Auditing Health and Wellness Marketing Agencies: A Guide

Why the Standard Agency Scorecard Misses the Real Risk

Most quarterly business reviews between a treatment center and its marketing agency grade the wrong exam. Sessions are up, cost per lead is down, the ranking report is green — and none of that answers the question a general counsel or board member will ask when a regulator sends a letter: can the agency’s work survive an FTC inquiry, an HHS Office for Civil Rights investigation, or a board-level attribution challenge?

The federal record from the past three years reframes the audit brief. HHS OCR revised its tracking-technology bulletin in March 2024, keeping pixels, cookies, and session-recording tools inside the HIPAA risk-analysis perimeter ². The FTC’s Consumer Reviews and Testimonials Rule became fully effective October 21, 2024, adding civil-penalty exposure to alumni stories and Google review programs ⁴. The 42 CFR Part 2 final rule set a February 16, 2026 compliance date for how substance-use-disorder records move through intake, CRM, and case-study workflows ⁸. A scorecard built around traffic and lead volume simply does not test for any of this.

The rest of this guide replaces that scorecard with seven evidence domains tied to specific federal standards — and a scoring model weighted by regulatory severity and revenue impact, not by service line.

The Seven Federal Standards an Audit Must Test Against

A defensible audit anchors every finding to a specific federal source. Generic “best practices” collapse under legal review; citations survive it. The seven standards below form the regulatory perimeter for behavioral-health marketing and should sit at the top of the audit workbook as the scope map.

The FTC’s Health Products Compliance Guidance, revised in 2022, sets the substantiation baseline: objective health claims — direct or implied — require competent and reliable scientific evidence before publication, and the same discipline applies to testimonials and expert endorsements ¹. The HHS Office for Civil Rights tracking bulletin, revised March 18, 2024, keeps pixels, cookies, session-recording, and analytics tools inside the HIPAA risk-analysis perimeter and requires business-associate agreements where vendors receive protected health information ². The FTC’s Health Breach Notification Rule, updated by the 2024 amendments codified at 16 CFR Part 318, extends breach-notification duties to health apps, intake tools, and similar vendors that sit outside HIPAA, with notice generally required within 60 calendar days of discovery ^{3, 13}.

The FTC’s Consumer Reviews and Testimonials Rule, announced August 14, 2024 and fully effective October 21, 2024, adds civil-penalty exposure to fake reviews, insider reviews without disclosure, review suppression, and AI-generated testimonial content ⁴. The revised FTC Endorsement Guides, finalized June 2023, govern material-connection disclosures for influencers, clinicians, and alumni endorsers and extend liability to agencies acting as intermediaries ⁵. The 42 CFR Part 2 final rule became effective April 16, 2024, with a compliance deadline of February 16, 2026 for substance-use-disorder record handling across intake, CRM, and downstream marketing exports ⁸.

Audit each domain against its named artifact — the landing page, the pixel inventory, the vendor contract, the testimonial release, the endorsement disclosure, the intake consent form — not against a generic checklist.

Domain One: Claim Substantiation on Ads, Landing Pages, and Video

The first artifact the audit team should pull is the current-quarter ad inventory: every paid search headline, display creative, YouTube pre-roll, Meta static, and landing page the agency has published. Read each one against the FTC’s Health Products Compliance Guidance, which requires competent and reliable scientific evidence for objective health claims — direct or implied — before the ad ever runs ¹.

The implied claim is where most treatment center marketing quietly fails the standard. A detox landing page that opens with “85% of our clients complete treatment” makes a completion-rate claim that needs a documented denominator, cohort definition, and time window sitting in a file the agency can produce on request. A PPC headline promising “Lasting Recovery Starts Here” implies a durability claim about outcomes. A before-and-after alumni video, even without a spoken statistic, communicates typical results and inherits the same substantiation burden as a direct percentage ¹. The FTC’s guidance treats testimonials, expert endorsements, and representations about typical results with the same evidentiary discipline as a headline number ¹.

For each asset in the sample, the audit workbook should record five fields:

1. the claim as a consumer would read it,
2. whether the claim is express or implied,
3. the substantiation file the agency cites,
4. the qualifications of the person who reviewed that substantiation, and
5. the date the claim was last verified against source data.

Expect gaps. Common patterns include:

• success-rate figures inherited from a 2019 outcomes study whose methodology no one on the current team can describe,
• clinician credentials cited on a program page for a physician who left the medical group two years ago, and
• “evidence-based” language attached to modalities the facility does not actually deliver in that level of care.

Video carries the highest audit friction because claims are ambient — a voiceover, a chyron, a background testimonial — and rarely inventoried in the same spreadsheet as web copy. Pull the raw transcripts, not the marketing brief. Match each spoken or on-screen claim to a substantiation file the same way headlines are matched. Where a video mixes a real alumnus’s account with b-roll of clinical staff, the audit should flag whether the visual pairing implies a clinical outcome the endorser’s individual experience cannot support on its own ¹.

Domain Two: Tracking-Technology Governance and PHI-Equivalent Signals

The tracking audit starts with a script inventory pulled directly from the site’s rendered source, not from the tag manager’s admin view. Tag managers routinely show fewer scripts than actually fire, and the audit needs ground truth. For each URL in the sample — homepage, program pages, insurance verification form, chat widget, appointment scheduler, thank-you page — record every third-party script that loads, the vendor behind it, the data fields it transmits, and whether a business-associate agreement covers that vendor. HHS Office for Civil Rights is explicit that tracking technologies must be addressed inside the HIPAA risk-analysis process, and that vendors receiving protected health information require a BAA ².

The governance problem sits at specific pages. A Meta Pixel on a fentanyl detox program page transmits the URL, the referrer, and the IP address alongside a hashed user identifier — a combination OCR treats as capable of revealing that an individual is seeking treatment for a particular condition ². The same pixel on an insurance verification form can capture policy numbers, dates of birth, and diagnostic hints from field labels. A session-replay script on the intake page records keystrokes and hesitation patterns. Google Analytics 4, configured with default settings, sends IP addresses and full page paths to Google’s advertising infrastructure. Call-tracking platforms that record and transcribe inbound calls receive the caller’s spoken account of their substance use before an admissions coordinator ever picks up.

The BetterHelp order sets the risk benchmark. The FTC required a $7.8 million payment, banned the company from sharing health data for advertising, restricted retargeting audiences built from health-related activity, and imposed affirmative-consent requirements before any future health-data disclosure to third parties ⁷. The order is a consent settlement, not a judicial ruling on every allegation, but the remedies define what a regulator considers proportionate when questionnaire responses and IP addresses reach ad platforms. For a behavioral-health operator, the same fact pattern is easy to replicate: a Meta Pixel fires on a PHP program page, the visitor later sees a retargeting ad, and the audience definition itself now encodes a treatment-seeking signal.

For each script identified, the audit workbook should record the page, the vendor, the data transmitted, whether a BAA exists, whether the vendor’s contract addresses retargeting and audience-building limits, and the date consent was captured — if consent was captured at all. Flag every script that fires before a consent interaction. Flag every vendor without a signed BAA. Flag every retargeting audience whose membership condition is visiting a clinical-content URL. Those flags are the deliverable counsel needs to prioritize remediation.

Domain Three: Testimonial Integrity and Endorsement Disclosures

Testimonial risk in behavioral health sits at the intersection of two federal instruments: the revised FTC Endorsement Guides finalized in June 2023 ⁵and the Consumer Reviews and Testimonials Rule that became fully effective October 21, 2024, which added civil-penalty exposure for fake reviews, insider reviews without disclosure, review suppression, and AI-generated testimonial content ⁴. The audit team should pull three artifacts from the agency:

1. the full library of alumni videos and written stories in market,
2. the review-generation workflow (including any SMS or email templates sent post-discharge), and
3. the influencer or clinician-endorsement contracts active in the last twelve months.

For each alumni testimonial, record the endorser’s real name and consent-on-file status, the date of the recorded experience, whether compensation or in-kind benefits were provided, whether a material-connection disclosure appears clearly in the asset itself (not buried in a video description), and whether the story implies typical results. A single recovery account is a genuine individual experience — it is not, on its own, substantiation for what a reasonable prospective patient will experience ⁵. If the video’s edit pairs the alumnus’s account with success-rate voiceover or clinical b-roll, the audit should flag the implied typicality claim and require either substantiation or a clear disclosure of generally expected outcomes.

Review-generation programs need the same scrutiny.

• Flag any workflow that solicits reviews only from clients who rate their experience positively in an internal survey — that is textbook suppression under 16 CFR Part 465 ¹⁴.
• Flag employee or executive reviews posted without disclosure of the employment relationship.
• Flag any use of AI-generated testimonial copy attributed to a real or fictional patient.

The rule reaches advertisers, endorsers, and intermediaries, which explicitly includes the agency ⁵.

Domain Four: 42 CFR Part 2 Scope Across Intake, CRM, and Case Studies

Part 2 is the domain most agency audits skip because the records feel clinical, not marketing. That instinct is wrong. The 42 CFR Part 2 final rule became effective April 16, 2024, with a compliance deadline of February 16, 2026, and it protects records of a patient’s identity, diagnosis, prognosis, or treatment maintained in connection with federally assisted substance-use-disorder programs ⁸. Any marketing artifact that touches those records — or identifying information derived from them — sits inside the rule.

The audit team should walk five workflows end to end.

1. Intake forms and chat widgets: does the field schema capture SUD diagnosis, referral source, or prior treatment history that then syncs to a marketing CRM?
2. Call recordings and transcripts: does the call-tracking vendor route audio through a marketing analytics platform where an SUD disclosure becomes a searchable record?
3. CRM segments: are audiences built on program interest (opioid detox, alcohol residential) that identify individuals as SUD patients once a call or admission occurs?
4. Alumni case studies: does the release form meet Part 2’s consent specificity, or does it rely on a generic media waiver?
5. Reporting exports: do dashboards sent to the agency contain patient-level fields that qualify as Part 2 records?

Part 2 and HIPAA are not identical, and a workflow can satisfy one while violating the other ⁸. The audit’s deliverable is a workflow-by-workflow map showing where SUD identifiers enter marketing systems, which consent instrument authorizes each use, and what remediation the February 2026 deadline forces before the calendar closes.

Domain Five: Vendor Chain and Health Breach Notification Exposure

The vendor audit answers a question most agencies avoid: which parties in the marketing stack handle identifiable health information without the protection of a HIPAA business-associate agreement, and what happens when one of them suffers a breach? The FTC’s Health Breach Notification Rule reaches health apps, connected devices, intake tools, measurement vendors, and similar entities that fall outside a HIPAA-covered arrangement, and it generally requires notice to affected individuals and the FTC without unreasonable delay and no later than 60 calendar days after discovery ^{3, 13}.

Pull the current vendor list and sort it into three buckets:

• covered by HIPAA under a signed BAA,
• covered by the FTC rule as a non-HIPAA health-data handler, or
• covered by neither because the vendor genuinely receives no identifiable health information.

The third bucket should be small and defensible. Chatbot providers, quiz builders, intake widgets, symptom-screening tools, appointment schedulers, SMS platforms, and email service providers frequently sit in bucket two — and their standard contracts rarely name a 60-day notification obligation, a breach-discovery trigger, or a designated contact for FTC reporting ³.

For each vendor, the workbook should record the data fields received, the coverage bucket, the incident-response clause in the master services agreement, the retention schedule, and the subprocessor list. Contracts missing any of those four fields are the remediation queue counsel receives first.

Domain Six: Health-Literacy Quality on Service and Crisis Pages

AHRQ’s Health Literacy Universal Precautions Toolkit, third edition, published in March 2024, gives the audit team a working standard for whether a treatment center’s web content is understandable, actionable, and navigable for people making a treatment decision under stress ⁹. Readability alone is not the test — comprehension and next-step clarity are — but readability is the fastest way to surface pages that fail on their face.

Sample ten pages: the homepage, three program pages (detox, residential, PHP), the insurance verification page, the admissions or contact page, an alumni story, a blog post targeting a high-intent query, and any page that appears when a visitor types a crisis phrase. Score each on:

• reading grade,
• jargon density (words like “co-occurring,” “utilization review,” “medically supervised withdrawal” without plain-language equivalents),
• presence of a visible 988 or crisis instruction above the fold,
• next-step CTA specificity,
• form field count on the intake path, and
• language-access options.

A detox page written at a 14th-grade reading level, burying the phone number below three testimonial carousels, is a health-literacy failure regardless of its conversion rate.

The audit’s deliverable is a page-by-page remediation list ranked by traffic volume and crisis relevance — not a generic “simplify the copy” note the agency can defer indefinitely ⁹.

Domain Seven: Full-Funnel Attribution From Reach to Admission

Most agency dashboards stop three tiers short of the number the CFO cares about. The CDC’s evaluation profile for communication campaigns organizes measurement into a stack that begins with implementation and moves through reach, engagement, understanding, utilization, behavior change, and broader outcomes ¹⁰. Impressions and clicks belong to the first two tiers. Qualified admissions calls, completed assessments, verifications of benefits, and admissions belong to utilization and behavior change. Treating the two halves as interchangeable is how agencies get paid for activity that never touches census.

The audit team should start by pulling the last four quarterly reports and mapping every metric on every page to the tier it actually measures. Expect the top-of-stack tiers to be dense — impressions, sessions, click-through rate, video completion rate, follower growth, engagement rate — and the utilization and outcome tiers to be thin or missing. The CDC’s social-media job aid is the reference for testing metric definitions inside the top tiers: reach counts unique users exposed, impressions count total displays, engagements include likes, comments, shares, and clicks, and engagement rate is commonly calculated as engagements divided by reach ¹¹. Agencies that swap denominators between quarters, or report “engagement rate” against impressions one month and reach the next, are producing numbers the board cannot trend.

The harder audit question sits at the utilization tier. For each paid and organic channel, the workbook should record the qualified-call definition, the VOB completion count, the assessment-scheduled count, the admissions count, and the data source for each figure — call-tracking platform, CRM, EHR intake module, admissions log. Where the agency reports “leads” without a documented qualification criterion, or where admissions numbers appear only in aggregate without channel attribution, the audit’s finding is that the outcome tier is unmeasured, not that it is zero.

The CDC’s 2024 program evaluation framework closes the loop by requiring focused evaluation questions, defined indicators, documented data sources, and interpretation that accounts for context ¹². Applied here, that means the agency’s report should name what marketing contributed versus what admissions operations, payer mix, clinical capacity, and seasonal demand contributed — not claim credit for every admission that occurred during the reporting window. The audit’s deliverable is a single reconciliation showing which admissions the agency can defensibly claim, which it cannot, and which reporting gaps prevent the question from being answered at all.

Scoring the Audit: Weighting by Regulatory Severity and Revenue Impact

A flat checklist treats a missing alt tag and a Meta Pixel firing on a detox program page as equivalent findings. They are not. The scoring model should weight each finding across two axes: regulatory severity (civil-penalty exposure, enforcement precedent, consent-order remedies) and revenue impact (share of admissions the failure touches, remediation cost, timeline pressure).

Assign each finding a severity score of 1 to 5.

• Score 5 — Reserve for issues with named enforcement precedent: tracking scripts transmitting treatment-seeking signals to ad platforms without consent, given the BetterHelp remedies ⁷and the Monument action ⁶; testimonial workflows that suppress negative reviews under 16 CFR Part 465 ¹⁴; and SUD-record handling that will not meet the February 16, 2026 Part 2 deadline ⁸.
• Score 4 — Unsubstantiated outcome claims in market ¹and missing BAAs on vendors receiving PHI ².
• Score 3 — Undisclosed material connections ⁵and non-HIPAA vendor contracts missing 60-day breach clauses ^{3, 13}.

Multiply severity by a revenue-impact multiplier tied to the share of paid and organic admissions the failing artifact touches. A pixel on a single blog post scores differently than the same pixel on the insurance verification form. The output is a ranked remediation queue counsel and the CFO can defend — not a color-coded scorecard the agency can argue with line by line.

If You Operate Multiple Facilities: Scaling the Audit Across a Portfolio

The remainder of this section addresses multi-site operators — anyone running two or more licensed facilities under a shared or federated marketing function. The single-facility audit compresses into one workbook and one vendor stack. A portfolio audit does not, and treating it as a scaled-up version of the same review is how governance gaps hide inside brand-level rollups.

Three structural differences change the work.

1. First, artifact volume multiplies non-linearly: each facility carries its own program pages, Google Business Profiles, alumni libraries, review streams, and often a distinct call-tracking configuration inherited from an acquisition.
2. Second, vendor sprawl compounds — a portfolio that has grown by acquisition typically runs two or three CRMs, overlapping analytics properties, and pixel stacks that predate current governance.
3. Third, the Part 2 perimeter widens: SUD records may move between facility EHRs, a central admissions hub, and a shared marketing CRM under consent instruments that were never harmonized across the portfolio ⁸.

The audit scope should scale by tier rather than by headcount. The table below sets sampling depth, review cadence, and governance ownership for each operator size.

| Audit Domain | Single Facility | 2–5 Locations | 6+ Locations / Portfolio ||—|—|—|—|| Claim substantiation ¹| Full ad and landing-page inventory; annual review | Full inventory per site; semiannual review; central claim library | Sampled per site plus 100% review of shared brand claims; quarterly review; central claim library with facility-level exception log || Tracking governance ^{2, 7}| Full script inventory across all pages; annual | Full inventory per site; quarterly; single consent-management platform | Full inventory per site; quarterly; portfolio-wide CMP, unified tag standard, vendor allowlist || Testimonial integrity ^{4, 5}| Full library review; annual | Full review per site; semiannual; shared release template | Sampled per site plus 100% review of cross-brand assets; quarterly; central approval queue || Part 2 scope ⁸| Five-workflow walk; annual | Five-workflow walk per site; semiannual; harmonized consent form | Five-workflow walk per site plus inter-facility data-flow map; quarterly through February 2026 deadline || Health-literacy QA ⁹| Ten-page sample; annual | Ten-page sample per site; semiannual | Ten-page sample per site plus portfolio template audit; semiannual || Attribution modeling ^{10, 12}| Channel-to-admission reconciliation; quarterly | Per-site reconciliation plus portfolio roll-up; quarterly | Per-site reconciliation, portfolio roll-up, and cross-facility referral leakage analysis; monthly |

Governance ownership matters as much as cadence. In a single-facility operation, the CMO can hold the audit workbook directly. At two-to-five locations, a compliance-marketing liaison — often a director of marketing operations paired with the privacy officer — should own the artifact library and remediation queue. At six-plus locations, the portfolio needs a named marketing compliance function that reports into both the CMO and the general counsel, with facility-level marketing leads accountable for evidence production on a fixed cadence.

From Audit Findings to Agency Accountability

Build the accountability structure into the next master services agreement. Require the agency to produce substantiation files on 48-hour notice, maintain a current script and vendor inventory, sign a BAA where PHI is in scope, and report to the utilization and outcome tiers of the CDC evaluation stack — not just impressions and clicks ^{2, 10}. Agencies that cannot meet those terms have named themselves.