In short
- Track the source of every inquiry: forms, calls, chats and texts, with landing page and campaign.
- Keep the source data in the CRM, where patient records are protected. Keep patient details out of ad and analytics tools.
- Send conversions back to ad platforms as a click ID, a stage and a time. Leave out names, conditions and notes.
- Check with your compliance team before any data leaves the CRM.
Why tracking is different in healthcare
A healthcare inquiry is not a normal sales lead. A form or a call can include a condition, an insurance plan or a medication. That information is about a patient, and it needs more care than a product interest on a retail lead.
Ad platforms and analytics tools collect what you send them, and some tags collect more on their own. So the job is to give them what they need to measure campaigns, and nothing about the person.
This guide is about how we set up tracking. It is not legal advice. Your compliance team or counsel decides what your organization may share.
1. What to track
Track where each inquiry came from and how far it went. That is enough to judge every campaign.
- Source: paid search, organic search, social, referral partner, direct.
- Campaign details: UTM parameters, campaign and click IDs such as the GCLID.
- Landing page and referring domain from the first visit.
- Channel: form, call, chat or text.
- Stages after the inquiry: qualified, assessment, admitted, for example.
2. Keep the full picture in the CRM, not in the ad tools
The CRM is where the source and the person meet. It is the one place that should hold both, with access limited to the team that needs it.
- Source and campaign fields on the lead, carried to the opportunity.
- Call and chat records linked to the lead, inside the CRM.
- Admit and discharge data back from the EMR, so you can report source to admission.
- For healthcare work in Salesforce or Zoho CRM, we sign a BAA, store credentials encrypted, and give each system only the access it needs.
3. Keep patient information out of ad and analytics tools
Analytics and ad tools should get events, not people. Simple checks go a long way.
- Send a form submission or a completed chat to GA4 as an event, with no names, contact details or form answers.
- Do not put patient details in page URLs, page titles or event names. Tags can pick them up.
- Keep thank-you page URLs plain, with no form values in the query string.
- Review what your tag manager, pixels and chat widgets collect, and switch off anything that reads form fields.
- Show a cookie notice and keep your privacy policy and SMS consent wording up to date.
Talk through your project
A free call about your integration, your CRM or whatever you are stuck on. Honest advice, even if you never hire us. No obligation.
4. Send conversions back without patient details
Ad platforms bid better when they learn which clicks became real inquiries. You can tell them that without saying anything about the patient.
Match on the click ID
Send the GCLID stored on the lead, so Google credits the click. No name, phone or email is needed to match it.
Send a stage, not a story
A conversion name such as "Qualified", "Insured lead" or "Assessment", a time, and a value if you use one. No diagnosis, insurance plan details or notes.
Choose the stages on purpose
Agree which stages count as conversions before anything is sent, and write the process down.
Watch for failures
Have the upload send an alert email when it fails, so a gap does not go unnoticed.
Some ad platforms also offer matching on hashed email or phone. In healthcare, ask your compliance team before you turn that on.
5. Calls need the same care
In healthcare, the first contact can be a phone call. Call tracking shows the source of each call and logs it in the CRM.
- Log the call, source and campaign on the lead in the CRM.
- Send the call to GA4 or Google Ads as a conversion event, without the caller's details.
- Keep recordings and transcripts in the call tracking system or the CRM, not in ad or analytics tools.
6. Report from the CRM
With the source on every record and outcomes back from the EMR, the CRM can report what matters, in one place.
- Inquiries, qualified leads and admissions by source and campaign.
- Results by landing page and by referral partner.
- Leads with a missing source, flagged so they can be fixed.
If you want to see where data goes today, map your website, phone system, CRM and EMR with our free tech stack diagram builder. Or book a free call and we will walk through it with you.
Respect privacy laws and cookie consent
Tracking only holds up if it respects the people you track. Privacy laws and browser rules keep tightening, and a cookie banner that does nothing is not enough.
- Ask before you track: analytics and ad cookies wait until the visitor accepts, with an easy way to say no.
- Use Google Consent Mode, so Google tags follow the visitor’s choice.
- Honor Global Privacy Control: a browser that sends it is treated as a no.
- Let visitors change their mind later, from a cookie settings link in the footer.
- Keep your privacy policy and SMS consent wording in step with what you collect and send.
This is how we set up tracking on our own sites and for clients. It is general guidance, not legal advice: check the rules that apply to your business with your legal team.
Want help with this?
Book a free call about your CRM, integrations or reporting, or map your systems first with our free tech stack diagram builder.