Selecting a Health Care Marketing Company for Admissions

The addiction-treatment marketing environment has changed enough since 2022 that a CMO evaluating outside partners is no longer choosing between creative shops. The choice is between operators who can absorb the current federal rulebook and operators who cannot. SAMHSA’s 2025 National Survey on Drug Use and Health estimates that 47.2 million people aged 12 or older needed substance-use treatment in the past year, while 7.6 million (16.0%) received it. SAMHSA cautions that 2025 estimates of treatment, treatment need, and perceived unmet need are not comparable with prior years because of questionnaire changes, so the figure should anchor demand context rather than a year-over-year trend ¹¹. The gap is real; so is the enforcement risk attached to any agency that tries to close it carelessly.

Three federal developments have rewritten what a competent partner must actually do before a campaign launches. HHS issued its online-tracking bulletin in June 2024, clarifying that pixels, analytics, and conversion tags on treatment-center properties can create impermissible disclosures of protected health information ¹. The 2024 42 CFR Part 2 final rule set a February 16, 2026 compliance date for the federal SUD confidentiality framework, which reaches intake forms, call recordings, CRM records, and any conversion data tied to people seeking addiction treatment ⁴. And the FTC has continued to bring cases against treatment marketers for deceptive claims, health-data sharing, and competitor impersonation.

The practical consequence for a CMO is simple. Selection now hinges on whether a prospective agency can document its tracking architecture, its substantiation files, its consent workflows, and its reporting through to VOB and admit — not whether the pitch deck looks polished. The rest of this guide sets out that operating standard and the specific artifacts to require before signing.

Three FTC actions since 2022 sketch the pattern of behavior that gets treatment marketers into trouble. Read together, they function as a screening tool. A CMO reviewing an agency’s active tactics, portfolio, and call-center playbook can compare them directly to what regulators have already called deceptive.

The R360 matter, resolved in 2022, produced a $3.8 million civil penalty judgment against the company and its owner. The FTC’s proposed order barred misrepresentations that consumers would be directed to treatment based on individualized needs, that services carried expert endorsement or evaluation, and about the criteria used to evaluate providers ⁸. The screening implication is direct: any personalization or matching language on an agency’s client sites should be traceable to a documented assessment methodology, and any endorsement or evaluation claim should be backed by an actual reviewer with credentials on file.

The Monument settlement, announced in April 2024, addressed the disclosure of user health information to Meta, Google, and other advertising platforms after the company had promised confidentiality. The proposed order banned disclosure of health information for advertising, required affirmative consent for other third-party sharing, and imposed a $2.5 million civil penalty that was suspended based on inability to pay ⁶. For agency selection, this establishes that pixel and audience configuration is a legal question, not a technical convenience. A partner that cannot produce a current inventory of every tag, server-side endpoint, and audience upload — with the underlying consent basis for each — carries the same exposure Monument did.

The Evoke Wellness settlement, announced in June 2025, alleged that a Florida provider used Google ads and telemarketing to impersonate other treatment clinics. The resolution included a $1.9 million payment, a ban on impersonating other companies, restrictions on misrepresentations about SUD services, and a requirement to implement a compliance program that monitors call centers ⁷. Competitor-name bidding, ambiguous caller identity on inbound switchboards, and unmonitored intake scripts are all live risk vectors any CMO can audit in a prospective partner’s own campaigns before signing.

The screening exercise is concrete:

1. Pull the agency’s client landing pages and search which brand terms trigger their paid ads.
2. Listen to five recorded intake calls and verify that callers identify the specific facility, not a generic “admissions helpline.”
3. Ask for the pixel inventory and the BAA list.
4. Request the substantiation folder for any personalization claim.

Agencies that pass those four checks are working inside the rulebook the FTC has been enforcing. Agencies that stall on any one of them are running the tactics the commission has already penalized.

Most agency dashboards stop at sessions, form fills, and inbound calls. That is the wrong ceiling. A treatment center’s economic reality begins when a caller is qualified, verified, and admitted, and its brand reality extends into how that patient describes the intake experience weeks later. The reporting an agency owes a CMO should trace the full arc, and every stage of it should be tied to a specific measurement instrument and a governing regulation.

The scorecard below is the article’s central operating artifact. It replaces the usual funnel diagram with something a CMO can hand to an agency and grade against.

Two design points make the scorecard useful rather than decorative. First, each stage carries its consent and privacy attributes forward, so a VOB record can be traced back to the exact disclosure the caller saw and the exact tracking configuration on the landing page that produced the call. HHS is explicit that tracking vendors receiving PHI generally require a BAA and an applicable permission, which means the traffic row cannot be separated from the qualified-call row in any credible report ¹. Second, the post-admit row is not a satisfaction survey bolted onto a marketing deck. CAHPS Outpatient Mental Health measures include getting counseling, communication with the counselor, unmet need, and financial barriers ¹², while the ECHO framework adds timely access, family involvement, and information about treatment options ¹³. When those signals move alongside CPA and admit counts, an agency loses the option to optimize for cheap leads that produce poor-fit admissions.

A CMO should require the scorecard as a monthly deliverable and reserve the right to audit any row on request. Agencies that cannot produce the underlying artifacts — the data-flow diagram, the consent log sample, the substantiation file, the CAHPS or ECHO export — are reporting narrower results than the operating standard requires.

The build-versus-buy question sits underneath every agency evaluation, and most CMOs get pushed toward it before they have defined what they are actually staffing. The right frame is portfolio construction: which capabilities must live inside the center because they touch clinical judgment or patient records, which can be shared with an outside operator under a business associate agreement, and which are safer to hand off entirely to specialists who carry the tooling and precedent.

Three capabilities generally belong in-house:

• Substantiation review for outcome, MAT, and personalization claims requires clinical sign-off that an agency cannot provide on its own under the FTC’s health-claims standard ⁹.
• Consent architecture and Part 2 data governance sit closest to the patient record and the February 16, 2026 compliance framework, and delegating them creates ambiguity about who owns a redisclosure error ⁴.
• Payer strategy and VOB workflow depend on contract knowledge that changes weekly.

A specialized agency earns its place on the execution layers where scale and precedent matter: SEO and content production tuned to SUD search behavior, paid-media configuration that survives the HHS online-tracking bulletin ¹, call-tracking deployment with consented capture, and creative testing against segments drawn from sources like the SAMHSA 2024 TEDS tables ¹⁴. Generalist agencies without named treatment-center clients should be evaluated against the same operating standard as any other vendor — the regulatory rulebook does not adjust for staffing model.

For CMOs running two or more facilities — whether a regional group with three residential campuses or a national operator with twenty locations across detox, PHP, and IOP — governance stops being a single-site checklist and becomes an infrastructure problem. The compliance surface multiplies with every location, and so does the number of places an agency can quietly create exposure.

Three artifacts should be consolidated at the portfolio level rather than duplicated per facility:

• The pixel and tag inventory has to live in a single register that maps every property, every script, every server-side endpoint, and every BAA to the facility it serves, so that a change on one landing page cannot silently propagate an impermissible disclosure across the network ¹.
• Consent logs and suppression lists should be unified across the CRM, call platform, and any dialer vendor — a person who opts out at one facility must be suppressed across all of them, and the timestamp and disclosure language must be retrievable at the record level ¹⁰.
• Substantiation files for outcome, MAT, and personalization claims should be maintained centrally, with facility-specific variants approved against the same clinical sign-off, so that copy tested at one location is not repurposed elsewhere without a fresh substantiation check ⁹.

Google Business Profile governance deserves its own owner. Multi-location operators frequently discover duplicate listings, mismatched service categories, and unmanaged review responses that contradict the substantiation file. A single admin structure — with a documented escalation path for reputational incidents — closes that gap before it becomes an FTC exhibit.

A pitch deck is not evidence. Before a contract moves to signature, a CMO should require the agency to hand over a defined set of artifacts and hold them in a shared repository the treatment center can audit at any time. The list below is short on purpose. Each item corresponds to a specific regulatory or operational failure mode already covered in the article, and each one is refusable by an agency that has actually done the work.

Seven artifacts should arrive before launch:

1. A written data-flow diagram covering every script, tag, server-side endpoint, and vendor receiving identifiers from treatment-center properties, with BAAs attached for each vendor that touches PHI ¹.
2. A pixel and audience inventory listing every remarketing list, lookalike source, and conversion event, with the authorization basis for any use of patient information ².
3. A Part 2 subcontractor register naming every downstream vendor that touches SUD records, with consent language, redisclosure controls, and retention schedules documented per vendor ⁴.
4. A substantiation file for every active claim about outcomes, MAT, personalization, endorsement, or comparative superiority, with the source, reviewer, and last-review date on each entry ⁹.
5. A consent log sample showing source, timestamp, exact disclosure language, and suppression-list synchronization for call and text outreach ¹⁰.
6. A call-monitoring QA rubric with a defined sampling rate, scoring criteria for caller identity and service representation, and escalation procedures — the operational control the FTC required of Evoke Wellness ⁷.
7. A reporting template that produces the accountability scorecard monthly, with the underlying exports available on request.

An agency that treats these as post-launch deliverables is asking the treatment center to accept the risk during the build. Require them as conditions of the master services agreement, not as promises inside it.