Google Ads for Doctors: HIPAA-Safe Setup and What a New Patient Should Cost
Most doctors who try Google Ads run into the same wall. The agency that set up the account either ignored HIPAA entirely and quietly piped patient data into Google, or got so scared of the rules that the tracking was turned off and nobody could tell which ads produced patients. Both outcomes are common, and both cost you money.
This article explains what actually works for medical practices on Google Ads. It covers the health-specific policy limits Google enforces, why you must keep protected health information out of ad platforms, how to configure conversion tracking safely, what a click and a new patient realistically cost by specialty, and which keywords and settings separate a profitable account from a leaking one.
Google restricts healthcare advertising in ways other industries never see
Google treats health as a sensitive category, and the rules are stricter than they are for a plumber or a law firm. Two limits matter most.
First, remarketing based on sensitive health conditions is prohibited. You cannot build an audience of people who viewed your page about depression, fertility, addiction, or any specific diagnosis and then follow them around the web. Google classifies this under personalized health advertising, and the policy blocks audiences defined by a health status. You can still remarket to general visitors of your homepage or a scheduling page, as long as the audience is not built around a condition.
Second, personalized advertising for health is limited. You cannot target ads using inferred health status, and certain sensitive treatments face additional certification or geographic restrictions. The practical effect is that your strategy has to lean on keyword intent, not on profiling the person. That is fine. Keyword intent is where the good patients are anyway.
You must never send patient data into Google
This is the part agencies get wrong most often. Google is not a HIPAA business associate. It will not sign a BAA. That means any protected health information that reaches Google puts you out of compliance, and the burden is on you, not on Google.
Protected health information leaks into ad platforms in ways that look harmless. A URL that contains a condition or a patient identifier. A form confirmation page that passes the reason for the visit as a query parameter. A conversion event that includes the appointment type or a diagnosis. Google's own tracking pixel firing on a patient portal page. Each of these can send PHI into an environment that was never built to hold it.
The fix is to keep PHI out of everything Google can read. No health data in URLs. No condition names in page paths that the pixel captures. No appointment reason passed to the conversion. Treat the ad platform as a system that should only ever know that a conversion happened, never who converted or why.
Configure conversion tracking so it is safe by design
You still need to measure results. A blind account wastes budget on ads that never produce patients. The answer is to track conversions in a way that carries no health information.
Use server-side conversion tracking rather than a browser pixel that fires on sensitive pages. Send only the fact of a booking and a hashed identifier, never a name, condition, or appointment type in readable form. Keep the conversion trigger on a generic confirmation page whose URL contains no health data. This is the same architecture we build in our work on Google Ads for medical practices, and it is what lets a practice see cost per new patient without ever exposing a patient.
The rule of thumb is simple. If a value would identify a person or reveal why they are seeing a doctor, it does not belong in a conversion payload. Hash what you must send. Drop everything else.
What a click and a new patient actually cost
Medical keywords are among the most expensive in Google Ads because the lifetime value of a patient is high and competition is heavy. The numbers below are typical ranges for United States practices. Your market and your close rate move them.
| Specialty | Typical cost per click | Typical cost per new patient | Notes |
|---|---|---|---|
| Primary care | $4 to $9 | $80 to $180 | High volume, lower intent, strong lifetime value |
| General dentistry | $6 to $14 | $90 to $250 | Cleanings cheap, implants far higher |
| Dermatology | $7 to $16 | $120 to $300 | Cosmetic terms cost more than medical |
| Orthopedics | $9 to $22 | $200 to $500 | Joint procedures at the top of the range |
| Bariatric surgery | $12 to $30 | $250 to $600 | Long sales cycle, few competitors per market |
| Fertility | $10 to $28 | $200 to $550 | Sensitive category, tight policy limits |
| Med spa | $5 to $13 | $70 to $200 | High intent, price shoppers common |
| Physical therapy | $4 to $10 | $80 to $190 | Local and repeatable, referral driven |
| Cardiology | $8 to $18 | $180 to $400 | Often insurance led, longer decision |
| Plastic surgery | $11 to $26 | $220 to $550 | Consultation is the real conversion |
Read these as a starting point for a budget, not a promise. A practice with a fast front desk and an online booking page will beat the low end. A practice that misses calls will pay the high end and still lose the patient.
Bid on intent, not on wellness
The single biggest lever in a medical account is keyword selection. High-intent keywords describe a patient who is ready to book. Broad wellness terms describe someone reading an article.
Bid on procedure and condition terms tied to action and place. A procedure name plus your city. A condition plus the word treatment or specialist. The phrase "near me" attached to a service. These convert because the person is looking for a provider, not for information.
Avoid broad wellness and symptom-only terms. Someone searching for what a symptom means is usually researching, not booking, and you will pay for clicks that never call. If you want the patients behind those searches, earn them with content, which we cover in how to get more patients, rather than paying top dollar for a low-intent click.
Then build a negative keyword list, and treat it as ongoing work. Block jobs, careers, and salary. Block student, school, and degree. Block free, cheap, and clinic when they pull the wrong crowd. Block symptom-only research phrases that never lead to a booking. A tight negative list can cut wasted spend by a fifth or more in the first month.
Targeting and landing pages decide whether the budget works
Two settings and one page carry most of the outcome.
Geo targeting should match how far a patient will realistically drive. For a routine visit that is often a ten to twenty mile radius, not a whole state. Set the target to people in your area, not people interested in your area, so you are not paying for clicks from across the country. For a rare procedure with a wide draw, widen the radius on purpose.
Schedule targeting should match when your office can answer. If nobody picks up after 6 p.m., pulling back ad delivery in those hours often raises your booked rate, because a click that turns into a missed call is money spent for nothing.
The landing page is where budget converts or dies. Send paid traffic to a focused page for the service in the ad, not to your homepage. Put online booking above the fold so a ready patient can schedule in one step. Match the page to the ad so the searcher sees the exact service they clicked. A practice that adds real-time booking to its paid landing pages usually lifts conversion by a wide margin over a page that only shows a phone number. Our full approach to paid acquisition for clinics lives on our healthcare marketing page.
Find out where your medical ad budget is leaking
If you are already spending on Google Ads and cannot say what a new patient costs you, the account is almost certainly leaking through untracked conversions, broad keywords, or a landing page with no booking. We map exactly where the money goes and where the policy risk sits. See how we run compliant paid acquisition on our healthcare marketing page, then contact us for a review of your account.
FAQ
Is Google Ads HIPAA compliant for medical practices?
Google Ads is not a HIPAA business associate and will not sign a BAA, so you cannot send protected health information into it. You can still run compliant campaigns by keeping all PHI out of URLs, form fields, and conversion payloads. The compliance work happens on your side through server-side tracking and hashed data, not on Google's side.
How much does Google Ads cost for doctors?
Cost per click for medical keywords typically runs $4 to $30 depending on specialty and location, and cost per new patient usually lands between $80 and $600. High-value procedures like joint replacement or bariatric surgery sit at the top of that range. Primary care and dental cleanings sit near the bottom.
What keywords should a medical practice bid on?
Bid on high-intent terms that signal a patient ready to book, such as a procedure name plus your city or a condition plus the word treatment. Avoid broad wellness and symptom-research terms, which attract people who are reading rather than booking. Add negative keywords for jobs, schools, and free clinics to stop wasted spend.
Can I use remarketing for healthcare ads on Google?
Google prohibits remarketing based on sensitive health conditions and restricts personalized advertising built on health status. You cannot build audiences around users who visited a page about a specific diagnosis or treatment. You can still remarket to general site visitors as long as the audience is not defined by a health condition.