Google Analytics 4 is free, familiar, and used by almost everyone. It is also, for healthcare organizations, a compliance liability that gets harder to justify the closer you look at it. Google will not sign a Business Associate Agreement for GA4. That single fact has been true for over a decade and shows no sign of changing. If your organization is a HIPAA-covered entity and your website touches anything patient-related, you have a problem that no amount of configuration can solve.
But compliance is only part of the story. Many healthcare marketing teams stick with GA4 not because they've evaluated it against alternatives, but because switching analytics platforms feels expensive and disruptive. The goal of this piece is to lay out what's actually available, what each platform does well, where each one falls short, and how to think about making a move.
Why healthcare organizations outgrow GA4
The BAA issue gets the most attention, and for good reason. HHS OCR's December 2022 bulletin on tracking technologies made it explicit: when a covered entity's website uses trackers that transmit PHI to third parties, HIPAA rules apply. Multiple health systems have faced enforcement actions and class action lawsuits since then, and OCR's interpretation has only gotten stricter.
GA4's measurement model was designed for marketing attribution. Enhanced Measurement runs by default, capturing site search terms. Pageviews pull full URL paths. Cookies create persistent recognition across sessions. On a retail site, none of this matters. On a healthcare site, a URL like /appointments/depression-screening combined with a device identifier starts to look like PHI.
The workarounds exist. You can restrict GA4 to unauthenticated, general-content pages. You can strip URL parameters and disable Enhanced Measurement features one by one. Some organizations segment their sites and run GA4 only on blog content and general service pages. These approaches reduce risk. They also reduce the data you collect to a point where you're paying (in implementation complexity, if not dollars) for analytics that don't tell you much about the patient journey.
There are also non-compliance reasons to move on. GA4's data sampling at higher traffic volumes frustrates teams that need precise numbers for board reporting. The interface changes frequently. Attribution modeling in GA4 is opaque, and cross-domain tracking across hospital network subdomains is fragile. If you're running campaigns across service lines and trying to tie digital touchpoints to patient acquisition, GA4's model was not built for that use case.
Understanding the different platform categories
Before listing specific tools, it helps to understand that "analytics platform" covers several different types of software, and healthcare organizations often need more than one.
Web analytics platforms track pageviews, sessions, traffic sources, and user flows on your website. GA4 is a web analytics tool. Piwik PRO, Matomo, and LightTrail are also web analytics tools. They answer questions like: which service line pages get the most traffic, where do users drop off, and which campaigns drive appointment requests.
Product analytics platforms track how users interact with a specific application. Mixpanel, Amplitude, PostHog, and Heap fall into this category. They answer different questions: which features get used, where do users get stuck in an onboarding flow, and how does behavior differ between cohorts. If you operate a patient portal or a telehealth application, product analytics might matter to you. If you're mostly tracking a marketing website, these tools add complexity you probably don't need.
Customer data platforms (CDPs) collect and unify user data from multiple sources and route it to downstream tools. Freshpaint is the most prominent healthcare-specific CDP. It sits between your website and your marketing stack, filtering out PHI before data reaches tools like Google Analytics or ad platforms. A CDP is middleware. It is not an analytics platform by itself, though vendors sometimes blur that line.
Business intelligence (BI) tools like Tableau, Power BI, and Preset query structured data in a warehouse and generate dashboards. They are reporting layers, not data collection tools. A BI tool won't help you capture web analytics data, but it will help you visualize data that's already stored somewhere compliant.
Most healthcare marketing teams primarily need a web analytics platform. Some need a CDP in front of it. Fewer need product analytics. Keep that hierarchy in mind as you evaluate options.
The platforms, honestly assessed
Piwik PRO
Piwik PRO is the closest thing to a drop-in GA4 replacement for healthcare. It signs a BAA. It offers HIPAA-compliant hosting on US-based Azure infrastructure. The interface will feel familiar if your team has used GA4 or Universal Analytics, which lowers the learning curve considerably. The platform includes a built-in consent manager and tag manager, so you're getting several tools in one purchase.
Where it gets complicated is pricing. Piwik PRO discontinued its free Core plan in February 2026. Paid plans now start at around €35/month for the Business tier, but the Enterprise plan (which is what most healthcare organizations will need for the BAA and HIPAA hosting) starts at roughly €4,400/year and scales from there depending on data volume. For midsize health systems, expect to spend in the low-to-mid five figures annually.
The tradeoff compared to GA4 is that you lose native Google Ads integration and the depth of Google's attribution ecosystem. If you run heavy paid search campaigns, you'll need to build that connection differently or accept some loss of integration. Piwik PRO's reporting is solid but not as deep as what power users can extract from GA4's BigQuery export.
Piwik PRO makes the most sense for healthcare organizations that want a managed, compliance-ready web analytics platform without heavy IT involvement.
Matomo
Matomo and Piwik PRO share a common ancestor (they both evolved from the open-source Piwik project) but are now completely separate products with different business models. Matomo remains open source and offers a free, self-hosted (On-Premise) option alongside paid cloud plans.
Here's the catch for healthcare. Matomo Cloud does not sign a BAA. If you want HIPAA compliance from Matomo, you need to self-host it on your own infrastructure, which means your IT team owns the security, encryption, patching, database tuning, and audit logging. That's workable if you have the DevOps capacity. It's a burden if you don't.
Self-hosted Matomo is genuinely free at the software layer, but the real cost is operational. Someone on your team needs to maintain it, and that maintenance is ongoing. Healthcare organizations with lean IT departments should think carefully about whether "free" actually saves money once you account for staff time and the compliance documentation you'll need to produce for your own audits.
Matomo's analytics capabilities are comparable to GA4 for standard web analytics use cases. It handles traffic reporting, goal tracking, custom dimensions, and heatmaps (via plugin). The plugin ecosystem is a strength and a weakness: you get flexibility, but premium plugins cost extra and some require their own evaluation for compliance implications.
If your organization has strong DevOps capacity and wants full data ownership, Matomo On-Premise deserves serious consideration.
LightTrail
LightTrail is a web analytics platform built from the ground up for healthcare marketing teams. It's first-party and cookieless, which means it addresses the compliance question at the collection layer rather than filtering data after it's already been captured. The platform signs a BAA and runs on Azure infrastructure.
The feature set is worth looking at in detail because it consolidates tools that healthcare organizations typically buy separately. Campaign attribution, heatmaps, and tag management are included, but so are full session replay with configurable privacy settings and a built-in accessibility scanner. That last one matters more than it might seem at first glance. With the Section 504 digital accessibility deadline now in effect, most health systems are either paying for a separate accessibility monitoring tool or scrambling to find one. Having it bundled inside the analytics platform means your marketing team can identify accessibility issues in the same workflow where they're already reviewing user behavior.
Session replay in healthcare is tricky because you need granular control over what gets recorded and what gets masked. LightTrail's replay is built with that constraint in mind, with privacy settings designed for environments where patient data could appear on screen. Compare that to bolting Hotjar or FullStory onto a healthcare site, where neither signs a BAA and neither was designed with HIPAA in mind.
Where LightTrail differentiates from Piwik PRO and Matomo is in its healthcare-specific focus. The attribution model is designed around the way health system marketing actually works: multi-touch campaigns across service lines, long consideration windows, and conversion events that look like appointment requests rather than cart checkouts. A server-side conversion forwarding feature called Signals lets marketing teams pass conversion data to ad platforms without exposing visitor-level data, which addresses a gap that most analytics platforms leave to a separate CDP.
LightTrail is not trying to be a product analytics platform or a cross-channel enterprise suite. It's focused specifically on the web analytics and campaign measurement problem for healthcare. If you need PostHog-style feature flag testing or Adobe CJA's offline touchpoint stitching, that's a different tool for a different job.
For healthcare marketing teams evaluating the total cost of their analytics stack (analytics + session replay + heatmaps + accessibility monitoring + tag management), LightTrail is worth comparing against what you're currently paying for those tools individually.
Freshpaint
Freshpaint takes a different approach entirely. Rather than replacing GA4, it sits between your website and your existing marketing tools, filtering out PHI before data reaches downstream destinations. You install Freshpaint's tracking code. It decides what's safe to pass along to tools like Google Analytics, ad platforms, and CRMs, and what needs to be stripped.
This is appealing because it lets you keep using familiar tools without ripping and replacing your entire stack. Freshpaint signs a BAA and uses pattern recognition to identify and strip identifiers like email formats, phone numbers, and medical record numbers before anything leaves its infrastructure.
The limitation is structural. Your analytics still run on sanitized, incomplete data. Freshpaint removes the PHI, which means whatever reaches GA4 is inherently less granular than what a HIPAA-compliant native platform would capture. For some organizations, that tradeoff is fine. For teams that need full-funnel visibility into how patients move from awareness to appointment, the data gaps start to bite.
Pricing requires a custom quote for the Compliance plan. Expect enterprise-level numbers. Cloud-only.
Freshpaint fits organizations that are heavily invested in the Google ecosystem and want to reduce compliance risk without rebuilding their entire analytics stack.
PostHog
PostHog is open source and ambitious. It bundles product analytics, session replay, feature flags, A/B testing, and web analytics under a single BAA. Self-hosting is available for organizations that want to keep data entirely on their own infrastructure, and the cloud version also operates under a BAA.
PostHog's roots are in product analytics, not web analytics. That shows. If your team thinks in terms of events, funnels, and user properties, the interface will feel natural. If your team thinks in sessions, pageviews, and traffic sources, there's a learning curve that takes a few weeks to flatten out.
The web analytics module is newer than the product analytics side. It works, but it's not as polished as Piwik PRO or Matomo for traditional marketing reporting. If your primary question is "which campaigns drive appointment volume and how do visitors move through our service line pages," PostHog is more of a tool than you need. If you also manage a patient portal or a digital health app and want one platform for everything, the calculus changes.
The free tier (1 million events per month for product analytics) makes it easy to try before committing.
The sweet spot for PostHog is digital health companies and health systems with patient-facing applications that want unified product and web analytics under one roof.
Adobe Customer Journey Analytics
Adobe CJA is the enterprise option. It signs a BAA (note: standard Adobe Analytics does not, only the Customer Journey Analytics product). It offers cross-channel attribution, advanced segmentation, and integration with the broader Adobe Experience Platform.
Here's the thing: this is expensive and complex. Adobe CJA is priced for large organizations with dedicated analytics teams and existing Adobe contracts. Implementation is not trivial. If you're a 3-hospital system with a two-person digital marketing team, Adobe CJA is almost certainly overkill. If you're a 15-hospital integrated delivery network with a 10-person analytics team and an existing Adobe stack, it deserves evaluation.
Adobe's strength is the depth of its attribution modeling and its ability to stitch together data from web, app, call center, and offline touchpoints into a single patient journey view. That capability is real, but it requires investment in data architecture and ongoing maintenance to deliver value.
Large health systems with existing Adobe infrastructure and dedicated analytics staffing are the intended audience. Everyone else can probably skip this one.
Mixpanel and Amplitude
Both Mixpanel and Amplitude sign BAAs and offer HIPAA-compliant configurations. Both are product analytics platforms. They track events, build funnels, analyze cohorts, and measure retention.
For healthcare marketing teams focused on web analytics, these are generally not the right fit. They don't natively track traditional web metrics the way GA4, Piwik PRO, or Matomo do. Where they become relevant is if you're running a digital health product, a patient engagement platform, or a mobile app and you need to understand how users interact with specific features.
Amplitude recently added a web analytics layer, but it's still oriented around its event-based product analytics model. Mixpanel remains more purely focused on product analytics.
Pricing for both scales with event volume and can climb quickly at healthcare-organization data volumes. Both offer free tiers that are useful for smaller deployments.
These platforms make sense for digital health product teams that need deep behavioral analytics on applications. If you're primarily tracking a marketing website, look elsewhere.
How to evaluate what's right for your organization
Feature matrices are tempting but misleading. Before you start comparing checkboxes, figure out what you're actually solving for.
Start with your pages. If your analytics only need to cover a public blog and general service line pages (no scheduling, no provider search, no authenticated anything), the compliance requirements are lower and GA4 with careful scoping might still work. The moment you need visibility into appointment scheduling flows, condition-specific content, or anything near an authenticated experience, you need a platform that signs a BAA. That's the dividing line.
Then look at your team. Honestly. Most analytics platforms have more features than any marketing team actually uses. A 10-person digital team at a community hospital doesn't need what a 30-person experience team at a large IDN needs. The best platform is the one people log into on a Tuesday morning. If nobody opens it, the features don't matter.
IT capacity is the third question, and it's the one most teams underestimate. Self-hosted Matomo or PostHog give you maximum control, but they require people who will maintain, patch, and tune the deployment indefinitely. Managed platforms like Piwik PRO or LightTrail handle that for you. Freshpaint reduces the scope of change but doesn't eliminate the underlying platform dependency. Be realistic about who owns the technical side after the project is "done."
Once you've answered those questions, the comparison gets more practical: reporting depth, attribution modeling, session replay capabilities, integration with your CRM or EHR marketing tools, and pricing at your expected data volume.
What the transition actually looks like
Switching is not painless. But it's also not the year-long nightmare most teams imagine.
Plan for 30 to 90 days of parallel tracking. Run your new platform alongside GA4 so you can validate that the numbers align and your team has time to learn the new interface. Don't try to match every metric on day one. Focus on the five or six reports your team checks weekly and get those right first. The rest can follow.
You will lose historical data. GA4's data stays in GA4 (or BigQuery, if you've set up an export). Your new platform starts from scratch. This is uncomfortable but rarely matters in practice. Within a quarter, you'll have enough data to establish baselines. Within two quarters, nobody will miss the old tool.
Tag management is where the real work lives. If you're using Google Tag Manager today, you'll need to either migrate to the new platform's tag manager or reconfigure GTM to fire your new tracking code instead of (or alongside) GA4 tags. Some platforms offer migration tooling. Ask about this during evaluation, because it's where timelines actually expand.
Budget for training. Your team has muscle memory around GA4. Even a better tool will feel slow at first. Block a few hours for hands-on training and write internal documentation showing where the most-used reports now live. Small investment. Big difference in adoption speed.
The regulatory direction is clear
The HIPAA Security Rule NPRM is expected to be finalized in the near term, with stricter requirements around access controls and audit logging for ePHI. HHS enforcement actions against healthcare organizations using non-compliant tracking technologies have continued through 2025 and into 2026. The trend line only points one direction.
Waiting has a cost. Every month an organization runs GA4 on pages that touch patient intent is a month of regulatory exposure, potential class action risk, and reputational risk that didn't need to exist. The platforms listed above represent real, functional alternatives. None of them is perfect. All of them are better than the status quo for covered entities.
Pick one and run a pilot. You'll learn more in 30 days of parallel tracking than in six months of vendor demos.
