I have a complicated relationship with website analytics.
Obviously, therapy practices should know whether their websites are working. They probably want to know how people find a practice, what they search for, whether they land on the page that answers their question, whether anyone reads the therapist profiles, and whether that effort eventually helps people connect with care.
But it’s also important to remember that this is mental health care. “Track everything and figure it out later” is not a particularly good privacy strategy when the people visiting your website may be looking for help with depression, trauma, substance use, infertility, an eating disorder, domestic violence, or any number of other deeply personal concerns.
So, if you’re wondering, “Should therapists use analytics?” that question is nuanced. I think the better question becomes:
What do you actually need to know about your website, and what information are you willing — and legally permitted — to collect in order to know it?
Can a therapy practice use Google Analytics?
Potentially, but this is not a simple yes.
Google explicitly states that it does not offer a Business Associate Agreement for Google Analytics. Google instructs HIPAA-regulated organizations not to use Analytics in any way that gives Google access to protected health information.
So if your Google Analytics implementation transmits PHI to Google, you can't simply solve the problem by clicking a HIPAA setting or signing Google's standard Analytics terms.
There is no Google Analytics BAA.
This does not necessarily mean every public page on every therapist's website must immediately remove Google Analytics. HIPAA applies when the information involved qualifies as PHI and when the entity involved is subject to HIPAA. However, a therapy practice needs to understand what its analytics implementation collects and where the tracking code runs.
This got more complicated after a 2024 court decision
If you have read older articles about HIPAA and website analytics, you may have seen broad statements that an IP address combined with a visit to a health-related webpage automatically becomes PHI.
That no longer accurately summarizes current federal guidance.
HHS previously took a broad position on visitors to unauthenticated health-related webpages. In June 2024, a federal court struck down the portion of the HHS tracking guidance that treated an individual's IP address combined with a visit to a public webpage about specific health conditions or health-care providers as sufficient, by itself, to trigger HIPAA obligations.
So, someone visiting your public article about anxiety does not automatically turn every ordinary piece of website data associated with that visit into PHI.
But many website interactions can involve more than an IP address and a pageview.
Where analytics gets much riskier
Consider the difference between these two events.
Someone anonymously visits your page about therapy for anxiety.
Someone submits a consultation form that contains their name, email, requested therapist, insurance provider, and a message explaining that they are seeking treatment for panic attacks.
If tracking technology captures or receives information about that second interaction, we are in very different territory.
HHS says the HIPAA Rules apply when tracking technologies collect or disclose PHI. HHS also says that when a tracking vendor receives PHI as a business associate, the disclosure needs an applicable HIPAA permission, and the vendor needs an appropriate BAA.
That's what I would focus on when auditing a therapy website.
Not “does this website have Google Analytics?”
Instead:
Where does the analytics script run, what does it receive, and can it send anything sensitive with an event?
Google Analytics has its own privacy restrictions too
Even outside HIPAA, Google Analytics prohibits customers from sending information that Google could use to identify an individual.
Google's HIPAA guidance goes further for regulated organizations: it tells them not to expose Google to PHI and says Analytics should only be used on pages that are not HIPAA-covered. Google specifically warns against placing Analytics on authenticated pages likely to contain health information and tells regulated organizations to work with their legal teams to determine where Analytics can appropriately be used.
This is why installing GA4 globally through a tag manager and forgetting about it can be risky on a health-care site.
Be careful when tracking forms
Modern analytics platforms can track far more than pageviews. A site can fire an event when someone submits a form and record which form they submitted. Developers can create custom events and parameters, and URLs can sometimes contain query strings or values inserted after a user completes an action.
A badly configured implementation can accidentally push information into an analytics system nobody intended to receive it. That is why I prefer to treat sensitive forms as their own little privacy boundary. If someone submits health care-related information, I want to know exactly what scripts run on that page and what happens when they press Submit.
You may need less analytics than you think
This is where I have become somewhat opinionated.
A solo or small group therapy practice probably doesn’t need the same analytics infrastructure as Target. You don’t need cross-device identity graphs, 27 conversion events, session recordings, behavioral cohorts, or an advertising attribution system that can follow one person through a six-month buying journey.
Maybe what you actually want to know is:
Are people finding us?
What are they searching for?
Which pages show up?
Which pages get clicked?
Are people engaging with our important content?
Are consultation requests increasing?
Where do clients tell us they heard about us?
You can often answer those questions with far less tracking.
Google Search Console is one of my favorite starting points
If your primary question is “How are people finding us on Google?”, Search Console is incredibly useful.
It reports things like the search queries that surfaced your website, impressions, clicks, click-through rate, and the pages appearing in Google results.
That is how I discovered, for example, that one therapy practice I worked with didn't actually have the search problem its top-line analytics suggested. Much of its visibility came from informational horticultural-therapy searches that were unlikely to become local clients.
That insight changed what I recommended, and it changed what we implemented. Search Console doesn’t answer every website-behavior question, but for SEO specifically, it can give you a good amount of information without requiring you to build your entire strategy around tracking every action after someone arrives.
Your website platform may already give you enough information
Squarespace, Wix, WordPress hosts, and other platforms often include basic analytics. These tools still need to be evaluated based on your actual setup and vendor terms, but it is worth asking whether you already have enough data before adding another tracker. Sometimes basic traffic trends plus Search Console plus actual consultation/referral data answer the questions a small practice cares about most.
What I would do before installing analytics on a therapist website
I would start with your end goal. Consider what you are trying to learn.
If the answer is “which Google searches are finding us,” start with Search Console.
If you need basic site traffic trends, look at what your website platform already provides and how it handles the data.
If you genuinely need user-level behavior analytics, funnel analysis, or advanced attribution, evaluate tools designed to support health-care privacy requirements, and closely review BAAs, data collection, event design, URLs, forms, and subprocessors.
Then map the high-risk pages separately.
Analytics should answer a question, not become surveillance by default
I still use analytics, because I think it can genuinely improve access to care.
Analytics can tell us that people cannot find the rates page. It can show that a service page is appearing in search results but nobody clicks it. It can reveal that people are finding a practice through completely irrelevant searches. It can help us understand whether an expensive website rebuild accomplished anything.
Those are useful questions. But mental-health websites deserve a higher bar than:
Well, everybody uses Google Analytics.
The goal is to collect enough information to make better decisions while respecting the fact that someone visiting a mental-health website may be doing something deeply personal.
Frequently asked questions
Is Google Analytics HIPAA compliant?
Google does not offer a Business Associate Agreement for Google Analytics and tells HIPAA-regulated customers not to use Analytics in ways that give Google access to PHI. Whether a particular implementation is permissible therefore depends heavily on which pages are tracked and what information is transmitted.
Does visiting a therapy webpage automatically create PHI?
Not necessarily. In 2024, a federal court vacated the portion of HHS guidance that treated an IP address combined with a visit to a public webpage about specific health conditions or providers as sufficient by itself to trigger HIPAA. HHS's current tracking guidance reflects that ruling.
Is a cookie banner enough for HIPAA?
No. HHS specifically says ordinary cookie-consent banners do not constitute HIPAA-compliant authorization for disclosure of PHI.
Is privacy-first analytics automatically HIPAA compliant?
No. “Privacy-first,” “cookieless,” and “HIPAA compliant” describe different things. A vendor may collect very little personal information and still not offer a BAA for situations involving PHI.
What analytics should a therapy practice use?
There is no universal answer. The right setup depends on whether the practice is HIPAA regulated, which pages handle PHI, what information the practice actually needs, the vendors involved, and its risk analysis. For SEO questions specifically, Google Search Console is a useful starting point for impressions, clicks, click-through rates, pages, and search queries.
This article is educational and not legal advice. Tracking technology, privacy laws, and vendor terms change frequently, so health-care practices should verify current vendor documentation and involve qualified privacy or legal professionals when appropriate.