Rules
Part of How to think about dental marketing analytics
Dental marketing analytics: eight measurement practices and the US rules that apply
Eight dental marketing analytics practices: GA4 modeling, consent mode, server-side tagging, BigQuery export, call tracking and practice-management reconciliation, with the HIPAA and FTC rules that apply in the United States.
What to take away
- Modeled and observed numbers must be labelled separately in every dental dashboard.
- A BigQuery export is a second governance surface, not a copy of your reports.
- Patient health information stays out of Google Analytics, and the HIPAA Privacy Rule governs what the practice may share.
- Every practice on this list needs a named source, a named owner and a review date you set.
- Pilot one decision before buying any tool that supports it.
Dental marketing analytics rests on a few evidence sets: Google Analytics 4 documentation, the practice management system, call tracking records and US privacy rules. Each practice below names the source to check and the decision it should change.
Eight measurement practices and their sources
| Practice | Source to check | Decision it changes |
|---|---|---|
| Modeled key events | Google's GA4 modeling documentation, which says models estimate conversions that cannot be observed directly. | Whether a booked appointment is reported as observed or modeled. |
| Consent mode | Google's consent mode documentation, which sets how tags behave after a visitor refuses cookies. | Whether a conversion is observed, modeled or missing after a refusal. |
| Server-side tagging | Google Tag Manager's server-side container documentation. Events move to a server container you control. | Which identifiers leave the browser. |
| BigQuery export | The GA4 BigQuery export schema, which lists event tables, repeated parameters and late-arriving rows. | Who can query row-level events. |
| Automated insights | GA4's insights feature, which flags anomalies and trends in report data. | Whether a person verifies the definition before acting. |
| Call tracking | CallRail and Invoca record the source, campaign and caller of each call. | Whether a lead is matched or assumed. |
| Practice management reconciliation | Dentrix, Eaglesoft and Open Dental hold the booked and attended appointments. | Whether the marketing number matches the chair schedule. |
| Privacy and retention | HIPAA Privacy Rule, 45 CFR Parts 160 and 164, and your state's privacy law. | Whether collection can stop and be traced quickly. |
Each row names a source you can open, not a forecast. Check the live documentation before you rely on a quota, limit or default, because platform limits change without notice.
Modeled events need a label, not a footnote
Google's GA4 modeling documentation states that modeling estimates events it cannot observe directly. It names consent, device, cookie and privacy conditions, plus reporting delay. A dental dashboard should show four layers: observed, modeled, unknown and checked against the practice management system.
Four reporting layers
Observed
- Source
- Directly tracked
- Label
- Observed
- Use
- Count as seen
- Identity
- No patient ID
Modeled
- Source
- Estimated by model
- Label
- Modeled
- Use
- Flag as estimate
- Identity
- No patient ID
Unknown
- Source
- Not captured
- Label
- Unknown
- Use
- Do not infer
- Identity
- No patient ID
Operationally verified
- Source
- Practice management system
- Label
- Verified
- Use
- Match to booking
- Identity
- Matched record
Keep the platform definition and the processing date beside the number. Never use modeled reporting to infer a patient's identity or a clinical outcome. Treatment questions belong to the treating dentist, not to a dashboard.
The BigQuery export is a second governance surface
The GA4 BigQuery export schema documents event tables, repeated parameters and late-arriving rows. That is technical documentation, not permission to export patient-adjacent data. Restrict events and fields before they reach the warehouse, and set row-level access and retention deliberately.
Google Analytics should not receive patient health information. Keep appointment details, treatment names and patient identities out of page URLs, event names and form fields, and confirm Google's current terms for HIPAA-covered entities before you link any patient system to analytics.
Before exporting anything, apply the same test to every practice:
- Record each source and its review date.
- Test the setup with fictional data only.
- Pilot one decision on a small page set.
- Separate observed, modeled and matched outcomes.
- Cap row-level access and retention.
- Test what happens during a quota limit, an outage or stale data.
- Stop when a privacy or quality check fails.
Do not let automation write an unreviewed narrative. Require metric versions, filters, date ranges and quality flags, and check any generated explanation against the practice's own booking record.
Call tracking and the matched lead
Call tracking tools record where a call came from, which campaign drove it and, in some setups, the outcome. Invoca and CallRail are two examples. The tool records the call, but your practice management system records the patient, so a lead counts as matched only when the two records agree.
Recording calls can trigger state consent-to-record laws, which in some states require notice to every caller. Ask counsel before turning on call recording, and keep recordings no longer than the practice's written retention policy allows.
Reconcile with the practice management system
Marketing platforms count clicks, sessions and forms. The chair schedule counts appointments kept. Compare the two monthly, using the same date range and the same definition of a new patient, and write down the gap.
A large gap usually points to a tracking problem, such as a form that fails on mobile or a booking link that drops its source parameter. Find the cause before you change the campaign.
Rules that apply in the United States
HIPAA governs protected health information held by the practice and its business associates. A marketing vendor that receives patient data needs a business associate agreement before it touches that data.
The FTC Act's prohibition on unfair or deceptive practices applies to dental websites and advertising, and FTC guidance on health claims applies to what the analytics say about results.
State dental boards and the ADA's ethics code set advertising rules, and state privacy laws, such as the California Consumer Privacy Act, may apply to website data from residents of those states. Confirm each requirement with counsel.
Watchlist item labels
- Labelshipped, limited release, preview, announced, inferred
- Name the workflow
- Name the source
- Name the owner
- Name the test
- Name the rollback condition
- Recheck the primary page before adopting
Label every platform change as shipped, limited release, preview, announced or inferred. Name the workflow, the source, the owner, the test and the rollback condition. Recheck the primary documentation before you adopt anything.
Common questions
Will modeled events replace measurement gaps?
No. Models estimate under platform rules and whatever evidence is available. Keep the gap, the assumption and the observed data visible in the same view.
Does a warehouse create a single source of truth?
Only if definitions, ingestion, access, updates, quality checks, lineage and reconciliation with the practice management system are all governed. Otherwise it is a second set of numbers.
Which practice should a practice test first?
Start with the smallest change that improves a decision you already make, without widening patient data collection or loosening access controls. Consent setup and the monthly reconciliation are usually the cheapest places to start.
Do these practices change what a practice may advertise?
No. State dental board and ADA advertising rules set that, and counsel should review any claim before it runs.
