads

The most common objection we hear when recommending a Google Signals shutdown is that it will kill Google Ads performance. The concern is understandable but wrong.

Google Ads does not need Google Signals to optimize your campaigns. It needs conversion data. As long as you are sending conversions into Google Ads through call tracking, form submissions, or CRM uploads, the bidding algorithm has what it needs. The conversion signal flows from the click ID, not from analytics.

When we turned off Google Signals across that 17-property podiatry group, nothing changed in the Google Ads accounts. The cost per call stayed the same. The conversion rates stayed the same. The campaigns kept running. We have seen the same result across every partner practice we have cleaned up. Google Signals affects analytics features like audience building and demographic reporting. It does not affect Google Ads bidding.

If your Google Ads performance drops after disabling Google Signals, the problem is not Google Signals. The problem is that you were not tracking conversions properly to begin with.

How to Set Up GA4 Properly for a Clinic

Here is the checklist we use when setting up GA4 for a podiatry practice.

Turn off Google Signals. Data Settings, Data Collection, disable Google Signals. Do this first.

Disable advertising features. Google Analytics offers advertising personalization and remarketing features. Both require sharing data with Google's advertising services. Turn them off. You cannot remarket to people who visited your diabetic foot care page without creating a HIPAA disclosure risk.

Set up call tracking with key events. Use a call tracking provider that integrates with GA4. When a tracked call fires, it should trigger a custom event in GA4, labeled something like phone_call. Mark that event as a key event in your GA4 property so it shows up in your conversions report.

Track form submissions as a separate key event. If someone submits your contact form or appointment request form, fire a custom event. Label it clearly so you can distinguish form fills from calls. Not all form submissions are equal. A newsletter signup is not a new patient lead. Track the forms that matter.

Upload CRM conversions. If your CRM can export new patient records with a Google click ID or client ID attached, upload those conversions into GA4 and into Google Ads. This gives you the cleanest signal. A booked patient is worth more than a call, and a call is worth more than a form fill. Measure what matters.

Add a consent banner. GA4 requires user consent under GDPR and many state privacy laws. Even if HIPAA does not explicitly require a consent banner for analytics, the safer move is to add one. We recommend a banner that blocks GA4 from firing until the visitor opts in. It reduces your session counts, but it also reduces your compliance risk.

Review your data retention settings. GA4 defaults to 14 months of user-level and event-level data retention. That is longer than necessary for most practices. We recommend setting it to 2 months. You still get aggregated reporting. You just do not hold identifiable behavioral data for over a year.

Most practices skip half of this. Then they wonder why their analytics shows thousands of sessions and no leads, or why their HIPAA consultant flags their website during an audit.

What This Means for Your Growth Reporting

A compliant GA4 setup changes what you can measure, but it does not make the data less useful. You lose demographic breakdowns, remarketing audiences, and cross-device user tracking. You gain a setup that does not create disclosure risk and a conversion funnel that actually reflects how patients book.

The report a podiatry practice owner should read every month does not show bounce rate or average session duration. It shows phone calls, form submissions, booked patients, and cost per new patient. We have written before about what a perfect podiatry growth report looks like. The foundation is always the same: measure on outcomes, not on activity.

If you are running Google Ads for your podiatry practice, the conversion data from a properly configured GA4 property flows into your campaigns and improves bidding. If you are relying on call tracking to see which marketing channels are actually filling the schedule, GA4 becomes the reporting layer that ties it all together.

The practices that grow are not the ones with the most data. They are the ones with the right data, measured in a way that does not create compliance risk.

FAQ

Does turning off Google Signals hurt my Google Ads performance?

No. Google Ads bidding relies on conversion data sent through the click ID, not on Google Signals. As long as you are tracking calls, form submissions, or CRM uploads as conversions, your campaigns will optimize normally. Across the podiatry groups we work with, disabling Google Signals had zero impact on cost per call or conversion rates.

Can I use GA4 for remarketing to people who visited my website?

Not in a HIPAA-compliant way. Remarketing requires building an audience of identifiable users and sharing that list with Google's advertising services. If someone visited your plantar fasciitis treatment page, remarketing to them discloses their health interest to a third party. The safer move is to avoid remarketing entirely on a clinic website.

What key events should a podiatry practice track in GA4?

Phone calls, form submissions, and booked appointments uploaded from your CRM. Those are the three conversions that matter. Most practices still have the default generate_lead event, which reports zero until configured. If your GA4 property cannot see calls, you are blind to 90 percent of your new patient opportunities.

Do I need a consent banner for Google Analytics on a medical website?

Legally, it depends on your state and whether you serve visitors from GDPR regions. Practically, yes. A consent banner that blocks GA4 until the visitor opts in reduces both your session counts and your compliance risk. Most HIPAA consultants will flag an analytics setup that fires without consent.

Ready to Build a Compliant Marketing System That Actually Books Patients?

Podiatry Performance builds marketing systems for podiatry practices and measures them on booked patients. Start with a discovery call and a free audit: thirty minutes on fit and the pain point behind the open slots, then the six plays ranked for your practice. The audit is yours to keep, whether we work together or not. Book a discovery call and free audit.