Most of the advice about healthcare retargeting ads assumes you can do what a retailer does: tag every visitor, then follow them around the web. Google's own policy says otherwise. Advertisers promoting health products or services can't use advertiser-curated audiences, which rules out the visitor lists and patient uploads that retargeting normally runs on.
That doesn't make it impossible to bring back someone who looked at your cardiology page and never booked. It means the work moves from audience lists to context, consent and careful page selection.
Healthcare retargeting ads and what Google actually allows
Google treats Health as a sensitive interest category, and in its personalized advertising policy it lists Customer Match, your own data segments, lookalike segments and audience expansion as unsupported for these ads. The reasoning given is that advertiser-curated audiences may inadvertently contain sensitive user signals.
Two routes stay open. Predefined Google audiences still work, because sensitive signals are excluded from them. Custom segments are allowed under limits: if the creative or landing page is sensitive, the ads serve only in Display campaigns, to non-sensitive audiences or contextually.
Discovery and Demand Gen campaigns deserve a warning of their own. They use advertiser-curated audiences by default, so a health campaign built there can be restricted without you having changed a setting.
If a campaign is flagged, the policy's fixes are to remove the advertiser-curated audiences, change the ad or site content, or appeal. We cover the certification side in more depth in our guide to Google Ads for healthcare.
Why a pixel on a health page is a HIPAA question
Retargeting works by logging what someone looked at. On a clinic website, what someone looked at can be a health condition.
Paubox, which sells HIPAA-compliant email, gives a plain example in its 2021 article on retargeting and HIPAA: one person searches a condition, and a second person on the same shared browser then sees an ad about it. Paubox's conclusion is that retargeting is not HIPAA compliant, and it notes that Google limits retargeting for covered entities. Treat that as a vendor's strong position rather than settled law, as the next section shows.
Its practical advice is still sound. Before an ad platform or agency touches your data, ask whether it will sign a business associate agreement, how it uses and shares data, and whether it runs retargeting at all.
The broader picture of what marketing is and isn't permitted is in our piece on HIPAA-compliant marketing.
What the 2024 court ruling changed, and what it left alone
On June 20, 2024, a Texas federal court in American Hospital Association v. Becerra vacated one part of HHS's tracking technologies bulletin. According to Holland & Knight's analysis of the decision, the vacated part covered technology that links a person's IP address to a visit to an unauthenticated public webpage about specific health conditions or providers.
That is good news for a clinic running ads off public service pages. It is a narrow win, though.
Only that one portion of the bulletin was struck down. The authors say HIPAA's rules themselves haven't changed, that consent or authorization may still be needed even on unauthenticated sites, and that organizations should keep watching tracking on patient portals, which require a login. They also say the ruling doesn't immediately end the class actions over cookies and pixels, only that it should make them less attractive to plaintiffs.
Our reading: the ruling lowers the risk on public pages and does nothing to make a pixel on a portal or booking-confirmation page safer. Keep tracking off both.
What to run instead of a list of past visitors
Since the lists are off the table, the options come down to a short set of approaches that each work around a different restriction.
- Predefined audiences and contextual placement on Google, which stay available for health ads.
- Ads shown against content a patient is reading about the condition, rather than against a profile of what they did on your site.
- Email to people who gave you their address and agreed to hear from you, which sidesteps third-party tracking entirely.
- Organic follow-up from your own site, such as a clear booking path and a reminder sequence for people who started a form.
Email deserves more weight than it usually gets here. Paubox notes that marketing generally requires patient authorization in most cases, so the consent you collect at the start is what makes the follow-up usable later.
Paid search still carries the intent that retargeting was meant to recover. Someone searching for a named procedure near them is already doing the job a retargeting list would have done, and healthcare PPC management is where that spend usually pays back first.
Social platforms have their own rules for health audiences, which we go through in targeting patients ethically on Facebook.
A cautious way to set up a campaign
Photo by Lara Jameson on Pexels
Work in this order, because each step removes a risk the next one would otherwise inherit.
- Decide which pages are public and general, such as a service overview, and which reveal a specific condition or a patient's progress. Only the first group is a candidate for any ad tracking.
- Keep tracking off logged-in pages and off confirmation pages, where the visit itself says a person is a patient.
- Ask every vendor in the chain whether it will sign a business associate agreement before it receives any data.
- Build the audience from Google's predefined options or from context, not from an uploaded list.
- Check your privacy notice against what the site really does. Holland & Knight's question for providers is whether you do what you say you do.
- Have counsel review the setup. Both of the legal sources here say that their material is general information and not legal advice.
Each of these steps is also a place where a small mistake can undo the rest, which is why we usually fold retargeting into the wider plan described in our healthcare digital growth stack instead of running it on its own.
Where this fits in your marketing
Retargeting was always the last, cheapest layer of a funnel, and for healthcare it's the layer with the most constraints. Put your budget first into the pages and searches that bring patients in, then add whichever follow-up your consent practices and legal review can support.
If you'd like help building that plan, our digital marketing and growth service covers the campaigns, the site and the follow-up together. Start by listing which of your pages would be safe to advertise from, because that list decides everything else.
Frequently asked questions
Can I upload my patient list to Google Ads?
Not for health advertising. Google's policy marks Customer Match and your own data segments as unsupported for ads promoting health products or services.
Did the 2024 court ruling make retargeting safe for clinics?
Only partly. It vacated the part of HHS's bulletin about IP addresses and public, unauthenticated health pages. HIPAA's rules haven't changed, and consent may still be needed even on public sites.
Is email a safer way to follow up with patients?
It avoids third-party ad tracking, but Paubox points out that marketing generally needs patient authorization in most cases. Collect consent up front, and use a sender that will sign a business associate agreement.
Do Discovery and Demand Gen campaigns work for health ads?
They carry extra risk. Google says these campaigns use advertiser-curated audiences by default and may be restricted for health advertisers.
Cover photo by Towfiqu barbhuiya on Pexels
Sources
- Personalized advertising — Google Ads Policy Help
- American Hospital Assn. v. Becerra: Are Tracking Tools OK Again? Court Dials Back OCR Bulletin — Holland & Knight
