Is Google Analytics 4 HIPAA-compliant without a BAA?

No — and there is no "with a BAA" version either, because Google's own policy, titled "HIPAA and Google Analytics," states that Google "does not offer Business Associate Agreements in connection with this service" and "makes no representations that Google Analytics satisfies HIPAA requirements" (Google Analytics Help, verified live August 17, 2026).

The qualifier: this makes GA4 unusable on HIPAA-covered pages, not unusable everywhere. Google's policy draws the line itself — customers subject to HIPAA "may only use Google Analytics on pages that are not HIPAA-covered," and should keep tags off authenticated pages and off unauthenticated pages whose content relates to health care in a way that could constitute PHI. Whether your agency is subject to HIPAA is a separate, fact-specific question, but Google's terms are not the only constraint: the FTC penalized GoodRx and BetterHelp a combined $9.3 million in 2023 for sending health data to ad platforms, HIPAA status notwithstanding.

What Google's policy actually says

• No BAA, at any tier: "Google... does not offer Business Associate Agreements in connection with this service." The Workspace/Cloud BAA does not include Analytics. (Google, "HIPAA and Google Analytics.")
• No compliance claim: Google "makes no representations that Google Analytics satisfies HIPAA requirements." (Same source.)
• An explicit usage restriction: HIPAA-regulated customers "must not use Google Analytics in any way that implicates Google's access to, or collection of, PHI, and may only use Google Analytics on pages that are not HIPAA-covered." (Same source.)
• Regulators name the product: the FTC and HHS's July 20, 2023 joint letter to about 130 hospital systems and telehealth providers cited "the Meta/Facebook pixel and Google Analytics" as capable of revealing appointment scheduling and provider-page visits.

One nuance worth stating precisely: a June 20, 2024 federal court ruling vacated HHS's position that an IP address plus a visit to a public health-related page is automatically PHI — the current status of OCR's tracking guidance covers exactly what survived. That ruling narrowed one HIPAA theory; it changed nothing about Google's refusal to sign a BAA, nothing about pages where visitors submit health information, and nothing about the FTC's separate authority. If you need analytics on health pages, the answer is a tool that signs a BAA or runs on your own infrastructure, not a GA4 settings change. And a confidentiality agreement is not a workaround: an NDA does not satisfy HIPAA's vendor-contract requirement, for reasons the regulation spells out — the difference between an NDA and a BAA.

This page is sourced information, not legal advice. For a compliance decision about your agency, talk to counsel who knows your state and your book of business.