Choosing Health Care Marketing Companies for Admissions

What the Anti-Kickback Statute Actually Reaches

The federal Anti-Kickback Statute (AKS) criminalizes knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or reward referrals for services reimbursable by a federal healthcare program ³². Key terms are “remuneration” and “induce.” The OIG defines remuneration broadly as anything of value, whether direct or indirect, overt or covert, in cash or in kind ¹². This can include per-admit bonuses, per-VOB incentives, gift cards, paid trips, or overpriced leased call lines.

Intent is also crucial. OIG analyses consider compensation structures suspect if at least one purpose of the payment is to induce referrals for federally reimbursable care ¹¹. This includes programs with Medicaid, TRICARE, Medicare Advantage, or dual-eligible payer mixes. For a CMO, this means an agency’s payment structure is a compliance issue, not just a procurement preference. Two agencies offering identical services could present vastly different risk profiles based on whether their fees fluctuate with admissions volume.

Contract Language That Should Stop a Signature

DOJ’s 2025 case summaries detail instances where executives allegedly paid “body brokers” through disguised marketing-services agreements ¹⁰. This pattern serves as a template for screening agency contracts. Before legal review, a contract should be flagged if it contains any of the following:

• Fees tied to “per qualified admission,” “per confirmed VOB,” “per enrolled patient,” or bonuses that increase with census.
• Deliverables defined by outcomes the agency cannot directly control, such as beds filled, insurance verification, or patient retention beyond 30 days.
• Payment linked to “warm transfers,” “exclusive call routing,” or minimum call quotas from an unnamed third-party call center.
• Vague descriptions of subcontractor networks, aggregator sites, or “partner directories” that supply leads.
• Non-solicitation clauses that imply the agency, rather than the treatment center, dictates where a caller ultimately receives care.

A compliant agreement pays for specific marketing work—content creation, media buying, analytics, creative development, technical SEO—at fair market value, independent of admission numbers. If an agency resists this structure during negotiations, it indicates a fundamental diligence failure.

If you manage multiple facilities: comparing fee structures across a portfolio

This section is primarily for multi-facility and multi-state operators consolidating agency spend. Single-site operators may find it less relevant.

For a portfolio of facilities, minor differences in fee structures can lead to significant cumulative risk. A per-admit fee that seems acceptable for one facility can become a systemic liability across ten, especially if the same contract language applies to each location’s federal payer mix. The DOJ’s Sober Homes Initiative has prosecuted 27 defendants involved in over $1 billion in alleged false billings, targeting patient recruiters, facility operators, and lead brokers ⁷. A 2024 conviction in California involved nearly $2.9 million in illegal kickbacks paid for referrals to addiction-treatment facilities ⁸. Portfolio operators should anticipate increased enforcement scrutiny proportional to their operational footprint.

The following matrix uses variables to allow CFOs to input actual retainer costs, cost per qualified call, VOB-to-admit rates, and cost per admit for each facility.

Marketing Authorization, Business Associates, and Part 2 Overlap

HIPAA’s marketing rule is more stringent than many agencies suggest. HHS generally requires prior written authorization from individuals for marketing communications that use or disclose PHI, with limited exceptions ¹⁸. An agency proposing to build lookalike audiences from past admissions, send email sequences to previous inquirers, or provide a call-center vendor with names and phone numbers is operating under this rule, regardless of how the contract labels the activity.

The business associate question is also critical. A covered entity typically cannot share PHI with a telemarketer or third-party campaign vendor without written authorization, unless the vendor functions as a business associate for a communication not considered marketing under the rule ¹⁹. A signed Business Associate Agreement (BAA) alone does not authorize marketing uses of PHI; it only defines permitted service uses, safeguards, and breach obligations.

For SUD programs, 42 CFR Part 2 supersedes HIPAA. Part 2 applies to federally assisted programs providing SUD diagnosis, treatment, or referral for treatment, with a compliance date of February 16, 2026 ²⁹. When both frameworks apply, the more protective Part 2 rules govern, and HIPAA permissions do not override them ³³. This means an agency handling intake forms, call recordings, CRM records, or admissions status data is subject to Part 2’s consent, redisclosure, and prohibition-on-use-in-legal-proceedings requirements, not just HIPAA. A qualified partner will proactively identify these three frameworks and map each data flow to its corresponding authorization.

Pixels, Call Tracking, and What the OCR Bulletin Changed

The OCR’s tracking-technology bulletin significantly altered how standard marketing stacks are viewed. HIPAA applies when information collected via tracking technologies or disclosed to tracking vendors includes PHI. Regulated entities must configure these technologies to use and disclose PHI only as permitted and secure electronic PHI accordingly ³⁰. This includes a Meta pixel on an “verify insurance” page, a Google Ads conversion tag on a thank-you URL containing a program name, or a session-replay tool recording an intake form, all of which can transmit qualifying information.

Call tracking falls into the same category. Dynamic number insertion, keyword-level attribution, and third-party call recording transmit caller identifiers and the fact of an SUD-treatment inquiry to a vendor. Under Part 2, the mere fact that a person contacted a covered program is protected ²⁹. Separately, the FTC has indicated that consumer health information can create privacy, security, consent, retention, and deception risks even outside HIPAA’s scope ¹⁵.

Operationally, an agency must provide a written data-flow inventory covering pixels, tags, call tracking, chat, forms, and CRM syncs. This inventory should identify which vendors receive which data fields on which pages, include BAAs where PHI is shared with a vendor, and document server-side or aggregation controls used to strip identifiers before data leaves the covered entity’s environment. An agency unable to produce this inventory during diligence will not be able to do so after a breach.

Ad Ownership, Landing-Page Identity, and Call Routing After Mercury Marketing

The FTC’s June 2025 complaint against Mercury Marketing alleged that the defendants ran deceptive search ads impersonating SUD clinics and rerouted consumers to their own facilities ³¹. This case sets the standard for diligence questions a CMO must ask before an agency manages any paid search advertising.

Every ad-integrity review should cover three key areas:

1. Ad account ownership: Google Ads and Meta Ads accounts must be owned by the treatment center, with the agency granted managed access. Ownership dictates control over keywords, negative-keyword lists, ad copy, and the authority to remove ads if complaints arise.
2. Landing-page identity: the destination URL, headline, provider name, address, and phone number must precisely match the advertised entity. Bidding on a competitor’s brand and redirecting clicks to an unrelated facility was the specific conduct challenged by the FTC.
3. Call routing: dynamic number insertion, warm transfers, and any third-party call center involved must be documented. Callers must reach the advertised program directly, without being redirected to other facilities based on referral fees.

An agency that cannot provide a written ad-account access log, a landing-page-to-ad matching audit, and a call-routing diagram is not prepared to manage paid media in this sector.

Success-Rate Claims, Testimonials, and Endorsement Disclosure

FTC guidance mandates that objective health-benefit claims be supported by competent and reliable scientific evidence, and anecdotal consumer experiences alone are insufficient to substantiate health-effect claims ¹⁶. This standard directly impacts common claims found on treatment center homepages, such as “85% success rate,” “proven outcomes,” or “evidence-based” positioning, especially when these lack defined outcome measures, follow-up windows, or clear denominators.

Endorsement rules add another layer of scrutiny. FTC guidance warns that unrepresentative testimonials can mislead consumers unless accompanied by information describing typical results. Additionally, material connections between endorsers and marketers must be disclosed ¹⁷. This means a former patient in a video, a clinician quoted in a case study, or a paid influencer sharing a recovery story each have distinct consent, authenticity, and disclosure requirements.

An agency creating content in this category must maintain a substantiation file for every objective claim, written consent and release documentation for every patient story, and disclosure language for every material connection. If these files do not exist, the claim should be removed before the campaign launches.

Referral Sources the Digital Dashboard Never Sees

Most agency reports focus on what they can measure, but the actual admissions pipeline is much broader. SAMHSA’s 2024 TEDS report, which tracked approximately 1.58 million SUD treatment admissions, shows that among those with a known referral source:

• 50.4% came from the client or friends and family
• 24.6% from criminal justice or DUI channels
• 9.4% from other SUD-care providers
• 6.6% from other healthcare providers ¹

While TEDS counts episodes, not unique clients, and coverage varies, this data consistently illustrates the diverse referral landscape.

Operationally, a dashboard reporting paid search, organic, and social conversions only captures a segment of self-referrals where individuals or family members initiated a digital search. It does not account for referrals from drug court coordinators, emergency department social workers, or primary care physicians. An agency that relies solely on digital-attributed calls will likely overspend on lower-intent digital touchpoints and underinvest in assets—such as provider-facing collateral, referral portals, and community outreach content—that drive larger referral channels.

Agencies should be required to reconcile their reported calls with the intake team’s referral-source coding. The resulting gap provides an honest assessment of what marketing efforts are not yet capturing.

Intermediate KPIs vs. Outcome KPIs

Calls, forms, and verified benefits are not admissions. These are intermediate signals that correlate with actual outcomes only to the extent permitted by the intake process, clinical fit criteria, and payer mix. Treating them as terminal metrics can inflate marketing budgets without increasing census.

Evidence on digital engagement supports this caution. A systematic review of digital interventions aimed at increasing readiness for psychological therapy found that only 7 out of 16 studies (44%) measuring actual behavior showed effectiveness compared to controls ²⁵. While these studies were not SUD marketing campaigns, the principle holds: exposure and engagement do not reliably predict downstream action, nor does a submitted form.

A robust measurement framework distinguishes between two layers:

Intermediate KPIs

qualified call volume, form-completion rate, VOB completion rate, and cost per qualified call—essential for weekly operational reviews to diagnose channel and creative performance.

Outcome KPIs

admissions attributable to a source, cost per admit, VOB-to-admit conversion, and 30-day retention (where lawful to report)—crucial for quarterly board reviews, as they measure whether marketing genuinely increased census, not just activity.

AHRQ’s patient-engagement framework offers useful terminology for the intermediate layer, such as task completion and user-reported usability, adapted for intake journeys ²⁶. An agency that reports only intermediate metrics is essentially asking to be paid for activity rather than results.