The Process for Vetting Healthcare Marketing Agencies

A treatment center’s marketing agency does not merely sell beds. It shapes how prospective patients and referring clinicians perceive the quality of care before a single admissions call connects. That perception carries measurable weight. A study of more than 2,100 U.S. hospitals found that in competitive markets, a 1% increase in advertising spend per thousand households was associated with a 1.173% rise in top-box HCAHPS ratings and a 1.540% rise in “definitely would recommend” responses ¹. The study covered acute-care hospitals rather than behavioral health facilities, and the elasticity should not be lifted wholesale into a residential SUD context—but the directional signal holds: paid visibility shifts reported experience independent of clinical delta.

For a treatment center CMO, that finding reframes the vetting exercise. Selecting an agency is not procurement. It is the delegation of a variable that measurably alters how patients, families, and referral sources judge clinical trust. The agency’s editorial choices, retargeting logic, and claim substantiation flow directly into the same perceptual layer that HCAHPS captures for hospitals and that review sites, Google Business Profiles, and referral conversations capture for behavioral health.

Two operational consequences follow. First, an agency that mishandles PHI, testimonial substantiation, or paid-search claims does not simply create a compliance incident—it corrupts the trust signal the CMO is paying to build ^{6, 5}. Second, agencies that optimize purely for call volume without governing perception quality can lift short-term admissions while eroding the brand equity that keeps census stable through regulator scrutiny cycles and payer negotiations ⁷. Vetting has to be built around both risks at once.

Procurement teams and PE sponsors do not respond to narrative arguments about agency fit. They respond to weighted criteria, documented thresholds, and a defensible rationale for why one vendor was selected over another. Translating the four layers into a scorecard gives the CMO an artifact that survives board review and creates an audit trail if a campaign later triggers a regulatory inquiry.

The weighting reflects where risk concentrates. Regulatory Posture takes 30% because a single HIPAA authorization failure or an unsubstantiated outcome claim can generate enforcement exposure that dwarfs any marketing efficiency gain—HHS treats third-party remuneration as a threshold that flips ordinary communications into marketing requiring patient authorization ⁶, and FTC expects competent and reliable scientific evidence behind health claims before they run ⁵. Evidence Discipline and Attribution Architecture each carry 25%: the first governs what the agency will let the treatment center say in market, the second governs whether the CMO can prove which dollars produced admissions. Category Operating History rounds out the remaining 20%—weighted lower than compliance and measurement because operating history without regulatory posture is a liability, but weighted high enough that generalist agencies with strong measurement stacks do not score their way into a behavioral health contract.

Sub-criteria within each category should be scored pass/fail rather than one-to-five, because directional scoring hides binary risks.

• Under Regulatory Posture: executed BAA template, documented PHI data-flow diagram, substantiation workflow with named owner, and demonstrated familiarity with CMS marketing constraints for Medicare-participating populations ³.
• Under Evidence Discipline: testimonial intake form, redacted substantiation file from a live account, and a documented process for pulling copy that fails FTC review ⁵.
• Under Attribution Architecture: dynamic number insertion with session persistence, CRM event schema tied to admissions rather than leads, and a reporting cadence that reconciles to census.
• Under Category Operating History: three named behavioral health accounts held eighteen months or longer, and consent to contact one former client.

Certain patterns in an agency pitch deck or master services agreement should end the conversation before a scope-of-work draft appears. Behavioral health carries specific failure modes that do not show up in general healthcare marketing engagements, and CMOs who catalog them explicitly can screen out unsuitable vendors in a single review pass.

1. The first pattern is language that edges toward patient brokering. Agencies that describe deliverables as “per admit” pricing, referral fees for filled beds, or performance bonuses tied to specific admission counts are proposing a compensation structure that intersects with federal anti-kickback statutes and state patient brokering laws. The compliant alternative is fixed-fee retainers or media-management fees decoupled from clinical outcomes.

2. The second pattern is casual use of PHI in retargeting and lookalike audiences. HHS is explicit that a communication becomes marketing—and generally requires patient authorization—when it describes a product or service and involves financial remuneration from a third party ⁶. Agencies that propose uploading admissions lists, inquiry-form data, or CRM segments into ad platforms without walking through the authorization boundary are describing a HIPAA incident on a whiteboard. The correct posture is hashed-audience workflows only for non-PHI segments, with documented consent language for anything else.

3. The third pattern is testimonial and outcomes copy that arrives without a substantiation file. FTC guidance requires competent and reliable scientific evidence for health claims, and marketers are expected to weigh all relevant research rather than cherry-pick supportive studies ⁵. Success-rate percentages, completion statistics, and “industry-leading” outcome claims that appear in draft creative without a methodology document should be pulled and reworked.

4. The fourth pattern is LegitScript status treated as an afterthought. Agencies that cannot describe how they manage the certification window, which paid channels require it, and how they sequence campaign launches around re-verification are proposing to run paid acquisition on channels that will suspend the account.

5. The fifth pattern is lead-resale language buried in the MSA. Contracts that grant the agency rights to “aggregate,” “benchmark,” or “share” inquiry data across accounts are describing a lead marketplace, not a marketing engagement. That clause needs to come out before signature.

Content is the layer where an agency’s judgment shows up in public. Search-driven articles, condition pages, and family resources are read by prospective patients who use them to validate what a clinician has already told them, question a treatment recommendation, or decide whether to place a call at all. A systematic review of 48 studies found that online health information generally supports professional advice, increases consultation rates, and improves adherence, but also contributes in some cases to refusal or discontinuation of treatment ⁴. An agency operating without editorial guardrails is not neutral in that dynamic—it is actively pushing patients toward one outcome or the other.

That risk is why content strategy cannot be handed over as a monthly deliverable count. The vetting question is who inside the treatment center holds final editorial authority over any asset that discusses conditions, levels of care, or outcomes. If the agency’s proposed workflow routes clinical content through a marketing manager alone, without clinician review, the treatment center has delegated something it should not have. An overview of reviews on online health information found the patient–provider relationship moderates whether digital content strengthens or undermines care, which puts editorial oversight squarely inside the clinical governance frame ².

Three operational tests separate agencies that respect that boundary from those that do not:

1. Does the content brief template include a required clinician reviewer field with sign-off before publication?
2. Does the agency maintain a source library for medical claims that a compliance officer can audit?
3. When SEO priorities conflict with clinical accuracy—phrasing that ranks but oversimplifies a level-of-care distinction, for example—whose call is it? The right answer is the treatment center’s, in writing, before the contract is signed.

The vetting logic shifts when the buyer is a portfolio CMO or a PE-backed platform overseeing three or more facilities across state lines. The four layers still apply, but two of them—Category Operating History and Attribution Architecture—need additional stress tests that a single-site engagement does not surface.

Category Operating History has to account for facility differentiation. A residential adolescent program in Florida, an adult MAT clinic in Ohio, and a dual-diagnosis PHP in California share a parent brand but draw distinct search populations, referral networks, and payer mixes. Research on hospital social media strategy shows that tailored activity, interactivity, and content type produce meaningfully different influence outcomes than uniform playbooks ¹⁰. An agency that proposes to duplicate a single national SEO template across every facility—same page structures, same local citations approach, same review-generation cadence—is proposing to cannibalize its own client. The vetting move is to ask for a sample multi-site content plan and check whether local pages carry facility-specific clinical voice, staff bios, and geo-modified keyword strategy, or whether they are variable-substituted copies.

Attribution Architecture has to survive facility-level rollup. Cost-per-admission is only useful when the CMO can decompose it by site, level of care, and payer without the CRM collapsing sources across facilities. Agencies with real portfolio experience arrive with a call-tracking taxonomy that isolates each location as a distinct source dimension and a reporting layer that reconciles admissions back to census by site.

A defensible vetting process runs in three phases, and the artifacts produced at each phase are what protect the CMO when a campaign is later audited or a contract has to be unwound.

1. Phase one is a written RFI, not a discovery call. It requests the executed BAA template, a redacted substantiation file, three named behavioral health accounts held eighteen months or longer, and a sample cost-per-admission report by channel. Agencies that cannot return those four artifacts within ten business days are eliminated before pitch meetings consume calendar time.

2. Phase two is a scored working session with the two or three agencies that clear the RFI. The session tests judgment under real constraints: a live client-supplied outcome claim without methodology, a proposed retargeting audience that touches inquiry data, and a multi-site content plan for facilities in two states with different regulatory postures. How the agency reasons through the substantiation gap, the HIPAA authorization boundary ⁶, and the facility-level differentiation problem ¹⁰ reveals more than any capabilities deck. The CMO scores the working session against the four-layer rubric on the same day, while the reasoning is intact.

3. Phase three is the contract itself. Three exit terms belong in every behavioral health MSA:

   • A ninety-day termination-for-convenience clause with prorated media commitments, because eighteen-month lock-ins concentrate risk on the treatment center rather than the agency.
   • A data-return provision requiring the agency to hand over call-tracking histories, CRM integrations, keyword rankings, and content assets in native formats within thirty days of termination—without which the next agency inherits a black box.
   • An indemnification clause specific to FTC substantiation failures and HIPAA marketing rule violations ⁵, so financial exposure follows the party that authored the noncompliant asset.

   Agencies that resist these three terms are describing where they expect the relationship to break.