Is Google Analytics HIPAA Compliant?

{
    "jsonapi": {
        "version": "1.0",
        "meta": {
            "links": {
                "self": {
                    "href": "http:\/\/jsonapi.org\/format\/1.0\/"
                }
            }
        }
    },
    "data": {
        "type": "node--article",
        "id": "363b2b19-2095-475f-88ca-69feed46b83b",
        "links": {
            "self": {
                "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b?resourceVersion=id%3A399"
            }
        },
        "attributes": {
            "internalId": 399,
            "isPublished": true,
            "title": "Is Google Analytics HIPAA Compliant?",
            "created": "2023-09-13T20:26:40+00:00",
            "changed": "2024-06-11T14:53:47+00:00",
            "promote": false,
            "sticky": false,
            "metatag": [
                {
                    "tag": "meta",
                    "attributes": {
                        "name": "title",
                        "content": "Is Google Analytics HIPAA Compliant? | Inclind"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "name": "description",
                        "content": "Running a business or organization in modern times requires different skills than in the past. For example, it is no longer as easy to track customer interest"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "name": "abstract",
                        "content": "Delaware Drupal web development company specializing in custom Drupal development, real estate and rental brokerage websites, internet marketing and ecommerce"
                    }
                },
                {
                    "tag": "link",
                    "attributes": {
                        "rel": "canonical",
                        "href": "https:\/\/www.inclind.com\/news\/google-analytics-hipaa-compliant"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "name": "robots",
                        "content": "index, follow"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:site_name",
                        "content": "Inclind"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:url",
                        "content": "https:\/\/www.inclind.com\/news\/google-analytics-hipaa-compliant"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:title",
                        "content": "Is Google Analytics HIPAA Compliant?"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:description",
                        "content": "Delaware Drupal web development company specializing in custom Drupal development, real estate and rental brokerage websites, internet marketing and ecommerce"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "place:location:latitude",
                        "content": "38.77513"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "place:location:longitude",
                        "content": "-75.13974"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:street_address",
                        "content": "119 W. Third St., Suite 6"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:locality",
                        "content": "Lewes"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:region",
                        "content": "Delaware"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:postal_code",
                        "content": "19958"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:country_name",
                        "content": "United States"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:email",
                        "content": "hello@inclind.com"
                    }
                },
                {
                    "tag": "meta",
                    "attributes": {
                        "property": "og:phone_number",
                        "content": "(800) 604-8139"
                    }
                }
            ],
            "path": {
                "alias": "\/news\/google-analytics-hipaa-compliant",
                "pid": 1087,
                "langcode": "en"
            },
            "body": {
                "value": "\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003ERunning a business or organization in modern times requires different skills than in the past. For example, it is no longer as easy to track customer interest in your goods or services. Instead of simply looking at profit and loss sheets, a whole world of data is available from websites and social media.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EFor healthcare organizations, this data can be valuable - and it can also create massive legal problems. Tracking tools like Google Analytics are not compliant with federal healthcare privacy rules (HIPAA). It is possible to still track website data, with some careful modifications or the use of a different tracking technology that is HIPAA compliant.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EBased in Delaware, Inclind works with healthcare organizations and other entities throughout the United States. We understand the unique needs of\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/news\/16-best-healthcare-website-designs\u0022\u003E\u003Cspan\u003Ehealthcare websites\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, including the requirement that visitors\u2019 private medical information not be improperly used or disclosed. Reach out today to learn more about our award-winning w\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/solutions\u0022\u003E\u003Cspan\u003Eebsite design and development services\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EWhat Is Google Analytics?\u003C\/span\u003E\u003C\/h2\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Ca href=\u0022https:\/\/marketingplatform.google.com\/about\/analytics\/\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003EGoogle Analytics\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E is a software tool developed by Google that provides basic site analytics and statistics for marketing and search engine optimization (\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/solutions\/technical-seo\u0022\u003E\u003Cspan\u003ESEO\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E) purposes. It works by inserting a JavaScript page tag into the code of each page of a website. This tag then runs in the web browser of site visitors, collecting data, which can then be used to create reports.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EWebsite owners use Google Analytics to track website performance and to collect insights into people who visit their site. It can generate reports on the number of users, page views, bounce rates, average session durations, sessions by channel, and more. Site owners can then use this information to determine the top sources of website traffic, quantify the success of marketing campaigns, and track conversion actions (like completing purchases or adding items to a shopping cart). It can even provide information on browser type, where a person is browsing from (city and country), language, the type of device that they are using, and their age group.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGoogle Analytics is an incredibly important tool for website owners and marketing teams. Without this service, gaining these insights and reports related to website performance would be far more difficult. It is also free, fairly easy to use, and integrates well with other platforms. For these reasons, Google Analytics is the most\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/w3techs.com\/technologies\/overview\/traffic_analysis\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003Ewidely used\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E tool of its kind.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EWhat Is HIPAA?\u003C\/span\u003E\u003C\/h2\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EThe Health Insurance Portability and Accountability Act (\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.hhs.gov\/hipaa\/index.html\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003EHIPAA\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E) is a 1996 law that modernized the flow of healthcare information - and, perhaps most famously, protects private medical information from unauthorized disclosure. More specifically, covered entities must maintain and protect certain protected health information (PHI) related to healthcare.\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EUnder HIPAA, covered entities include health plans (including health insurance companies), most healthcare providers, and healthcare clearinghouses that process PHI that they receive from another covered entity. HIPAA also covers business associates of covered entities.\u0026nbsp;\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EProtected health information includes:\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cul\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInformation that your medical team puts into your medical record\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInformation about you in the health insurance company\u2019s computer system\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EYour billing information\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EConversations between healthcare professionals about your care or treatment\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EMost other health information about you that is held by covered entities.\u003C\/span\u003E\u003C\/li\u003E\u003C\/ul\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EPursuant to HIPAA, covered entities must put safeguards in place to ensure that they do not improperly disclose or use PHI improperly. They must also limit uses and disclosures of PHI to the minimum necessary to accomplish the intended purpose, such as communicating with another healthcare provider. They should also have procedures in place to limit who can view and access PHI, and train employees about HIPAA. Finally, business associates have to put safeguards in place to protect PHI and ensure that this information is not used or disclosed improperly.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EThe\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/laws-regulations\/index.html\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003Econsequences\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E of violating HIPAA are steep. According to the United States Department of Health and Human Services (HHS), a person subject to these rules who violates HIPAA may face a criminal penalty of up to $50,000 plus one year in prison. These penalties can increase to up to a $250,000 fine and 10 years in prison in more extreme cases.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGiven these potential consequences - and the need to protect patients\u2019 and clients\u2019 private information - covered entities should ensure that any information they collect is safeguarded appropriately. This is particularly true for\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/clients\/healthcare-organizations\u0022\u003E\u003Cspan\u003Ehealthcare organizations\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E that maintain websites that use tools like Google Analytics.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EIs Google Analytics HIPAA Compliant?\u003C\/span\u003E\u003C\/h2\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGoogle itself is clear that Google Analytics is\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/support.google.com\/analytics\/answer\/13297105?hl=en\u0022 target=\u0022_blank\u0022\u003E\u003Cstrong\u003Enot\u0026nbsp;\u003C\/strong\u003E\u003Cspan\u003EHIPAA compliant\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E. The tech giant asks customers who are covered entities under HIPAA to refrain from exposing any protected health information (PHI). Google will not certify that Google Analytics satisfies HIPAA requirements and does not offer any agreements that it will comply with HIPAA\u2019s privacy rules.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAccording to\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/guidance\/hipaa-online-tracking\/index.html\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003EHHS\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, covered entities are prohibited from using tracking technologies like Google Analytics which would result in improper disclosures of PHI to the technology vendor. HHS advises that all types of information may be considered PHI,\u0026nbsp;\u003C\/span\u003E\u003Cem\u003Eeven if an individual does not have an existing relationship with a covered entity\u003C\/em\u003E\u003Cspan\u003E. This includes information such as:\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cul\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EA medical record number\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EHome or email address\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EDates of appointments\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAn individual\u2019s IP address or geographic location,\u0026nbsp;\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EMedical device IDs\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAny unique identifying code\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003ENetwork location\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGeolocation\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAdvertising ID\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EFingerprint used for log-in\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EHome or email addresses\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EDiagnosis and treatment information\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EPrescription information\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EBilling information\u003C\/span\u003E\u003C\/li\u003E\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInformation created for a login on a patient portal\u003C\/span\u003E\u003C\/li\u003E\u003C\/ul\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EIn some cases, the fact that an individual searches for a medical condition or physician on a covered entity\u2019s website may be PHI, even if that person isn\u2019t a patient. That is because information about the individual\u2019s search, their IP address, email address, and other identifying information may be transmitted to Google. For example, if a person visits a healthcare provider\u2019s website to search for information about Parkinson\u2019s Disease, Google Analytics tracking the individual\u2019s search and their IP address could be considered a HIPAA violation.\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EThis reality puts healthcare organizations in a difficult position. Like other website owners, the data collected by tools like Google Analytics is incredibly valuable to them. Yet at the same time, using Google Analytics could put their patients\u2019 private medical information at risk - potentially leading to a HIPAA violation.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EMaking Google Analytics HIPAA-Compliant\u003C\/span\u003E\u003C\/h2\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EThere are workarounds that allow healthcare organizations to use Google Analytics and comply with HIPAA. Essentially, you will need to change the settings so that no PHI is exposed or transmitted to Google.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAs an initial step, you can use Google Tag Manager (GTM) to manage your website\u0027s tags or tracking codes. You can then remove tracking data for things like IP addresses, patient names, medical records, addresses, appointment dates, diagnosis, location, age, and gender.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInstead of using Google Analytics to collect potential PHI, you can focus on aggregate data, like traffic patterns and user behavior. In this way, you can still get valuable insight into how visitors interact with your website without potentially violating HIPAA.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EOf course, this option will not give you all of the data that you might need to optimize your website. There are some tracking tools that are HIPAA compliant. You could opt to use a different company that will sign a business associate agreement with your organization to avoid a potential HIPAA violation.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EThese issues are incredibly complex. There isn\u2019t an easy solution, given HHS\u2019 guidance and Google\u2019s very clear stance that Google Analytics is not HIPAA compliant and will not sign a business associate agreement. In this situation, an experienced website design and development team - like Inclind - can work with you to find a way to track website data in a way that protects visitors\u2019 PHI and helps you avoid HIPAA violations.\u003C\/span\u003E\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EBuild \u0026amp; Maintain Your Healthcare Site With Inclind\u003C\/span\u003E\u003C\/h2\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003ERunning a website as a healthcare organization can be tricky. In addition to providing accurate information, you must also ensure that your patients\u2019 healthcare information is protected. While tools like Google Analytics are helpful for website administrators and marketing teams, they are not HIPAA compliant.\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInclined has years of experience helping healthcare entities design and develop beautiful,\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/solutions\/accessibility-audits\u0022\u003E\u003Cspan\u003Eaccessible\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, and secure websites.\u0026nbsp; We understand that healthcare providers, insurance companies, and related organizations have different needs. Our website designers and developers will use their skills and know-how to ensure that every aspect of your website functions well - and complies with HIPAA. We can also help you make updates to your existing site to maintain compliance with our website support and maintenance services.\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EIf you\u0027re interested in knowing more about our web design,\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/services\u0022\u003E\u003Cspan\u003Edevelopment\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, and\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/support\u0022\u003E\u003Cspan\u003Esupport\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E services, we are always here to chat with you. You can fill out our\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.inclind.com\/services#link1\u0022\u003E\u003Cspan\u003Eonline contact form\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E or hit the live chat button to speak to one of our experts about your healthcare website.\u003C\/span\u003E\u003C\/p\u003E",
                "format": "full_html",
                "processed": "\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003ERunning a business or organization in modern times requires different skills than in the past. For example, it is no longer as easy to track customer interest in your goods or services. Instead of simply looking at profit and loss sheets, a whole world of data is available from websites and social media.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EFor healthcare organizations, this data can be valuable - and it can also create massive legal problems. Tracking tools like Google Analytics are not compliant with federal healthcare privacy rules (HIPAA). It is possible to still track website data, with some careful modifications or the use of a different tracking technology that is HIPAA compliant.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EBased in Delaware, Inclind works with healthcare organizations and other entities throughout the United States. We understand the unique needs of\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022\/news\/16-best-healthcare-website-designs\u0022\u003E\u003Cspan\u003Ehealthcare websites\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, including the requirement that visitors\u2019 private medical information not be improperly used or disclosed. Reach out today to learn more about our award-winning w\u003C\/span\u003E\u003Ca href=\u0022\/solutions\u0022\u003E\u003Cspan\u003Eebsite design and development services\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EWhat Is Google Analytics?\u003C\/span\u003E\u003C\/h2\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Ca href=\u0022https:\/\/marketingplatform.google.com\/about\/analytics\/\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003EGoogle Analytics\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E is a software tool developed by Google that provides basic site analytics and statistics for marketing and search engine optimization (\u003C\/span\u003E\u003Ca href=\u0022\/solutions\/technical-seo\u0022\u003E\u003Cspan\u003ESEO\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E) purposes. It works by inserting a JavaScript page tag into the code of each page of a website. This tag then runs in the web browser of site visitors, collecting data, which can then be used to create reports.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EWebsite owners use Google Analytics to track website performance and to collect insights into people who visit their site. It can generate reports on the number of users, page views, bounce rates, average session durations, sessions by channel, and more. Site owners can then use this information to determine the top sources of website traffic, quantify the success of marketing campaigns, and track conversion actions (like completing purchases or adding items to a shopping cart). It can even provide information on browser type, where a person is browsing from (city and country), language, the type of device that they are using, and their age group.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGoogle Analytics is an incredibly important tool for website owners and marketing teams. Without this service, gaining these insights and reports related to website performance would be far more difficult. It is also free, fairly easy to use, and integrates well with other platforms. For these reasons, Google Analytics is the most\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/w3techs.com\/technologies\/overview\/traffic_analysis\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003Ewidely used\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E tool of its kind.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EWhat Is HIPAA?\u003C\/span\u003E\u003C\/h2\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EThe Health Insurance Portability and Accountability Act (\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.hhs.gov\/hipaa\/index.html\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003EHIPAA\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E) is a 1996 law that modernized the flow of healthcare information - and, perhaps most famously, protects private medical information from unauthorized disclosure. More specifically, covered entities must maintain and protect certain protected health information (PHI) related to healthcare.\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EUnder HIPAA, covered entities include health plans (including health insurance companies), most healthcare providers, and healthcare clearinghouses that process PHI that they receive from another covered entity. HIPAA also covers business associates of covered entities.\u0026nbsp;\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EProtected health information includes:\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInformation that your medical team puts into your medical record\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInformation about you in the health insurance company\u2019s computer system\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EYour billing information\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EConversations between healthcare professionals about your care or treatment\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EMost other health information about you that is held by covered entities.\u003C\/span\u003E\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EPursuant to HIPAA, covered entities must put safeguards in place to ensure that they do not improperly disclose or use PHI improperly. They must also limit uses and disclosures of PHI to the minimum necessary to accomplish the intended purpose, such as communicating with another healthcare provider. They should also have procedures in place to limit who can view and access PHI, and train employees about HIPAA. Finally, business associates have to put safeguards in place to protect PHI and ensure that this information is not used or disclosed improperly.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EThe\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/laws-regulations\/index.html\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003Econsequences\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E of violating HIPAA are steep. According to the United States Department of Health and Human Services (HHS), a person subject to these rules who violates HIPAA may face a criminal penalty of up to $50,000 plus one year in prison. These penalties can increase to up to a $250,000 fine and 10 years in prison in more extreme cases.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGiven these potential consequences - and the need to protect patients\u2019 and clients\u2019 private information - covered entities should ensure that any information they collect is safeguarded appropriately. This is particularly true for\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022\/clients\/healthcare-organizations\u0022\u003E\u003Cspan\u003Ehealthcare organizations\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E that maintain websites that use tools like Google Analytics.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EIs Google Analytics HIPAA Compliant?\u003C\/span\u003E\u003C\/h2\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGoogle itself is clear that Google Analytics is\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/support.google.com\/analytics\/answer\/13297105?hl=en\u0022 target=\u0022_blank\u0022\u003E\u003Cstrong\u003Enot\u0026nbsp;\u003C\/strong\u003E\u003Cspan\u003EHIPAA compliant\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E. The tech giant asks customers who are covered entities under HIPAA to refrain from exposing any protected health information (PHI). Google will not certify that Google Analytics satisfies HIPAA requirements and does not offer any agreements that it will comply with HIPAA\u2019s privacy rules.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAccording to\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/guidance\/hipaa-online-tracking\/index.html\u0022 target=\u0022_blank\u0022\u003E\u003Cspan\u003EHHS\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, covered entities are prohibited from using tracking technologies like Google Analytics which would result in improper disclosures of PHI to the technology vendor. HHS advises that all types of information may be considered PHI,\u0026nbsp;\u003C\/span\u003E\u003Cem\u003Eeven if an individual does not have an existing relationship with a covered entity\u003C\/em\u003E\u003Cspan\u003E. This includes information such as:\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EA medical record number\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EHome or email address\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EDates of appointments\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAn individual\u2019s IP address or geographic location,\u0026nbsp;\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EMedical device IDs\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAny unique identifying code\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003ENetwork location\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EGeolocation\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAdvertising ID\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EFingerprint used for log-in\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EHome or email addresses\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EDiagnosis and treatment information\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EPrescription information\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EBilling information\u003C\/span\u003E\u003C\/li\u003E\n\u003Cli dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInformation created for a login on a patient portal\u003C\/span\u003E\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EIn some cases, the fact that an individual searches for a medical condition or physician on a covered entity\u2019s website may be PHI, even if that person isn\u2019t a patient. That is because information about the individual\u2019s search, their IP address, email address, and other identifying information may be transmitted to Google. For example, if a person visits a healthcare provider\u2019s website to search for information about Parkinson\u2019s Disease, Google Analytics tracking the individual\u2019s search and their IP address could be considered a HIPAA violation.\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EThis reality puts healthcare organizations in a difficult position. Like other website owners, the data collected by tools like Google Analytics is incredibly valuable to them. Yet at the same time, using Google Analytics could put their patients\u2019 private medical information at risk - potentially leading to a HIPAA violation.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EMaking Google Analytics HIPAA-Compliant\u003C\/span\u003E\u003C\/h2\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EThere are workarounds that allow healthcare organizations to use Google Analytics and comply with HIPAA. Essentially, you will need to change the settings so that no PHI is exposed or transmitted to Google.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EAs an initial step, you can use Google Tag Manager (GTM) to manage your website\u0027s tags or tracking codes. You can then remove tracking data for things like IP addresses, patient names, medical records, addresses, appointment dates, diagnosis, location, age, and gender.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInstead of using Google Analytics to collect potential PHI, you can focus on aggregate data, like traffic patterns and user behavior. In this way, you can still get valuable insight into how visitors interact with your website without potentially violating HIPAA.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EOf course, this option will not give you all of the data that you might need to optimize your website. There are some tracking tools that are HIPAA compliant. You could opt to use a different company that will sign a business associate agreement with your organization to avoid a potential HIPAA violation.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cbr\u003E\u003Cspan\u003EThese issues are incredibly complex. There isn\u2019t an easy solution, given HHS\u2019 guidance and Google\u2019s very clear stance that Google Analytics is not HIPAA compliant and will not sign a business associate agreement. In this situation, an experienced website design and development team - like Inclind - can work with you to find a way to track website data in a way that protects visitors\u2019 PHI and helps you avoid HIPAA violations.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Ch2 dir=\u0022ltr\u0022\u003E\u003Cspan\u003EBuild \u0026amp; Maintain Your Healthcare Site With Inclind\u003C\/span\u003E\u003C\/h2\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003ERunning a website as a healthcare organization can be tricky. In addition to providing accurate information, you must also ensure that your patients\u2019 healthcare information is protected. While tools like Google Analytics are helpful for website administrators and marketing teams, they are not HIPAA compliant.\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EInclined has years of experience helping healthcare entities design and develop beautiful,\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022\/solutions\/accessibility-audits\u0022\u003E\u003Cspan\u003Eaccessible\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, and secure websites.\u0026nbsp; We understand that healthcare providers, insurance companies, and related organizations have different needs. Our website designers and developers will use their skills and know-how to ensure that every aspect of your website functions well - and complies with HIPAA. We can also help you make updates to your existing site to maintain compliance with our website support and maintenance services.\u0026nbsp;\u003C\/span\u003E\u003C\/p\u003E\n\u003Cp\u003E\u0026nbsp;\u003C\/p\u003E\n\u003Cp dir=\u0022ltr\u0022\u003E\u003Cspan\u003EIf you\u0027re interested in knowing more about our web design,\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022\/services\u0022\u003E\u003Cspan\u003Edevelopment\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E, and\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022\/support\u0022\u003E\u003Cspan\u003Esupport\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E services, we are always here to chat with you. You can fill out our\u0026nbsp;\u003C\/span\u003E\u003Ca href=\u0022\/services#link1\u0022\u003E\u003Cspan\u003Eonline contact form\u003C\/span\u003E\u003C\/a\u003E\u003Cspan\u003E or hit the live chat button to speak to one of our experts about your healthcare website.\u003C\/span\u003E\u003C\/p\u003E\n",
                "summary": ""
            },
            "articleType": "news",
            "author": "Katie Callahan",
            "authorTitle": null,
            "challenge": null,
            "introText": null,
            "location": null,
            "f_metatag": null,
            "publishDate": "2023-09-08",
            "result": null,
            "solution": null,
            "subheader1": null,
            "subheader2": null
        },
        "relationships": {
            "contentType": {
                "data": null,
                "links": {
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/contentType?resourceVersion=id%3A399"
                    }
                }
            },
            "category": {
                "data": {
                    "type": "catTerm",
                    "id": "e7befc73-77f0-46c9-aedf-608856a6a450",
                    "meta": {
                        "drupal_internal__target_id": 52
                    }
                },
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/category?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/category?resourceVersion=id%3A399"
                    }
                }
            },
            "companyRef": {
                "data": null,
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/companyRef?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/companyRef?resourceVersion=id%3A399"
                    }
                }
            },
            "image": {
                "data": {
                    "type": "images",
                    "id": "8bbfed92-208d-44aa-a4a4-6c05cd0dd979",
                    "meta": {
                        "drupal_internal__target_id": 517
                    }
                },
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/image?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/image?resourceVersion=id%3A399"
                    }
                }
            },
            "slides": {
                "data": [],
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/slides?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/slides?resourceVersion=id%3A399"
                    }
                }
            },
            "teamMember": {
                "data": [
                    {
                        "type": "node--person",
                        "id": "missing",
                        "meta": {
                            "links": {
                                "help": {
                                    "href": "https:\/\/www.drupal.org\/docs\/8\/modules\/json-api\/core-concepts#missing",
                                    "meta": {
                                        "about": "Usage and meaning of the \u0027missing\u0027 resource identifier."
                                    }
                                }
                            }
                        }
                    }
                ],
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/teamMember?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/teamMember?resourceVersion=id%3A399"
                    }
                }
            },
            "tags": {
                "data": [],
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/tags?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/tags?resourceVersion=id%3A399"
                    }
                }
            },
            "topic": {
                "data": [
                    {
                        "type": "topicTerm",
                        "id": "abe0f319-f759-4609-b6cb-c0cdd68a06b4",
                        "meta": {
                            "drupal_internal__target_id": 54
                        }
                    }
                ],
                "links": {
                    "related": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/topic?resourceVersion=id%3A399"
                    },
                    "self": {
                        "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b\/relationships\/topic?resourceVersion=id%3A399"
                    }
                }
            }
        }
    },
    "links": {
        "self": {
            "href": "https:\/\/backend.inclind.com\/jsonapi\/articles\/363b2b19-2095-475f-88ca-69feed46b83b?resourceVersion=id%3A399"
        }
    }
}