Answers · HIPAA & Tracking
Which analytics tools can a health insurance agency legally use?
Last reviewed: · Strategic AI Architects Data Desk · reviewed by Mike Moore
A health insurance agency can legally run analytics that keeps visitor data on infrastructure the agency controls or comes from a vendor that will sign a Business Associate Agreement — self-hosted Matomo (no vendor ever touches the data), Piwik PRO's enterprise plan (signs a BAA, per its published HIPAA terms), and Freshpaint's healthcare compliance plan (offers a BAA) are the established examples — while GA4 and the Meta Pixel, which offer no BAA, are restricted by Google's and HIPAA's own terms to pages that never touch health information.
Two qualifiers keep this honest. First, "legally" depends on whether your agency is HIPAA-regulated at all, which is fact-specific — but the FTC has penalized non-HIPAA businesses (GoodRx, $1.5 million, February 2023; BetterHelp, $7.8 million, July 2023) for the same data flows under the FTC Act, so the safe architecture is the same either way. Second, a compliant tool can still be deployed non-compliantly: the vendor list below is necessary, not sufficient.
The realistic options, compared
| Tool | BAA available? | Where it can sit |
|---|---|---|
| Google Analytics 4 | No — Google's policy states no BAA is offered | Non-health pages only, per Google's own HIPAA terms |
| Meta Pixel | No | Off quote forms and health-condition pages; consent-gated elsewhere |
| Piwik PRO (enterprise) | Yes — signs a BAA; EU/US hosting choice | Site-wide, including health pages |
| Freshpaint (compliance plan) | Yes — healthcare-focused, offers a BAA | Site-wide, forwards consented events to ad platforms |
| Matomo, self-hosted | Not needed — vendor never accesses your data | Site-wide; compliance burden is yours (Matomo HIPAA FAQ) |
| Server-side, consent-gated tagging | Depends on what you forward, to whom | Site-wide, if consent is checked and health fields stripped before forwarding |
The architecture matters as much as the vendor. HHS OCR's tracking guidance (revised March 18, 2024) makes the trigger concrete: a vendor that receives PHI on behalf of a regulated entity is a business associate needing a BAA, and pages where visitors submit health information are where that happens. So the two defensible patterns are (1) a BAA-signing or self-hosted tool site-wide, or (2) mainstream ad-platform tags kept strictly off health pages and gated behind real prior consent everywhere else — with server-side forwarding, so consent is actually enforced rather than displayed. What consent can and cannot fix, and why a banner alone is not the answer, is its own question.
Sources
- Google. "HIPAA and Google Analytics" — "Google... does not offer Business Associate Agreements in connection with this service" and "makes no representations that Google Analytics satisfies HIPAA requirements." Verified live 2026-08-17. support.google.com.
- Piwik PRO. "Analytics for healthcare — HIPAA-compliant marketing analytics platform," BAA availability on the enterprise plan. Verified live 2026-08-17. piwik.pro.
- Matomo. "Configure Matomo Analytics for HIPAA compliance," self-hosted deployment FAQ. Verified live 2026-08-17. matomo.org.
- U.S. Department of Health and Human Services, Office for Civil Rights. "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates," revised 2024-03-18. hhs.gov.
- Federal Trade Commission. GoodRx enforcement action, 2023-02-01, and BetterHelp final order, 2023-07-14. ftc.gov.
This page is sourced information, not legal advice. For a compliance decision about your agency, talk to counsel who knows your state and your book of business.
Related questions
Can I keep GA4 if I only sell life insurance or P&C?
The HIPAA-specific analysis mostly falls away if your site never collects or displays health information — HIPAA, the FTC's Health Breach Notification Rule, and CMS's TPMO rule are keyed to health data and Medicare marketing. Wiretapping-style claims under statutes like California's CIPA are not health-specific, so consent-gating your tags is still the defensive posture, but the BAA question stops being the blocker.
Is server-side tagging by itself enough?
No — routing events through your own server is the mechanism, not the compliance. It becomes defensible when your server checks recorded consent before forwarding anything, strips health-adjacent fields, and keeps raw visitor data off vendors that won't sign a BAA. A server-side container that forwards everything unconditionally reproduces the client-side problem one hop later.
Do cookieless tools like Plausible or Fathom solve the problem?
They shrink it — they collect no cross-site identifiers and minimal visitor data — but 'cookieless' is not a legal category. If a HIPAA-regulated page sends a vendor identifiable health information without a BAA, the cookie technology used is beside the point. Evaluate them the same way: what data leaves the page, to whom, under what agreement.
Want to know where your own site stands? Run the free Audit — a live AEO audit plus a HIPAA tracking scan — or browse all answers.