Skip to content
  • There are no suggestions because the search field is empty.

How to Set Up HIPAA-Compliant Experiments in Convert

Configure privacy-first Convert experiments while minimising PHI exposure across healthcare and other HIPAA-regulated digital experiences.

Author: Dionysia Kontotasiou

IN THIS ARTICLE YOU WILL:

Overview

Healthcare, healthtech, wellness, insurance, and other regulated organizations may need to run experiments on pages that can involve sensitive health-related journeys. This guide explains how to configure Convert experiments in a privacy-conscious way and reduce the risk of collecting or exposing Protected Health Information (PHI).

Convert can support privacy-focused experimentation workflows, but HIPAA compliance depends on the customer’s full implementation, including what pages are tested, what data is collected, what third-party tools are connected, how consent is handled, and what legal agreements are in place. Customers should review their setup with their legal, privacy, or compliance team before launching experiments on healthcare-related pages.

Before You Start

Before running experiments in a HIPAA-regulated context, confirm the following:

  1. You know whether the tested page can expose PHI.
  2. You have reviewed what data Convert will collect through goals, audiences, segments, cookies, integrations, and reports.
  3. You have configured experiments to avoid collecting names, emails, patient IDs, appointment details, medical conditions, prescription information, insurance details, or other health-related identifiers.
  4. You have reviewed whether a Data Processing Agreement or other contractual documentation is required.
  5. You have disabled or carefully reviewed features that may capture behavioral or session-level data.

Convert’s Data Processing Agreement explains that Convert may process personal data on behalf of customers and that customers can request and digitally sign a DPA by contacting support@convert.com

Recommended HIPAA-Safe Experiment Setup

1. Use a dedicated Convert project for healthcare-sensitive experiments

Create a separate project for experiments that may run on healthcare, patient, member, portal, appointment, or insurance-related pages. This makes it easier to manage privacy settings, goals, audiences, access, and integrations separately from general marketing experiments.

Keep this project limited to only the domains and pages that need testing. Avoid mixing general marketing experiments with experiments that may involve regulated user journeys.

2. Avoid testing pages that display or collect PHI whenever possible

The safest setup is to run experiments only on pages that do not display, collect, or infer PHI. Examples of lower-risk pages may include general educational pages, public service descriptions, or non-personalized landing pages.

Avoid running Convert experiments on pages that include:

  • Patient names, emails, phone numbers, or account IDs
  • Appointment details
  • Medical forms
  • Prescription, diagnosis, treatment, symptom, or condition information
  • Insurance member information
  • Lab results or provider communications
  • Any page where URL paths or query strings contain health-related identifiers

If experimentation is required on such pages, use developer-built changes that do not read, store, send, or expose PHI.

3. Install the Convert tracking code securely

Add the Convert tracking code only to pages approved for experimentation. If your site uses a Content Security Policy, whitelist the required Convert domains so the tracking code can run without weakening your site’s broader security configuration.

Convert recommends configuring the connect-src directive to allow:

  • *.metrics.convertexperiments.com

  • logs.convertexperiments.com

  • *.convertexperiments.com

  • connect-src 'self' *.metrics.convertexperiments.com logs.convertexperiments.com *.convertexperiments.com; 

4. Enable privacy-first project settings

Enable Data Anonymization

Turn on Data Anonymization in Project Configuration. This hides experiment, variation, segment, and goal names from the public JavaScript and replaces them with IDs. This is especially important if experiment names could reveal sensitive business logic or health-related targeting.

Do not use experiment or variation names that include health conditions, patient types, or internal campaign labels that could be sensitive.

Respect Do Not Track and Global Privacy Control signals

Enable Respect Do Not Track Browser Settings in Project Configuration if your compliance policy requires honoring browser-level privacy choices. Convert can be configured not to load scripts or experiments when the browser sends a Do Not Track opt-out signal.

Use consent controls where required

Convert supports delaying cookie writing and data collection until consent is provided. This should be configured with your Consent Management Platform if your privacy workflow requires experiments or tracking to wait until the visitor has consented.

Use:

if (!convert.getCookie("_conv_v")) _conv_q.push({ what: "consentRequired" });

After consent is granted, re-enable Convert tracking with:

_conv_q.push({ what: "consentGiven" });

5. Create goals that do not collect PHI

Goals are used to measure whether an experiment succeeds or fails. In HIPAA-sensitive contexts, goals should measure safe, non-identifying actions only.

Recommended goal examples:

  • Clicked a generic CTA
  • Viewed a non-sensitive confirmation page
  • Completed a non-PHI interaction
  • Reached a general informational page
  • Scrolled to a content section

Avoid goal names or goal conditions that include PHI. Do not pass patient identifiers, condition names, appointment data, form field values, or health-related metadata into JavaScript-triggered goals.

Convert supports several goal types, including page visit goals, click goals, form submit goals, scroll percentage goals, and JavaScript-triggered goals. Source: Goals

For custom JavaScript goals, trigger only the goal ID. Do not include PHI or sensitive values in the code or event payload.

Example:

window._conv_q = window._conv_q || [];

_conv_q.push(["triggerConversion", "GOAL_ID"]);

6. Be careful with audiences, segments, and targeting rules

Do not build audiences using data that identifies or implies a person’s health condition, care status, appointment type, insurance status, prescription interest, or patient/member identity.

Avoid audiences based on:

  • Customer ID
  • Patient ID
  • Email or phone number
  • Health condition pages
  • Prescription or treatment interest
  • Insurance or member identifiers
  • Cookies or JavaScript variables that contain personal or health-related data

Convert displays GDPR/privacy warnings when audiences are built with cookies, JavaScript conditions, Time Zone, City, Region, Customer ID, Customer Tag, segmentation, or other potentially identifying criteria. Treat these warnings as a prompt to review whether the experiment is appropriate for HIPAA-sensitive use.

7. Review Convert Signals before enabling it

Convert Signals is designed with privacy in mind and masks sensitive inputs. Organizations operating in HIPAA-regulated environments should review whether session-level behavioral analysis is appropriate for their compliance requirements.

If the project may include pages with PHI, the safest approach is to keep Convert Signals disabled unless your legal/privacy team has approved its use.

8. Limit integrations with third-party tools

Many Convert integrations send experiment and variation information to analytics, personalization, data warehouse, email, or session analysis tools. In HIPAA-sensitive projects, only enable integrations that have been approved by your compliance team.

Do not send PHI, patient identifiers, or health-related audience labels to third-party tools. If sending experiment metadata to tools such as analytics platforms, customer data platforms, or email platforms, use neutral IDs rather than descriptive names.

For example, use:

  • Experiment ID: 10012345

  • Variation ID: 10067890


Instead of:

  • Experiment: Diabetes Appointment Form Test

  • Variation: High-Risk Patient CTA


Convert’s integration articles commonly describe passing experiment and variation names or IDs to third-party tools, so review each integration carefully before enabling it.

9. Protect account access

Require strong internal access controls for any Convert account used for regulated experiments.

Recommended controls:

  • Enable Two-Factor Authentication for users.
  • Give users the minimum role/access needed.
  • Remove access when team members leave.
  • Review collaborators regularly.
  • Avoid sharing credentials.
  • Keep API credentials secure and rotate them periodically.

Convert supports Two-Factor Authentication from the user profile settings.

10. QA the experiment before launch

Before launching, test as a normal visitor in an incognito window and verify:

  • The experiment only runs on approved pages.
  • No PHI is included in experiment names, variation names, goal names, audience names, JavaScript, cookies, URLs, query strings, or third-party events.
  • Goals trigger correctly without passing sensitive data.
  • Consent logic works as expected.
  • DNT/GPC behavior matches your project policy.
  • Integrations are disabled or only receive approved non-sensitive IDs.
  • Convert Signals is disabled unless approved.
  • Reports do not expose health-related identifiers.

11. Archive unused goals, audiences, and locations

After an experiment is completed, archive unused goals, locations, and audiences. This keeps the tracking setup cleaner and ensures only active, relevant data is processed by the tracking script.

Archived goals are no longer tracked in new experiments but remain available in historical reports. Archived locations and audiences are removed from the active tracking setup.

HIPAA Experiment Setup Checklist

Use this checklist before launch:

  • Legal/privacy team reviewed the experiment.
  • A DPA or required agreement is in place, if applicable.
  • Experiment is running only on approved pages.
  • No PHI appears in URLs, query strings, page content used by Convert, cookies, JavaScript variables, custom tags, or goal payloads.
  • Data Anonymization is enabled.
  • Do Not Track / GPC settings are configured according to policy.
  • Consent handling is configured, if required.
  • Goals are generic and non-identifying.
  • Audiences do not use PHI or sensitive health-related attributes.
  • Convert Signals is disabled unless approved.
  • Third-party integrations are disabled or send only approved non-sensitive IDs.
  • 2FA is enabled for account users.
  • Access permissions have been reviewed.
  • QA has confirmed no sensitive data is exposed in reports, cookies, console logs, network requests, or connected tools.

Example HIPAA-Conscious Experiment

A healthcare provider wants to test two versions of a public “Book an Appointment” CTA on a general service page.

Recommended setup:

  • Run the experiment only on the public service page.
  • Do not run the experiment inside the patient portal or appointment form.
  • Name the experiment generically, such as CTA Layout Test - Public Page.
  • Enable Data Anonymization.
  • Track only a generic CTA click goal.
  • Do not pass appointment type, condition, provider, patient, or insurance information to Convert.
  • Disable third-party integrations unless approved.
  • Disable Convert Signals unless approved.
  • QA the experiment and verify that no PHI appears in cookies, requests, logs, or reports.

What Not To Do

Do not:

  • Use Convert to collect form field values from medical or patient forms.
  • Include PHI in experiment, variation, goal, audience, or segment names.
  • Use JavaScript conditions that read patient profile data.
  • Send Convert experiment data to third-party tools that are not approved for HIPAA workflows.
  • Run session recordings or behavioral replay tools on pages containing PHI without legal/privacy approval.
  • Use URLs containing health conditions, patient IDs, or appointment details as targeting logic unless reviewed and approved.
  • Store patient or health-related data in custom page tags, cookies, localStorage, or dataLayer values used by Convert.

Final Recommendation

For HIPAA-sensitive experimentation, the best approach is data minimization: run experiments only where needed, avoid PHI entirely, anonymize experiment metadata, restrict goals and audiences to non-identifying behavior, disable unnecessary integrations, and review the setup with your legal/privacy team before launch.