Comment by paulcole

> The last time I checked, the Google Analytics' Terms of Service explicitly prohibited its use on web sites involving healthcare companies.

You're missing a key part of the sentence you're remembering:

> If you are (or become) a Covered Entity or Business Associate under HIPAA, you may not use Google Analytics for any purpose or in any manner involving Protected Health Information unless you have received prior written consent to such use from Google.

Healthcare companies can absolutely use GA on their websites as long as the website isn't involving PHI or ePHI.