How to Vet a Digital Healthcare Marketing Agency

Why Agency Selection Is a Compliance Decision Before a Growth Decision

For behavioral health organizations, selecting a marketing agency prioritizes compliance over immediate growth. An agency that generates leads but uses stigmatizing language, mishandles Protected Health Information (PHI) for retargeting without authorization, or makes unsubstantiated claims creates significant enforcement risks. The Department of Health and Human Services (HHS) mandates written patient authorization for marketing uses of PHI, with limited exceptions ⁷. Similarly, the Federal Trade Commission (FTC) requires health-related advertising claims to be truthful, non-deceptive, and supported by adequate evidence ^{1, 2}.

This means a Treatment Center CMO is primarily seeking a digital healthcare marketing agency capable of operating within a complex regulatory framework. This includes HIPAA marketing rules, FTC substantiation and endorsement standards, SAMHSA and CMS language guidelines, and the accuracy expectations for directories that federal reviewers now specifically scrutinize in behavioral health ^{9, 16}. Growth achieved without adherence to these standards is unsustainable.

The following sections detail a diligence rubric structured around five pillars, each linked to a specific federal source. This framework serves as an internal audit protocol to assess an agency’s compliance capabilities. If an agency cannot provide evidence for each pillar, discussions about admissions volume are premature.

The Five-Pillar Diligence Rubric

This rubric organizes agency vetting into five diligence pillars, each grounded in a federal or clinical standard. It is designed to produce tangible evidence for a CMO to present to leadership or legal counsel.

The pillars are:

• HIPAA marketing authorization and PHI handling (HHS guidance ⁷)
• FTC substantiation for treatment and outcome claims (FTC requirements for evidence-based advertising ³)
• Endorsement and testimonial discipline (FTC Guides on honest endorsements and disclosures ⁶)
• Language and stigma controls (SAMHSA guidance on discriminatory language ¹²)
• Directory and reputation accuracy (CMS reviews of provider-directory data quality ¹⁵)

Each pillar section outlines specific questions to ask, what constitutes acceptable proof, and the authoritative source for the standard.

Pillar One: HIPAA Marketing Authorization and PHI Handling

Many agencies struggle with this pillar. HHS clearly states that the HIPAA Privacy Rule mandates written patient authorization for marketing uses or disclosures of PHI, with only limited exceptions ⁷. This rule dictates how an agency can build audiences, manage retargeting, synchronize CRM data with ad platforms, share data with call centers, or provide leads to third parties. A CMO should not accept a general claim of “HIPAA compliance.” Instead, demand specific artifacts:

• A signed business associate agreement
• Documented data flow diagrams for all campaign types
• An authorization form meeting HIPAA’s content requirements
• A written policy detailing how PHI is scrubbed before use with any ad platform pixel or lookalike model

Agencies proficient in this area can readily identify which workflows involve PHI and which do not. They should be able to provide data-flow diagrams for paid search campaigns, form-fill funnels, and CRM-to-Meta audience synchronization. They must also distinguish between business associates and other vendors in their technology stack, explaining why a telemarketer using an outbound list requires either written authorization or a qualifying business associate relationship for non-marketing communications ⁸. Agencies unable to map their data flows upon request are not suitable for handling behavioral health data.

Pillar Two: FTC Substantiation for Treatment and Outcome Claims

This pillar assesses an agency’s ability to differentiate between marketing copy and evidence-based claims. The FTC mandates that advertising be truthful, non-deceptive, and evidence-based, without exceptions for behavioral health ². Its health-products guidance further specifies that objective claims made to patients and families must be substantiated at the time of publication, and implied claims are treated with the same scrutiny as explicit ones ¹. A CMO should request substantiation files for every recurring claim in the agency’s content library. If the agency states the client bears all risk and merely writes to a brief, this is only acceptable if the agency also flags claims requiring proof before publication. Agencies that publish claims like “industry-leading outcomes” or “proven recovery model” without requesting underlying data are transferring enforcement risk to the operator without disclosure.

Pillar Three: Testimonials, Reviews, and Endorsement Discipline

Patient stories are powerful marketing tools but also a significant source of enforcement risk. The FTC’s Guides mandate that endorsements reflect the honest opinions and experiences of the endorser, and that consumer endorsements are not considered competent scientific evidence for performance claims ⁶. A single alumni testimonial stating “I’ve been sober for three years” cannot, by itself, imply program efficacy. If an advertisement or landing page suggests such results are typical, the advertiser must disclose what consumers can generally expect ⁵.

Agency discipline in this area is evidenced by three artifacts:

1. A written testimonial-sourcing policy detailing how alumni consent is obtained, whether compensation was provided, and how material connections are disclosed ⁴.
2. A substantiation file for any implied outcome within the testimonial, as the FTC applies the same standards to implied and explicit claims in health advertising ¹.
3. A review-handling protocol outlining how third-party reviews are excerpted, whether only positive quotes are selected, and how negative reviews are addressed rather than suppressed.

Request the agency to present a current alumni story from paid or organic channels and walk through these artifacts. Agencies that treat testimonials solely as creative content without proper disclosure and substantiation layers are prone to regulatory attention. Those that can readily produce the necessary documentation have established the required workflows.

Pillar Four: Language, Stigma, and Content Audit Controls

This pillar addresses the intersection of creative quality and clinical credibility. SAMHSA emphasizes that discriminatory language and inaccurate perceptions harm individuals with substance use disorder, and its stigma-language initiative educates healthcare professionals on appropriate terminology ¹². CMS provides a working vocabulary, offering person-centered alternatives for stigmatized terms like “addict” and “substance abuser” ¹³. An agency unfamiliar with this vocabulary will produce outdated copy that clinical reviewers, payers, or family members will immediately identify as problematic.

The diligence question is whether the agency incorporates a language audit into its standard content workflow, not as a one-off task. Request to see the firm’s internal style guide and verify if it specifically addresses terms flagged by SAMHSA and CMS, such as “clean,” “dirty,” “relapse” used judgmentally, and “abuser” framings ^{12, 13}. Inquire about their process for handling legacy content: is there a scheduled review of existing landing pages, blog archives, and ad libraries, or does old copy remain unaddressed? Ask who approves new creative before publication and if a clinical stakeholder from the treatment center is involved in this process.

An agency excelling in this pillar will provide two artifacts: a written language standard aligned with SAMHSA and CMS guidance, and a content audit log detailing reviewed assets, changes made, and review dates. Agencies that view stigma controls as mere sensitivity rather than standard operating procedure will continue to publish copy that erodes the trust built by paid media efforts.

Pillar Five: Directory Accuracy and Ghost-Network Exposure

This pillar focuses on the infrastructure that enables prospective patients to find and access a facility. A CMS review of Medicare Advantage online provider directories found that nearly half (48.74%) contained at least one inaccuracy, including incorrect addresses, phone numbers, or listings for providers not accepting new patients ¹⁵. While this figure pertains to Medicare Advantage, the principle applies broadly: self-reported directory data degrades over time, requiring active reconciliation.

For a treatment center CMO, this pillar evaluates whether an agency treats directory hygiene as an ongoing workflow or a one-time setup. Ask how frequently the agency audits Google Business Profile hours, addresses, phone numbers, and service categories for all facility locations. Inquire about the reconciliation cadence for Yelp, Psychology Today, insurance-plan directories, and referral listings. Determine which team member is responsible for addressing discrepancies when a location changes admissions hours, adds a level of care, or discontinues a program. The Assistant Secretary for Planning and Evaluation (ASPE) has highlighted that inaccurate provider directories hinder patients seeking behavioral health care, turning every outdated listing into a lost admissions opportunity ¹⁴.

Telehealth Marketing: Consent Alignment as a Vetting Signal

Telehealth has become a key admissions growth channel, necessitating that marketing claims, such as “same-day virtual intake,” align with actual clinical capabilities. HHS notes that most states require official informed consent before telehealth treatment, with specifics varying by state ¹⁰. An agency running geo-targeted campaigns across multiple states should be able to identify which state-specific consent requirements influence landing-page flows.

The second alignment point is privacy. HHS guidance for telebehavioral health explicitly states that privacy risks should be discussed with patients before a telehealth encounter ¹¹. A landing page promising “private, confidential virtual care” must correspond with the intake team’s actual privacy disclosure script. Ask the agency who is responsible for reconciling marketing promises with clinical consent language. If this handoff is undefined, the marketing efforts may create expectations that the clinical workflow cannot meet.

Measuring the Agency: Admissions Signals, Not Vanity Metrics

An agency’s monthly reporting deck is a diligence artifact in itself. Metrics like sessions, impressions, and keyword rankings indicate activity, not outcomes. For a treatment center CMO, the critical measurement stack occurs downstream of the click:

• Unique inbound calls by source
• Call duration and disposition
• VOB (Verification of Benefits) attempts
• VOBs cleared
• Admissions scheduled
• Admissions completed

All tracked by campaign and geography. If the agency cannot link a paid search term, landing page variant, or organic blog post to a specific admissions call via a tracked number, their reporting is merely decorative.

While review management is important, its impact should be calibrated. A systematic review found consistent positive correlations between online patient reviews and patient experience, but mixed associations with clinical quality measures ¹⁷. Another synthesis of 63 studies revealed that most online patient reviews are positive, limiting the insight gained from a raw star average ¹⁸. Treat reviews as a reputation signal that the agency should protect and respond to, rather than a direct proxy for program quality or admissions conversion. Ask the agency which admissions signals correlate with changes in review volume.

The Vetting Rubric Table: Criterion, Question, Proof, Source

The five pillars are summarized in a working table for CMOs to use in RFP reviews, board presentations, or discussions with legal counsel. Each row identifies the diligence area, the question to elicit artifacts, the required proof, and the governing federal standard.

| Criterion | What to Ask | What Proof Looks Like | Source Standard ||—|—|—|—|| HIPAA marketing authorization and PHI handling | Which workflows touch PHI, and where is written authorization required? | Signed BAA, data-flow diagrams by campaign type, HIPAA-compliant authorization form, telemarketer relationship documentation | HHS Privacy Rule marketing guidance ^{7, 8}|| FTC substantiation for treatment and outcome claims | For every numeric or comparative claim, where is the substantiation file? | Source document, measurement window, population scope, and qualifiers on file before the claim runs | FTC health-products and health-claims guidance ^{1, 3}|| Testimonial and endorsement discipline | How are alumni stories sourced, disclosed, and matched to substantiation? | Written testimonial policy, material-connection disclosures on assets, typical-results language where implied | FTC Endorsement Guides ⁶|| Language and stigma controls | What style guide governs SUD terminology, and how is legacy content audited? | Written standard mapped to SAMHSA and CMS terms, audit log of reviewed assets, clinical sign-off in the approval chain | SAMHSA and CMS language guidance ^{12, 13}|| Directory accuracy and reputation | Who owns reconciliation across GBP, Yelp, and payer directories, and on what cadence? | Audit schedule, discrepancy log, correction requests filed with payers for inactive or misattributed listings | CMS directory review and OIG network report ^{15, 16}|

If an agency cannot provide the required proof during a working session, the source column indicates where the enforcement risk lies.

If You Operate a Multi-Facility Portfolio

While the rubric applies to single-facility operators, portfolio CMOs face additional exposure. Each pillar’s requirements multiply at the location level. HIPAA data flows must be mapped per facility, as CRM configurations or call-tracking setups can diverge from parent policies ⁷. Substantiation files must be specific to each program’s clinical data, not aggregated into a portfolio-wide claim that the FTC would deem unsupported ¹. Testimonial libraries need to be tagged by facility to prevent an alumni story from a residential program in one state from being inappropriately used for an outpatient program in another ⁶.

Directory drift presents the most significant portfolio risk. Each new location increases the number of Google Business Profiles, Yelp listings, and payer-directory entries requiring reconciliation. Inactive or misattributed listings across a network can lead to the same credibility damage OIG documented in behavioral health plan directories ¹⁶. Ask the agency for a per-location audit cadence, a discrepancy log by facility, and a single owner responsible for correction requests. Portfolio operators who neglect this will pay for traffic directed to outdated information.

A Direct Directive for the CMO

Before the next agency meeting, apply this rubric. Request five specific artifacts from the current or prospective agency:

1. A data-flow diagram for one live campaign
2. The substantiation file for the most prominent outcome claim on the site
3. The disclosure and consent documentation for the most frequently used alumni testimonial
4. The written language standard aligned with SAMHSA and CMS terms
5. The latest directory audit log

If any of these cannot be produced within a week, the agency is not prepared to manage behavioral health traffic at scale. Growth discussions should only proceed once these artifacts are in place. This provides a defensible position for discussions with the CEO, board, or outside counsel.