Google Ads for medical, dental & veterinary practices 2026

Healthcare PPC in 2026 needs a different playbook than e-commerce or B2B SaaS. The combination of Google's Healthcare and Medicines policy, regional regulations (HIPAA in USA, MHRA in UK, MOH in GCC, ANVISA in Brazil, DPDP in India), and the high-stakes nature of medical decisions means compliance constraints shape every layer of the account: tracking, targeting, ad copy, landing pages, and audience strategy. Get it wrong and you face account suspensions, regulatory fines, and reputational damage.

This guide is for medical, dental, and veterinary practices running Google Ads — single-location and multi-location. The playbook covers the four regions where SteerAds operates: North America (HIPAA scope), Europe (MHRA + GDPR), Middle East (MOH GCC + PDPL), Brazil (ANVISA + LGPD), India (DPDP). We'll cover specifically what's allowed, what's tracked-but-not-PHI, what converts, and what the realistic CPLs look like.

Updated 2026-05-08 with current Google Healthcare policy guidance and post-Consent-Mode-v2 tracking architecture.

Why healthcare PPC needs a different playbook

Three structural differences from non-healthcare:

1. PHI cannot be passed to ad platforms. In HIPAA scope (US), passing protected health information (name + diagnosis, name + procedure, etc.) to Google through tracking pixels is a HIPAA violation. Google does not sign BAAs (Business Associate Agreements) for ad services, so the obligation to redact lies entirely with the advertiser. Equivalent constraints exist in Europe (GDPR special-category data), GCC (PDPL/MOH), Brazil (LGPD), and India (DPDP).

2. Many keywords are restricted or prohibited. Google's Healthcare policy prohibits targeting users based on inferred medical conditions, restricts certain symptom keywords (especially mental health, sexual health, addiction), and prohibits unsubstantiated medical claims in ad copy. Each region adds its own rules.

3. Audience signals are constrained. Customer Match works (with hashed identifiers), but in-market segments related to healthcare are limited. Lookalike modeling on patient lists is restricted. Cross-device tracking can break PHI redaction if not carefully architected.

The combined effect: healthcare practices that try to run Google Ads using e-commerce playbooks routinely get suspended. The compliance-first playbook below is what works in 2026.

Compliance constraints by region

For the compliance-tracking architecture in detail, see our multi-region privacy guide.

Conversion tracking without PHI leakage

Standard 2026 healthcare conversion tracking architecture:

Layer 1 — Server-side GTM (sGTM) — Mandatory for HIPAA scope. All conversion events flow through your sGTM container before being forwarded to Google Ads. The container is configured to: (a) redact any URL parameters containing PHI, (b) strip diagnostic/treatment data from event payloads, (c) hash email/phone before forwarding.

Layer 2 — Enhanced Conversions for Leads — Hash email/phone using SHA-256 lowercase trimmed, send to Google Ads server-to-server. No name, no address, no clinical data. Improves attribution by 8-15% in HIPAA-compliant manner.

Layer 3 — Offline conversion uploads via gclid — When a lead becomes a confirmed appointment, upload the gclid + conversion value (no clinical data) to Google Ads. Standard practice for B2B-style lead nurturing.

Layer 4 — Phone call tracking — Use Google's call extension or a HIPAA-compliant call tracking provider (CallRail's HIPAA tier, Invoca's HIPAA-compliant offering). Avoid call recording features unless a BAA is in place.

For the tracking foundation, see our server-side tracking guide.

Account structure for medical practices

Single-location practice (general):

• Campaign 1: Branded (own practice name) — defensive
• Campaign 2: Service Line A (e.g. general dentistry) — Search
• Campaign 3: Service Line B (e.g. cosmetic dentistry) — Search, higher CPC
• Campaign 4: Emergency / after-hours (separate ad scheduling)
• Campaign 5: Local Services Ads (if eligible)

Multi-location practice:

• One campaign per location × service-line matrix, or
• One campaign per service line with location targeting and location feeds.
• Use MCC structure for separate billing/reporting per location.

Specialty practice:

• Tighter campaign segmentation by sub-specialty.
• Often higher CPCs ($25-$95 for orthopedic surgery, neurology, cosmetic).
• Branded protection becomes critical (competitors aggressively bid on specialty-practice brand names).

For multi-location complexity, see our franchise/multi-location guide.

Keyword & ad copy patterns that convert

Keyword patterns that work (compliant):

• "[service] near me" — primary intent driver
• "[service] [city]" — geographic intent
• "[service] cost / price" — high-intent, qualifying
• "best [specialty] in [city]" — branded comparison
• "[provider name]" — branded protection

Keyword patterns to avoid (policy/compliance risk):

• Diagnosis-based ("treatment for [condition]") — risk of policy flag
• Symptom-based ("[symptom] doctor") — narrow margin of compliance
• Drug-name based — restricted in most regions
• Sensitive conditions (mental health, addiction, fertility) — separate policy

Ad copy patterns that convert:

• License/credential visible (e.g. "Board-Certified Dentist", "DDS, MD")
• Local trust signals ("Serving [city] since [year]")
• Concrete service offer (free consultation, financing available, same-day appointments)
• No claims of cure or guaranteed outcome
• No patient testimonials in regions where prohibited (e.g. some US states for some specialties)

For RSA writing methodology, see our RSA writing method.

Landing page requirements (compliance + CRO)

Healthcare landing pages must be both compliant (no PHI capture in non-secure forms, no prohibited claims, accessibility) and conversion-optimized:

• HIPAA-compliant form hosting in US scope (most major form builders offer HIPAA tiers — Jotform HIPAA, Formstack HIPAA, custom builds via HIPAA-compliant hosts).
• Mobile-first, LCP under 2.5s, INP under 200ms.
• H1 matching ad headline — message match drives QS.
• Prominent phone number (click-to-call on mobile) — many medical conversions are still calls, not form fills.
• Visible licensure/credentials — trust signal and compliance requirement in many regions.
• Office hours and emergency contact — practical patient intent.
• Insurance accepted (US) — qualifies the lead.
• No diagnostic data capture in any form not under BAA.
• Cookie banner — required by GDPR/PDPL/LGPD/DPDP; integrated with Consent Mode v2 in EU scope.
• Accessibility (WCAG 2.1 AA) — increasingly enforced; reduces complaints/lawsuits.

For landing page methodology, see our landing pages guide.

Budget tiers and CPL benchmarks

GCC budgets: roughly USD-equivalent × 3.7 (in AED). India budgets: USD × 80 (in INR). Brazil: USD × 5 (in BRL).

Vertical-specific notes (dental, vet, primary care, specialty)

Dental. Highest CPC range and broadest service spectrum. Cosmetic dentistry (implants, veneers) commands 2-3× general CPC. Local Services Ads work very well in eligible US markets.

Veterinary. Lower CPCs ($2-$5 USA general); not in HIPAA scope (animals don't have PHI). Customer Match audiences highly effective. Emergency vet specialty has strong conversion economics.

Primary care / family medicine. High volume, lower CPC, often insurance-driven. Local Services Ads + standard Search dominate. Telehealth-specific keywords are a 2024+ growth area.

Specialty (orthopedic, dermatology, cardiology, etc.). High CPCs ($15-$95+ depending on specialty), longer consideration cycles, larger LTVs justify the spend. Compliance review burden is highest in mental health and addiction specialties.

Common compliance mistakes (and fines)

Mistake 1 — Sending PHI to Google in URL parameters. Booking confirmation pages with diagnostic codes in the URL are common HIPAA violations. Fines can reach $50,000 per violation under HIPAA, with annual caps of $1.5M+.

Mistake 2 — Using non-HIPAA-compliant form builders. Default Mailchimp, ActiveCampaign, etc. are not HIPAA-compliant on standard tiers. Use HIPAA-tier offerings or HIPAA-compliant builds.

Mistake 3 — Patient testimonials in restricted states/specialties. Some US states (e.g. Texas) restrict testimonial advertising for certain medical specialties. ASA in UK applies similar limits.

Mistake 4 — Performance Max for healthcare. Lack of placement transparency creates compliance risk; ads can land on inappropriate sites. Stick to Standard Search + Local Services Ads.

Mistake 5 — Recording calls without BAA. HIPAA-compliant call tracking requires a BAA with the provider. Default call recording in Google's call extensions is not BAA-covered.

For complementary reading, see our CPC by industry & region matrix, our conversion tracking guide, and our multi-region privacy guide. To audit your healthcare account against compliance and performance benchmarks, run our free audit.

Sources

Official sources consulted for this guide:

• support.google.com
• support.google.com
• blog.google
• support.google.com

FAQ