Healthcare marketing runs under rules most agencies never learn. Here is exactly what we do, what we won't do, and where your counsel comes in.
TL;DR
We keep patient information out of ad platforms, use tools that will sign a Business Associate Agreement, sign one ourselves, write ads to fit Google and Meta health policies, and charge a flat monthly fee instead of a fee per patient. We work alongside your compliance counsel. We aren’t lawyers, and nothing on this page is legal advice.
01
How we handle patient data
No patient information in ad platforms, HIPAA-capable tools only, and a signed BAA before we touch anything sensitive.
The safest patient data is the data we never see. We set up your marketing so that most of our work, such as your Google profile, your ads and your website content, doesn't involve patient information at all.
Where a tool does have to hold patient details, like a follow-up text or a reminder, we use tools that offer a Business Associate Agreement and we make sure one is signed. If our own work for you could involve protected health information, we sign a BAA with you before that work starts.
We do
Sign a Business Associate Agreement before any work that could involve protected health information
Use tools that will sign a BAA for anything that stores or sends patient details
Keep patient names, conditions and appointment details out of ad platforms and general analytics
Give each person their own login, with the least access they need
We won’t
Upload patient lists to an ad platform to build audiences
Put patient details in a tool that hasn't signed a BAA
Ask for more access to your systems than the work requires
02
Tracking we set up and tracking we won't
You still see which marketing works. Ad platforms don't get to see who your patients are.
Most clinic websites were built by someone who treats tracking the way a retailer would: an ad pixel on every page, including the booking form. On a page where someone is sharing why they need care, that can send identifying information to a company that has no agreement with you.
We take the opposite approach. We measure what you need to make decisions, such as which channel led to an inquiry, and we keep ad and analytics trackers off the pages where patients share health information. The free Tracker Scan shows what's on your site today.
We do
Audit every tracker on your site, page by page, including what loads through a tag manager
Keep booking, intake, contact and patient portal pages free of ad pixels
Report on inquiries and bookings by source, using aggregate numbers
Give you a written record of what we removed, what we changed and why
We won’t
Send form contents, appointment details or condition pages a visitor viewed to an ad platform
Install session recording on pages where patients type health details
Tell you a setup is risk-free. We reduce risk and document it; your counsel decides what's acceptable
Google, Meta and TikTok each have their own rules for health advertising. We write and target inside them.
Every major ad platform treats health as a sensitive category. Google restricts prescription drug terms and requires certification for some kinds of advertiser. Meta doesn't allow ads that assert or imply something about the viewer's health, and limits the data health advertisers can send back to it. TikTok restricts many health and weight-related claims and products.
These rules change often, and an account flagged under a health policy can take weeks to recover. We write ads, landing pages and targeting with the current policies open, and we keep your accounts in your name so a problem never strands you.
We do
Write ad copy that describes the service, not the reader's condition
Check each campaign against the platform's current health policy before it launches
Tell you plainly when something you want to advertise isn't allowed, or needs certification first
We won’t
Use before-and-after imagery or claims a platform prohibits
Try to slip restricted terms past a review
Run ads from an account you don't own
04
LegitScript: who needs it, what it costs, how we help
Some practices need a third-party certification before platforms will run their ads. Most don't.
LegitScript is an independent company that certifies certain healthcare businesses. Ad platforms rely on it to decide who may advertise in higher-risk categories. In the United States that mainly means telemedicine providers that prescribe, online pharmacies, and drug and alcohol addiction treatment. A local dental office, chiropractor or med spa advertising in-person services usually doesn't need it.
You apply and pay LegitScript directly: an application fee, then an annual fee for each website. Fees depend on the type of certification, so check LegitScript's current pricing before you budget. We don't mark it up or collect it.
We do
Tell you early whether your practice is likely to need certification
Help you get your website, licensing details and policies ready for the application
Plan your marketing around the review timeline, so you aren't waiting with nothing running
We won’t
Promise that an application will be approved, or how long it will take
A flat monthly fee, always. Paying a marketer for each patient can run into anti-kickback and fee-splitting rules.
Plenty of agencies offer to be paid per lead, per booking, or as a share of what a new patient spends. In most industries that's just a pricing choice. In healthcare, paying someone for each patient they bring you can raise problems under the federal Anti-Kickback Statute when government programs are involved, and under state laws on fee-splitting and patient referrals, some of which apply even to cash-pay practices.
We charge a flat monthly fee for the marketing work we do. The fee doesn't go up or down with how many patients you see or what they spend. It keeps the arrangement simple for your counsel to review, and it keeps our incentives where they should be.
We won’t
Charge per patient, per booking or per lead
Take a percentage of your collections or of any treatment
No guarantees, no borrowed results, and written consent before a patient's photo or words appear anywhere.
Healthcare advertising has to be truthful and backed up, and licensing boards hold clinicians to stricter standards than the general rules for advertising. We write with that in mind and ask you to approve anything that makes a clinical statement.
We do
Describe what a treatment is and who it may suit, without promising an outcome
Use before-and-after photos only with the patient's written authorization, and only where the platform allows them
Use reviews and testimonials as patients gave them, with permission
Send clinical claims to you for approval before they're published
We won’t
Guarantee results, rankings or a number of new patients
Use stock or AI-generated images as if they were your patients or your results
Reply to a review in a way that confirms someone is a patient
07
Accessibility
Every site we build targets WCAG 2.2 Level AA.
People visit a practice's website when they're unwell, in a hurry, older, or using assistive technology. A site they can't use is a patient who goes elsewhere, and it can be a legal exposure for the practice.
We build to the Web Content Accessibility Guidelines 2.2 at Level AA: readable contrast, keyboard navigation, labeled forms, text alternatives for images, and respect for reduced-motion settings. We test it before launch and when we add pages.
We work alongside your compliance counsel. We aren't lawyers.
We bring the marketing and technical detail. Legal judgment stays with your attorney.
Everything on this page describes how we work. None of it is legal advice, and none of it is a promise that your practice is compliant with HIPAA or any other law.
What we can do is make your counsel's job easier. We document what's on your site, what we changed and how your data flows, in plain language, so the person responsible for your compliance can make a decision quickly. If you don't have compliance counsel yet, we'll tell you when a question needs one.
Find out what's running on your booking pages.
The free Tracker Scan reads your site in seconds. The free audit goes deeper, with a real browser and a person.
