Why analytics went dark
Healthcare removed its analytics — and went blind
The tracking stack that every other industry takes for granted became a legal liability for covered entities. Three facts explain the gap this design sets out to close.
Privacy exposure
Regulators and courts now treat third-party trackers on health sites as a serious privacy exposure — health systems are removing them wholesale.
Google won’t sign the contract healthcare needs
Hospitals and clinics strip Google Analytics and ad trackers because Google won’t sign the HIPAA contract (BAA) that covered entities legally require.
Budgets are reallocated blind
With tracking gone, nothing connects a paid click to a booked patient — budgets are reallocated blind.
BAA = Business Associate Agreement, the HIPAA contract where a vendor takes legal responsibility for patient data.
What gets collected
The difference is what gets collected and stored — not just whose server
Anyone can self-host an analytics tool and still collect everything. What separates this design is, first, what is collected and stored at all — de-identified events only, with the sensitive parts (URL paths that can name a condition, IP addresses, device details) redacted or discarded at collection and never stored, even on our side — and, second, who may use the data: as your Business Associate we would use it only for your measurement, never for our own purposes.
Click-IDs and the anonymous first-party ID are unique codes — under HIPAA they may only be stored by a party bound by a BAA, which is how this design handles them; nothing that links them to a person or condition ever leaves.
The ad platform still learns “click X converted” — enough to optimize campaigns. It never learns who the person is or what care they sought.
Private by construction
Private by construction
Five steps from ad click to measured booking, as designed. Collection is first-party, on the clinic’s own domain; storage of the de-identified events stays inside the BAA boundary — and the allowlist, not an after-the-fact filter, decides what leaves.
- 01
Ad click lands
Google, Meta, and LinkedIn append their click ID to the landing URL — the one identifier the ad platform already owns.
- 02
A snippet on your own domain
Collection is first-party: a ~3KB tracking snippet reports to an endpoint on the clinic’s own domain. No third-party beacons.
- 03
Server-side allowlist
The default is send nothing: IP discarded, URL path redacted, PHI blocked — at collection, before anything is stored.
- 04
Storage inside the BAA boundary
De-identified events land in your own warehouse next to your ad-spend data — or Improvado stores them for you as your Business Associate under a signed BAA. Either way, storage never leaves the BAA boundary, and you stay the data owner.
- 05
Click ID only
Optionally, the bare click ID returns to the ad platform so bidding keeps learning.
- ✓ We sign a BAA and operate as your Business Associate
- ✓ A consent banner in the design: tracking starts only after explicit visitor consent
- ✓ Designed for US-only data residency, encryption in transit and at rest, and a full audit log
For what Google Ads and Meta would receive from one booked visit, field by field, see healthcare conversion tracking.
What you see
What you see
Compliance evidence
Compliance you can show your legal team
Five design-partner questions
Design partners: five questions, thirty minutes
The tracking layer is not built yet. Your answers to five questions decide what gets built first.
- 1
Is this problem real for you and your clients today — how painful is the loss of web analytics?
- 2
How do you measure paid campaigns right now without GA — and what does that cost you?
- 3
Once it is built, would you pilot it on one property or sub-client site?
- 4
Looking at these mockups, what is missing for your day-to-day work?
- 5
What would your compliance and legal team need to see to approve a pilot?