Real-time analytics
Live visitor stream, sources, and pages, sanitized of PHI as it streams.
HIPAA-compliant analytics, with nothing to configure.
Get the visitor insights, funnels, and conversion data you rely on, engineered so protected health information never reaches the analytics pipeline. A signed BAA is included on every plan.
Signed BAAPHI stripped at the edge100% US-hosted
PHI never touches the pixel.
Our tracker filters and hashes IP addresses, URLs, query strings, and form fields at the edge, before a single byte is stored. What lands in your reports is already sanitized. And each practice runs on its own dedicated instance, at its own URL.
Automatic PII/PHI redaction, no rules to maintain
AES-256 at rest, TLS 1.2+ in transit
Activity logs your compliance team can export
Patient's browser
Visits your site, fills out forms
Edge filter
IPs, URLs, and form fields stripped
IP addressURL paramsForm input
Encrypted storage
AES-256, 100% US-hosted
Your dashboard
Clean, compliant analytics
Everything you measured before.
Real-time visitors, audience segments, funnels, goals, cohorts, heatmaps, and A/B tests: a complete analytics suite, not a stripped-down "privacy" tool.
Live visitor stream & conversion funnels
Heatmaps and A/B testing built in
Reporting API & warehouse export
One tracker. The whole toolkit.
Every capability below ships compliant out of the box.
Funnels & goals
Map landing-to-booked-visit journeys and find the drop-off.
Heatmaps & A/B
See clicks and scrolls, then test changes without recording inputs.
Cohorts & audiences
Segment by device, geography, and source. Aggregated, never identifying.
Reporting API
Export clean, compliant data to your warehouse or BI tool.
Consent management
Built-in consent tooling and granular access controls for auditors.
Common questions
Do you sign a BAA?
Yes. We sign a Business Associate Agreement with every organization we work with, included on every plan. Our standard agreement is ready to sign; minor redlines are available on Premium and custom terms on Enterprise.
Will it slow down my site?
No. The tracker loads asynchronously, so it never blocks rendering or hurts Core Web Vitals.
Can I migrate from Google Analytics?
Yes. Most teams swap one snippet (or use our Google Tag Manager template) and keep their existing event names. Our team can assist with mapping.
Ghost Metrics follows HHS guidance
Federal guidance lays out a compliant path for website tracking: route it through a vendor that signs a BAA, strips the PHI, and shares only de-identified data downstream. That vendor is Ghost Metrics.
“…the regulated entity can choose to establish a BAA with another vendor, for example a Customer Data Platform vendor, that will enter into a BAA with the regulated entity to de-identify online tracking information that includes PHI and then subsequently disclose only de-identified information to tracking technology vendors that are unwilling to enter into a BAA.”
U.S. Department of Health & Human ServicesOffice for Civil Rights · HIPAA online tracking guidance
Quoted from public HHS guidance. Ghost Metrics is not affiliated with or endorsed by HHS.
See compliant analytics in action.
Install in two minutes, sign your BAA instantly, and start seeing real data today.