Google’s own support page on HIPAA says it plainly: Google makes no representations that Google Analytics satisfies HIPAA requirements, and it does not offer Business Associate Agreements for the service. For a treatment center, that single sentence decides how analytics has to be set up.
It doesn’t mean GA4 has to go. It means GA4 can’t receive protected health information, and any vendor that does receive it needs a signed BAA.
Treatment centers have two workable paths: replace GA4 with an analytics platform that signs a BAA, or keep GA4 behind a BAA-covered layer that strips PHI before anything reaches Google.
This guide ranks eleven options across both paths, based on each vendor’s published BAA terms, deployment model, and fit for a treatment center marketing team.
It’s the evaluation behind the analytics recommendations we make inside our admission ops and attribution work, and every BAA and pricing detail links to the vendor’s own page as of September 2026.
For the attribution model these tools feed, see our complete guide to attribution for treatment centers. This piece is about choosing the tool.
Key Takeaways
- Google says it does not offer a BAA for Google Analytics, so GA4 can’t receive PHI. Treatment centers either replace it or keep it behind a BAA-covered layer that removes PHI first.
- HHS guidance says tracking vendors that receive PHI need a signed BAA, and that a regulated entity can instead use a BAA-covered vendor to de-identify data before it goes to one that won’t sign.
- BAA terms are plan-specific. Piwik PRO offers a BAA on its Enterprise plan, PostHog from its Boost package, Mixpanel on Enterprise, Twilio Segment on Business, and Stape on Custom plans.
- Some well-known privacy-focused tools don’t sign BAAs. Plausible states it is not HIPAA compliant, and Matomo says its Cloud service is not HIPAA compliant.
- A BAA is necessary but not sufficient. Configuration still decides whether PHI leaks through URLs, event names, or form fields.
- Choose by team and stack: a web analytics replacement for most single-facility operators, a BAA-covered routing layer when GA4 and ad platforms need to stay connected.
What makes an analytics setup HIPAA-safe
Three requirements apply to every option in this guide, whichever path you choose.
A signed BAA with any vendor that receives PHI. HHS’s tracking technologies bulletin says regulated entities must make sure tracking technology vendors that receive PHI have signed a BAA, and treats an impermissible disclosure to a vendor as a presumed breach.
The same guidance describes signing a BAA with one vendor, such as a customer data platform, to de-identify information before it goes to a vendor that won’t sign.
An accurate read of which pages carry PHI. In June 2024 a federal court vacated part of that guidance covering certain unauthenticated public pages.
Google’s own HIPAA guidance for Google Analytics still describes authenticated pages as likely HIPAA-covered and says unauthenticated pages tied to providing care are more likely covered. Treat intake forms, verification flows, and patient portals as PHI surfaces.
Configuration that keeps PHI out. A BAA doesn’t stop a form from writing an email address into a URL. The setup still needs neutral event names, no form values in query strings, and no condition or level-of-care detail attached to identifiable users. Our GA4 configuration guide and HIPAA-safe conversion tracking stack cover those rules.
Substance use disorder programs also have 42 CFR Part 2 to consider, which adds its own consent rules for SUD records. None of the tools below removes the need for counsel to review the final setup.
How we ranked the options
Rankings reflect fit for a typical treatment center marketing team, judged on five criteria from each vendor’s public documentation:
- BAA availability: whether the vendor signs a BAA, and on which plan.
- Web analytics coverage: how much of what a marketing team uses GA4 for (traffic sources, landing pages, conversions) the tool covers out of the box.
- Ad platform fit: whether it can feed conversion signal to Google and Meta through a PHI-stripped path.
- Setup effort: whether a marketing team can run it or it needs engineering.
- Pricing transparency: whether plans and BAA tiers are published.
We didn’t receive payment or referral fees from any vendor listed. BAA terms and pricing change, so confirm both with the vendor in writing before you sign.
DEFINITION
BAA-covered analytics. A web or product analytics platform whose vendor signs a Business Associate Agreement covering the data it receives, so it can lawfully process PHI on the treatment center’s behalf. The BAA makes processing permissible; the configuration determines whether anything unnecessary gets collected at all.
The 11 options, ranked
The table summarizes each option’s path, BAA terms, and published pricing.
| Rank | Tool | Path | BAA | Plan with BAA | Public pricing |
|---|---|---|---|---|---|
| 1 | Piwik PRO | Replace GA4 | Yes | Enterprise | From €366/mo, billed annually |
| 2 | Freshpaint | Keep GA4 behind a BAA layer | Yes | Confirm with sales | Through sales |
| 3 | Ours Privacy | Either path | Yes | Every plan | By demo |
| 4 | Matomo On-Premise | Replace GA4 | With your host | Self-hosted | See vendor pricing page |
| 5 | Server-side GTM on Stape | Keep GA4 behind a BAA layer | Yes | Custom | See vendor pricing page |
| 6 | PostHog | Replace GA4 | Yes | Boost and above | Boost $250/mo |
| 7 | Mixpanel | Replace GA4 | Yes | Enterprise | Through sales |
| 8 | Amplitude | Replace GA4 | Yes | Confirm with sales | Through sales |
| 9 | Twilio Segment | Keep GA4 behind a BAA layer | Yes | Business | See vendor pricing page |
| 10 | Tealium | Keep GA4 behind a BAA layer | Yes | Private Cloud recommended | Through sales |
| 11 | Adobe Customer Journey Analytics | Replace GA4 | Yes | HIPAA-ready services only | Through sales |
Full notes on each option follow, in ranked order.
1. Piwik PRO (Enterprise plan)
Path: replace GA4. BAA: yes, on the Enterprise plan.
Piwik PRO is the closest match to GA4-style web analytics among BAA-eligible tools. Its HIPAA page describes signing the BAA before any data is collected and lists HIPAA-compliant Azure hosting in the US.
The BAA sits on the Enterprise plan. Piwik PRO’s plan page lists the Business plan with EU hosting in Sweden and no BAA, while Enterprise includes a customizable BAA. Enterprise pricing is listed as starting from €366 per month billed annually.
Best for: single- and multi-facility operators who want a web analytics replacement their marketing team can run without engineering support.
Watch for: picking the Business plan by mistake. Confirm the Enterprise tier and US hosting in the contract.
2. Freshpaint
Path: keep GA4 behind a BAA layer. BAA: yes; confirm the tier with sales.
Freshpaint is built for healthcare marketing teams. Its privacy compliance page describes BAA-covered tracking infrastructure that sits between the site and marketing tools. That’s the de-identification pattern HHS describes, which makes it a practical way to keep GA4 and ad platforms connected.
Plans are listed as Comply, Perform, and Scale, each with pricing through sales. The published pages don’t state which tier includes the BAA, so get that in writing.
Best for: teams that want to keep GA4 reporting and ad platform conversions while moving PHI handling to a BAA-covered vendor.
Watch for: assuming every downstream tool is safe. The layer only protects what it’s configured to strip.
3. Ours Privacy
Path: either path. BAA: yes, on every plan.
Ours Privacy’s pricing page lists a BAA on every tier, from Essential (up to 50,000 monthly tracked users) through Enterprise+, with US hosting. Pricing is by demo.
Best for: operators who want a BAA without negotiating a plan upgrade, and teams that need both analytics and a PHI-safe path to ad platforms.
Watch for: confirming which destinations and integrations your plan includes before migrating.
4. Matomo On-Premise
Path: replace GA4. BAA: with your hosting provider, not with Matomo.
Matomo’s HIPAA FAQ says its Cloud service is not HIPAA compliant and points healthcare users to self-hosted On-Premise on HIPAA-compliant infrastructure. Because Matomo doesn’t host the data, you sign the BAA with your host instead.
Best for: organizations with IT capacity to run and patch a self-hosted application, and those that want full control of where data lives.
Watch for: the hosting. Self-hosting shifts security and uptime to your team, and the host’s BAA is what makes the setup permissible. Check Matomo’s pricing page for current plan options.
5. Server-side Google Tag Manager on Stape (Custom plan)
Path: keep GA4 behind a BAA layer. BAA: yes, on Custom plans.
A server-side tag manager container is the connecting layer in our HIPAA-safe conversion tracking stack: the site sends events to your container, the container strips PHI, and only neutral events go on to GA4 and ad platforms. Stape’s pricing page lists BAA signing only on Custom plans; its self-serve tiers don’t include it.
Best for: teams with tag management expertise who want full control over what each platform receives.
Watch for: the plan. A self-serve Stape container doesn’t come with a BAA, and the container’s rules are only as good as whoever writes them.
How an inpatient rehab scaled paid media to 95 admits while cutting cost per admission by 24%
Campaign consolidation and PMAX optimization drove 30% admission growth with improved efficiency, all while maintaining OON payer mix.
Read the case study →Q3 2025
6. PostHog (Boost package and above)
Path: replace GA4. BAA: yes, from the Boost package.
PostHog’s HIPAA documentation recommends its Cloud service under a BAA, and its platform packages page lists the HIPAA BAA in the Boost package at $250 per month, with Scale at $750 and custom Enterprise pricing.
The documentation notes that its managed reverse proxy and AI features aren’t covered by the BAA, so leave those off.
Best for: teams with developer support that want product analytics, session analysis, and experimentation in one tool.
Watch for: the excluded features, and the technical setup compared with a marketing-focused web analytics tool.
7. Mixpanel (Enterprise plan)
Path: replace GA4. BAA: yes, on the Enterprise plan.
Mixpanel’s HIPAA page says its standard BAA is available to Enterprise plan customers, with eligibility confirmed through sales.
Best for: larger operators already using event-based product analytics for patient portals or digital programs.
Watch for: fit. Mixpanel is built around product events rather than marketing channel reporting, so traffic source analysis takes more setup than in a web analytics tool.
8. Amplitude
Path: replace GA4. BAA: yes; confirm the plan with sales.
Amplitude’s security and privacy page says it can enter a BAA. The page doesn’t state which plan is required.
Best for: operators with digital products or apps who want behavioral analytics and already have analytics engineering capacity.
Watch for: the same product-versus-marketing fit issue as Mixpanel, and confirm the BAA tier before you build.
9. Twilio Segment (Business tier)
Path: keep GA4 behind a BAA layer. BAA: yes, on the Business tier.
Segment is a customer data platform: it collects events once and routes them to other tools. Twilio’s HIPAA-eligible Segment documentation says BAAs are available on the Business tier, not on Free or Team, and that each product should be checked against Twilio’s HIPAA-eligible list.
Best for: multi-facility operators with data engineering support routing events to many destinations.
Watch for: destinations. Segment can send data anywhere, which is also the risk; every destination needs its own review.
10. Tealium (Private Cloud)
Path: keep GA4 behind a BAA layer. BAA: yes.
Tealium’s HIPAA page says it enters into BAAs with HIPAA customers and recommends its Private Cloud for PHI.
Best for: large health systems and multi-state operators with enterprise tag management and data teams.
Watch for: scale. It’s more platform than most single-facility treatment centers need.
11. Adobe Customer Journey Analytics
Path: replace GA4. BAA: yes, for listed HIPAA-ready services.
Adobe’s HIPAA-ready services list includes Customer Journey Analytics (excluding CJA Labs). Adobe Analytics itself is not on that list, so the product name matters.
Best for: enterprise organizations already on Adobe Experience Cloud.
Watch for: licensing. You need the correct license plus a signed BAA, and PHI can’t pass through Adobe services that aren’t on the HIPAA-ready list.
Tools that don’t fit without a BAA layer
Several popular analytics tools either state they don’t sign BAAs or don’t address HIPAA at all. They can still have a place, but only on pages and events that never carry PHI, or behind a BAA-covered layer.
- Google Analytics 4: no BAA, per Google’s HIPAA guidance. Usable only for data that isn’t PHI.
- Plausible: its own guidance says it is not HIPAA compliant and doesn’t offer a BAA.
- Matomo Cloud: not HIPAA compliant, per Matomo’s FAQ. Use On-Premise instead.
- Fathom Analytics: its compliance page covers GDPR, CCPA, and other privacy laws but doesn’t address HIPAA or BAAs.
- Heap: a 2023 Heap post says it signs BAAs, but its current security pages don’t mention HIPAA. Get current terms in writing before relying on it.
COMMON MISTAKE
Treating “privacy-friendly” as “HIPAA-compliant.” Cookieless, anonymized analytics tools are built around laws like GDPR, and several say outright that they don’t sign BAAs. Privacy-friendly design reduces what a tool collects; it doesn’t create the contract HIPAA requires when PHI is involved.
If a tool’s documentation doesn’t mention a BAA, assume it doesn’t offer one until the vendor confirms in writing.
How to choose between the two paths
The deciding question is whether your team needs GA4 and ad platforms connected.
Replace GA4 if your marketing team mainly needs traffic, landing page, and conversion reporting, and your paid media conversions already run through a separate compliant setup. Piwik PRO Enterprise is the most direct swap; PostHog, Mixpanel, and Amplitude fit teams with developer support.
Keep GA4 behind a BAA layer if you rely on GA4’s integration with Google Ads, or you need a single PHI-stripping path for GA4, Google Ads, and Meta. Freshpaint, Ours Privacy, a server-side container on Stape’s Custom plan, Segment, and Tealium all fit, in rough order of setup effort.
Either way, the conversion events should be neutral value tiers rather than descriptive names, and every platform’s count should be reconciled against admits in your CRM each month. Clean, admit-level conversion data is also what lets paid campaigns lower cost per admit instead of optimizing toward cheap form fills.
OPERATOR INSIGHT
The vendor decision is usually the easy part. The work that protects a treatment center is the inventory that comes before it: every page, form, pixel, and third-party script on the site, and what each one sends where.
Run that inventory first. It tells you which path you need, which destinations the BAA has to cover, and which old tags to remove before the new tool goes live.
The migration checklist
Whichever option you choose, the move from an unprotected GA4 setup follows the same order.
Inventory every tag and script
Inventory every tag and script on the site, including chat widgets, heatmaps, and embedded forms.
Map PHI surfaces
Map PHI surfaces: intake forms, verification flows, thank-you pages, portals, and any page whose URL can carry form values.
Sign the BAA
Sign the BAA with the analytics or routing vendor before any data flows, and confirm the plan tier in writing.
Configure neutral events
Configure neutral events and strip query strings and form values before they reach any analytics or ad platform.
Run old and new setups in parallel
Run old and new setups in parallel long enough to compare counts, then remove the old tags from PHI surfaces.
Reconcile against the CRM
Reconcile against the CRM monthly, and repeat the tag inventory whenever the site, plugins, or vendors change.
Our call tracking attribution guide covers the phone side of the same setup, since most admissions still start with a call.
For how attribution fits your wider program, see our behavioral health marketing guide. If you want help choosing and configuring a tool, book an intro meeting and we’ll review your current setup with you.
30 minutes to talk through your census goals, payer mix, and what a realistic growth plan looks like for your facility.
No pitch. No pressure. Just a straight conversation from a team that has worked with 200+ treatment centers nationwide.
Frequently Asked Questions
Can a treatment center use Google Analytics at all?
Yes, for data that isn’t PHI. Google says it doesn’t offer a BAA for Google Analytics and asks regulated entities not to send it protected health information, so GA4 can’t sit on intake forms, portals, or other PHI surfaces with standard tagging.
Many treatment centers keep GA4 by routing events through a BAA-covered layer first, such as a healthcare tracking platform or a server-side container on a plan that includes a BAA. That layer removes PHI before GA4 receives anything.
The trade-off is configuration discipline. The layer protects only what it’s set up to strip, so event names, URLs, and form fields still need review.
Is a BAA enough to make analytics HIPAA-compliant?
No. A BAA makes it permissible for the vendor to handle PHI on your behalf, but it doesn’t stop your site from collecting more than it should or passing PHI to other tools.
Compliance also depends on configuration (what’s collected and where it goes), access controls, and your own policies. HHS’s tracking guidance treats disclosures without a BAA or other permission as presumed breaches, so the contract matters, but it’s the starting point.
Have counsel review the final setup, especially for substance use disorder programs covered by 42 CFR Part 2.
Which option is best for a single-facility treatment center?
For most single-facility operators without engineering support, a web analytics platform with a BAA is the simplest route. Piwik PRO’s Enterprise plan is the closest to GA4 in how a marketing team uses it.
If the facility depends on GA4’s link to Google Ads, a BAA-covered routing layer such as Freshpaint or Ours Privacy keeps that connection while moving PHI handling to a vendor that signs.
Whatever you choose, confirm the BAA tier in writing. Several vendors offer a BAA only on higher plans.
Do privacy-focused tools like Plausible or Fathom work for treatment centers?
Not for PHI. Plausible states it isn’t HIPAA compliant and doesn’t offer a BAA, and Fathom’s compliance page doesn’t address HIPAA.
They can still be used on pages that never carry PHI, such as blog content, if your compliance team is comfortable with that scope.
The risk is scope creep. Once a tag sits in a site-wide template, it tends to end up on intake and verification pages too.
How long does it take to move off an unprotected GA4 setup?
It depends on how many tags, forms, and destinations the site has. The inventory and BAA steps can move quickly; parallel tracking needs long enough to compare counts with confidence.
Plan the migration in stages rather than a single cutover. Removing old tags before the new setup is verified leaves gaps in reporting and ad optimization.
Keep a record of each step and sign-off. It becomes your documentation if a regulator or platform asks how the setup was built.
Trevor Gage is the Director of Marketing at Webserv, a digital marketing agency for treatment centers.
