What to Ask Healthcare Marketing Firms Before Hiring

The Only Scoreboard That Matters: Qualified Calls, VOB Rate, Admits, Cost per Admission

Most agency scorecards read like platform screenshots: sessions, keyword positions, MQL counts, impression share. None of those numbers pay for a bed. Treatment-center CMOs answer for census and cost per admission, and the reporting stack should end at those two lines.

A 2023 systematic review of digital health-behavior campaigns found moderate engagement and high acceptability across several formats but no strong evidence that the campaigns produced measurable behavior change, and the authors called for larger studies and more consistent outcome measurement ¹⁵. The review focused on low-income pregnant women, parents of young children, and adolescents rather than SUD populations, but the methodological point transfers: engagement volume is not clinical follow-through, and platform activity is not admission.

The reporting stack a behavioral-health CMO should require compresses the funnel to what admissions teams actually work:

An agency that cannot map its work to the right-hand column is reporting on itself. One that can will typically volunteer where its influence ends and the admissions team’s begins.

How to Test Attribution Claims in the Pitch Meeting

Attribution language collapses quickly under specific questions. A first meeting is the cheapest place to run that test.

Four prompts separate operators from storytellers.

1. Show a live client dashboard, redacted, that ties a paid-search campaign to admits by month for the last twelve months. Vague screenshots or “we don’t share client data” answers indicate the mapping does not exist.
2. Describe the call-tracking stack, including the vendor, how dynamic number insertion is deployed, and how call outcomes are pushed back into the ad platform without exposing protected health information. HHS has stated that HIPAA can apply to information collected through tracking technologies and disclosed to tracking vendors, so an agency that treats call tracking as a pure marketing tool is misreading the regulatory posture ².
3. Name the person on the admissions side who reconciles source-tagged calls to admits each week, and describe what happens when the numbers disagree.
4. Define an MQL. If the definition is a form fill or a page view rather than a qualified conversation, the agency is optimizing to a proxy the admissions team cannot bill against.

Any pitch that survives those four questions is worth a second meeting. Any pitch that does not has already answered the harder question.

HIPAA, Business-Associate Terms, and PHI in Marketing Workflows

The first document a treatment-center CMO should request is not a case study. It is the agency’s template business associate agreement, plus a written inventory of every workflow in which the agency touches patient lists, testimonials, intake notes, admissions call recordings, or portal traffic.

HHS Office for Civil Rights guidance is direct on the boundary: with limited exceptions, the HIPAA Privacy Rule requires an individual’s written authorization before protected health information is used or disclosed for marketing, and covered entities must contractually require business associates to use that information only for the covered entity’s authorized marketing activities ¹. That framing collapses several common agency practices. Uploading a former-patient list to a lookalike audience, quoting a discharge testimonial in an ad, or pulling case-mix data from a CRM to segment campaigns all trigger the authorization and BAA questions in the same paragraph.

Three artifacts should exist before a contract is signed:

• An executed BAA covering the agency and each subcontractor with PHI access.
• A written data-flow map showing where PHI enters and exits agency systems.
• A documented authorization process for any testimonial, review quote, or patient story that reaches an ad, landing page, or email.

Agencies that respond with “we don’t handle PHI” without showing how that boundary is enforced technically are describing an assumption, not a control.

Tracking Pixels, Call Data, and the Monument Precedent

In April 2024, the FTC alleged that Monument disclosed users’ personal and health information to advertising platforms including Meta and Google through tracking technologies, after promising confidentiality. The proposed order banned disclosure of health information for advertising, required affirmative consent for other disclosures, and imposed a $2.5 million civil penalty that was suspended based on inability to pay ⁵. The mechanism at issue was ordinary: standard advertising pixels, standard conversion events, and standard remarketing audiences deployed on pages where users were disclosing behavioral-health information.

HHS has separately confirmed that HIPAA applies when information collected through tracking technologies or disclosed to tracking vendors includes PHI, and that tracking on patient-portal login or registration pages can capture it ². Behavioral-health intake forms, verification-of-benefits pages, and “chat with an admissions counselor” flows sit squarely inside that guidance.

The written deliverable a CMO should demand is a current tracking inventory: every pixel, tag manager script, session-replay tool, chat widget, and call-tracking snippet deployed across the site, mapped to the vendor, the data fields transmitted, the legal basis, and the executed BAA or data processing agreement. Any agency that cannot produce this inventory within a week of the request is operating without one.

A parallel question covers non-HIPAA exposure. The FTC’s Health Breach Notification Rule reaches organizations and vendors outside HIPAA that maintain identifiable health information, including certain health apps, lead-form platforms, and call-tracking tools, with breach-notification duties to consumers, the FTC, and sometimes the media ⁹. Agencies should describe how they assess which of their tools fall under that rule and who notifies whom when a vendor is breached.

42 CFR Part 2 and the February 2026 Compliance Filter

The 2024 final rule modifying 42 CFR Part 2 became effective April 16, 2024, with compliance required by February 16, 2026 ⁷. That date is a live procurement filter. Any agency proposing to build CRM integrations, call-recording workflows, consent language, intake forms, or subcontractor data exports on a treatment center’s behalf should be able to describe what changed in the final rule and how its contracts and systems were updated for the compliance date.

The rule permits a single consent for future uses and disclosures for treatment, payment, and healthcare operations in specified circumstances, aligns certain breach-notification requirements with HIPAA, and adds patient rights concerning accounting and restrictions ⁷. The regulatory text also spells out what a written consent must identify, including the patient, the persons authorized to disclose, the information to be disclosed, and the recipients ⁸. Marketing systems that routinely copy information among CRMs, call platforms, analytics tools, and ad platforms are the friction point.

Two written artifacts settle the question quickly: a redlined MSA and DPA showing 2024-rule updates, and a consent-language sample the agency proposes to embed in intake forms and call scripts. Agencies still working from pre-2024 templates are asking the CMO to absorb their upgrade cost as regulatory risk.

FTC Substantiation, Testimonials, and Cure-Claim Exposure

The FTC’s Health Products Compliance Guidance states that health-related advertising claims must be truthful, nonmisleading, and supported by competent and reliable scientific evidence, and that advertisers cannot make through a testimonial or endorsement any claim that would be deceptive or unsupported if made directly. An honest testimonial does not eliminate the need to substantiate the underlying implied claim ³.

In March 2023, the FTC sued a medical clinic that allegedly claimed virtually every patient improved, including for illnesses considered incurable, and sought a $100,000 civil penalty; the resulting order barred similar unsupported claims ¹⁶. The mechanism was language, not medicine. Words like “cure,” “guaranteed,” “proven,” and “typical results” convert marketing copy into claims that require substantiation the agency likely did not gather.

The written compliance posture a CMO should require has three parts:

1. A claims-approval workflow that names who reviews ad copy, landing pages, and testimonial excerpts for substantiation, and what evidence file each approved claim points to.
2. A testimonial-consent process aligned with HIPAA authorization requirements ¹ and disclosure standards from the FTC guidance ³.
3. A takedown protocol for outdated or noncompliant copy, including archived pages, PDFs, and third-party syndication.

Agencies without those three artifacts are asking the CMO’s brand to underwrite their copywriting judgment.

What Each Recent FTC Action Should Force Into the RFP

Four FTC actions over four years have redrawn the diligence perimeter for behavioral-health marketing. Each one converts into a specific line item the RFP should require an agency to answer in writing.

R360, May 2022.

The FTC obtained a $3.8 million civil-penalty judgment against a treatment-referral network the agency alleged misrepresented how it evaluated and selected facilities, and described the case as its first action under OARFPA ¹⁷. The RFP question that follows: does the agency operate, resell, or receive compensation from any referral, directory, or lead-marketplace product, and how is paid placement distinguished from editorial ranking in every consumer-facing surface it touches?

The cure-claim clinic, March 2023.

The FTC alleged that a medical clinic claimed virtually every patient improved, including for illnesses considered incurable, and sought a $100,000 civil penalty; the order barred similar unsupported claims ¹⁶. The RFP question: who signs off on outcome language, guarantee language, and success-rate figures across ads, landing pages, and syndicated content, and what evidence file supports each approved claim?

Monument, April 2024.

A $2.5 million civil penalty, suspended based on inability to pay, followed allegations that behavioral-health user data was disclosed to advertising platforms through standard tracking technologies after users were promised confidentiality ⁵. The RFP question: produce a current inventory of every pixel, tag, chat widget, and audience upload on the site, mapped to the vendor, the data fields transmitted, and the executed agreement.

Evoke Wellness, June 2025.

A $1.9 million payment, a prohibition on using rivals’ names in search ads, and a required compliance program to monitor call centers ⁴. The RFP question: how does the agency prevent competitor-brand bidding, misleading ad copy, and unmonitored call-center scripts, and who reviews call recordings against those rules on a defined cadence?

Four cases, four RFP sections. An agency that cannot answer them line by line is asking the treatment center to price the risk instead.

OARFPA Exposure for Referral, Directory, and Lead-Gen Arrangements

The Opioid Addiction Recovery Fraud Prevention Act of 2018 gives the FTC authority to seek civil penalties for unfair or deceptive acts involving substance-use-disorder treatment services, referrals to treatment, or recovery housing ⁶. The statute reaches the referral layer directly, which is where most behavioral-health marketing arrangements accumulate quiet exposure.

Three arrangements should be surfaced before signature:

• Paid directory placements presented as objective quality rankings.
• Shared-lead marketplaces in which the same inbound call is sold to multiple facilities without clear disclosure.
• Call-transfer partnerships in which a third-party call center greets the caller under language that implies neutrality.

Each was a factual predicate in R360 ¹⁷.

The written deliverable is a compensation map: every referral, lead, or call source the agency proposes to use, the payment model, the disclosure language shown to the consumer, and the vetting criteria applied to any facility listed alongside the client’s own brand. Anything missing from that map is the CMO’s exposure, not the agency’s.

Supply-Chain Diligence and Named Accountability for Claims and Pixels

Most agency contracts describe the agency. Few describe the four or five vendors sitting behind it. NIST Special Publication 800-161 Revision 1, issued in November 2024, frames cybersecurity supply-chain risk management as the identification, assessment, and mitigation of risk across suppliers and service providers, integrated into the buyer’s own risk program ¹³. Translated into procurement terms: the treatment center owns the exposure created by every vendor its agency introduces.

Three documents settle the diligence question:

• A current subcontractor register listing every hosting provider, CRM, call-tracking platform, tag manager, analytics tool, chat vendor, email platform, and freelance contributor with production access, plus the data fields each one touches.
• A signed access matrix showing which named individuals at the agency and each subcontractor can read patient-adjacent data, and how access is revoked when staff turn over.
• An incident-response schedule with defined notification timelines to the treatment center, aligned with HIPAA breach rules and the FTC Health Breach Notification Rule for vendors outside HIPAA’s scope ⁹.

Content Review, Clinical Sign-Off, and Plain-Language Workflows

A publishing workflow without a clinician in it is a liability workflow. The FTC’s 2023 action against a clinic that claimed virtually every patient improved, including for conditions considered incurable, turned on language that a clinical reviewer would have flagged before it reached a landing page ¹⁶. The question is not whether the agency employs writers. It is who signs the copy before it ships.

The Office of Disease Prevention and Health Promotion’s Health Literacy Online guidance recommends short, direct content in plain language, important information first, specific action steps, and testing with actual users to confirm they understand and can act on what they read ¹². Applied to admissions funnels, that discipline is also a conversion discipline: forms that convert are forms readers finish.

Two artifacts document the workflow:

• A named editorial-review chain that includes a licensed clinical reviewer for any page discussing symptoms, diagnoses, medications, or outcomes, with the reviewer’s sign-off logged against the published version.
• A readability and user-testing protocol showing how intake pages, VOB forms, and treatment-description pages are tested before launch and revised on a defined cadence.