What to Look for in a Healthcare Digital Marketing Agency

The four failure points that separate specialists from generalists

Most agency shortlists are flawed. A CMO often sees a creative reel, a case study with a ranking chart, and a promise to lower cost per admission. However, this approach often overlooks where generalist agencies fail treatment centers. The failures occur where healthcare marketing intersects with federal enforcement, professional ethics, and the realities of admissions teams.

These failure points are consistent across enforcement records and critiques of health advertising. The four recurring failure points are:

• First, tracking and consent — how pixels, tag managers, and analytics vendors handle data that the Federal Trade Commission (FTC) now considers health information, even if it doesn’t touch an Electronic Health Record (EHR) ¹.
• Second, claims substantiation — outcome language and success rates must be backed by competent and reliable scientific evidence before appearing in paid ads ¹⁴.
• Third, the ethics of targeting individuals in acute crisis states, which peer-reviewed work identifies as a distinct concern from legal compliance ⁶.
• Fourth, whether the content strategy actually produces qualified admissions calls or merely generates promotional volume that looks like activity on a dashboard ⁷.

Each of these areas highlights how a generalist agency, applying tactics from e-commerce or SaaS, can introduce liability or waste in behavioral health. This article frames agency selection as a procurement decision focused on these four failures: identifying specific mistakes to avoid, the documentation a qualified vendor should provide, and the reporting metrics that offer a defensible scorecard beyond impressions and rankings. Value-driven, patient-centered marketing is a fundamental expectation for the industry, not a mere differentiator ⁴.

Mistake one: treating tracking and consent as an IT problem instead of a marketing decision

When a Meta Pixel, a Google Ads tag, or a third-party session replay tool is placed on a treatment center’s assessment page, many CMOs defer to IT or legal. This delegation is a mistake. The FTC has clarified that deciding which pixels fire, on which pages, and under what consent state is a marketing decision with direct enforcement implications. The agency now considers a broader range of data as health information than most agency proposals acknowledge.

The FTC’s joint guidance with HHS on consumer health information details this. While HIPAA governs protected health information held by covered entities and their business associates, the FTC Act and the Health Breach Notification Rule have a wider reach. The FTC defines health information to include inferences from browsing history, location signals, and search behavior, not just diagnoses or medical record numbers ¹. For example, a visitor landing on a fentanyl detox page from a paid search ad generates data that the agency now considers sensitive.

Enforcement actions against companies like BetterHelp, GoodRx, and Premom demonstrate the consequences. Disclosing consumer health information to advertisers without affirmative express consent can be deemed an unfair practice under the FTC Act, even if HIPAA doesn’t strictly apply ¹. These companies did not argue intent to harm; they argued their tracking methods were standard. The agency’s stance was that “standard” is not sufficient.

During agency evaluation, this means a qualified vendor should provide a documented approach to which tags load pre-consent versus post-consent, how conversion events are hashed or aggregated before leaving the site, and whether server-side tagging is used to strip identifiers before data reaches ad platforms. They should be able to name their consent management platform, explain its handling of Global Privacy Control signals, and present a data flow diagram for the admissions funnel, from paid click to call tracking to CRM.

Agencies unable to provide such documentation often default to retail practices: firing every pixel, capturing every event, and optimizing for the richest available signal. In behavioral health, this approach creates exposure under the Health Breach Notification Rule and can become a HIPAA issue if data passes through systems the center considers covered ¹.

Mistake two: accepting outcome claims and success rates without substantiation files

Treatment centers often feel pressure to communicate positive outcomes. Marketing teams push for differentiation, and agencies, especially those from a performance-marketing background, tend to agree. This agreement is the second failure point. The FTC’s 2022 Health Products Compliance Guidance mandates that any claim about a health-related product or service must be supported by competent and reliable scientific evidence before appearing in an ad, on a landing page, or in a testimonial ¹⁴.

“carefully review the support for each claim to make sure it is scientifically sound, adequate in the context of the surrounding body of evidence, and relevant to the specific product and advertising claim”

The American Medical Association’s (AMA) guidance on direct-to-consumer promotion reinforces this discipline from an ethical standpoint. Health advertising should be disease-specific, enhance patient education, and avoid encouraging self-diagnosis or unrealistic expectations ⁹. A qualified agency understands the difference between describing a level of care and implying a guaranteed result, a distinction evident in their copy.

CMOs should require a substantiation file for every outcome-related claim an agency proposes. This file should identify the underlying data source, sample and time period, measurement method, and internal reviewer approval. It must exist before an ad goes live. Agencies that resist this workflow, arguing it slows creative or that competitors are more aggressive, are adopting a posture that leads to state attorney general actions and FTC consent orders.

Truthful representation also extends to credentialing. The AMA explicitly states that healthcare professionals must clearly communicate their licensure and certification to patients, an obligation that applies to every marketing surface an agency touches ¹⁰. If a landing page implies medical supervision, the medical director’s credentials should be verifiable on that page. If an ad references clinicians, their license type and state of practice should be in the copy or easily accessible.

Operationally, this translates to a contract clause. The scope of work should require substantiation documentation for all performance, outcome, satisfaction, or success claims drafted by the agency, retained for the campaign’s duration plus a defined period. Copy that cannot be substantiated should not run. This is the standard the FTC applies during investigations, and it is the standard a competent agency applies proactively.

Mistake three: micro-targeting people in acute crisis states

The third failure point is challenging to formalize in a contract because it exists in the ethical gray area between what is legal and what is defensible. Behavioral targeting is effective; a person searching “how to detox at home safely” at 2 a.m. is, in performance-marketing terms, a highly qualified prospect. This effectiveness is precisely why the ethical dilemma arises.

Peer-reviewed research on online health advertising has directly highlighted this issue. Micro-targeting individuals during acute health crises raises ethical concerns beyond privacy law, especially when ad creative implies guaranteed relief or exploits the cognitive narrowing associated with withdrawal, suicidal ideation, or relapse ⁶. The study frames this concern in terms of autonomy and justice: personalization that is acceptable for consumer products becomes coercive when the audience is in a state that impairs their judgment.

Generalist agencies often do not consider these ethical dimensions. Their optimization prioritizes the cheapest conversion, which in behavioral health often means targeting the most vulnerable individuals. This leads to creative that uses urgency triggers—”available now,” “insurance verified in minutes,” “beds open tonight”—combined with audience segments built from symptom-related queries. This combination has been used by state attorneys general as evidence in deceptive-practice actions against rehab marketers and is flagged by LegitScript reviewers during recertification.

The AMA’s guidance on health promotion sets a contrasting standard. Advertising should be disease-specific, educate patients, and avoid prompting self-diagnosis or unrealistic expectations ⁹. For paid search and social, this means creative should be reviewed to ensure it informs decisions rather than short-circuiting them, and audience segments should be built around information needs, not emotional vulnerability.

CMOs evaluating agencies should request to see the ad review checklist applied before a campaign launches. A qualified vendor will have one that addresses urgency language, outcome implications, and the audience states the creative targets. Agencies that promote crisis targeting as an advantage, rather than a category they actively restrict, are describing a posture that increases enforcement risk and generates admissions calls that do not convert to enrolled patients.

Mistake four: mistaking promotional volume for admissions conversion

The fourth failure is often felt first by CMOs but diagnosed last. An agency might report strong metrics—increased impressions, followers, session counts, and improved keyword positions—while admissions volume remains flat or declines. The initial pitch promised a content strategy, but what was delivered was promotional volume disguised as content.

This distinction is crucial. A study on social media marketing by mental health services found that posts focusing on mental health education and coping strategies generated higher engagement than direct service promotions ⁷. This indicates the value of “information‑focused rather than persuasion‑focused” content. The research specifically analyzed content and engagement patterns within mental health service accounts, not the broader consumer market, and the engagement lift was consistent. For behavioral health, audiences are more likely to engage with content that educates on topics like withdrawal timelines, family dynamics, insurance mechanics, and levels of care, rather than direct sales pitches.

This finding aligns with what admissions directors observe during intake calls. Prospects who have read substantive explanations of medication-assisted treatment or accurate descriptions of the first 72 hours of residential care ask more informed questions and qualify at higher rates. Conversely, prospects from ads promising “beds available now” often do not meet clinical criteria, lack workable insurance, or are simultaneously contacting multiple facilities. Both scenarios might register as conversions on a dashboard, but only one leads to an actual admission.

“patients may have difficulty understanding whether a center meets their needs”

During evaluation, CMOs should require a content plan linked to admissions taxonomy, not just keyword volume. This plan should identify the clinical questions prospects ask before calling, the level-of-care decisions the content aims to inform, and the qualification signals each asset is measured against. Reporting should track qualified call rate and cost per admission by content cluster, rather than sessions by URL. Agencies that resist this framework, insisting that reach and rank are primary indicators, are operating as media buyers, not healthcare content strategists ⁴. The subsequent scorecard section provides concrete replacement metrics.

The compliance artifact packet a qualified agency produces on request

Selection risk significantly decreases when CMOs shift from asking agencies about HIPAA knowledge to requesting specific compliance documents. Compliance posture is either demonstrable or absent. A specialist vendor can typically produce a defined packet within a business day; a generalist will struggle to assemble one, which itself is an answer.

The packet typically includes a business associate agreement (BAA) that the agency can execute as written, or a redlined version detailing negotiated terms and justifications. HHS explicitly states that the Privacy Rule’s restrictions on using or disclosing protected health information (PHI) for marketing extend to any third party handling that data, with BAAs serving as the mechanism to bind these obligations ¹³. An agency that treats the BAA as boilerplate or refuses to sign one disqualifies itself from any workflow involving PHI, including call tracking, CRM synchronization, and lead nurture emails.

“expressly requires an authorization for uses or disclosures of protected health information for ALL marketing communications, except in two circumstances”

The third artifact is a data flow diagram covering the entire admissions funnel: paid click, landing page, form submission, call tracking, CRM, email platform, and ad platform conversion API. Each node should be labeled with the data types passing through it, the vendors involved, and the required consent state. This document addresses the tracking mistake discussed earlier and is often something generalist agencies cannot produce because they have never mapped it.

The fourth is a claims substantiation log. This log should list every outcome, success, satisfaction, or credentialing claim in current or proposed creative, matched to its evidence source, internal reviewer, and retention date. The FTC standard requires competent and reliable scientific evidence before a health claim runs ¹⁴. The log demonstrates an agency’s proactive application of this standard.

The fifth is a creative review checklist. This checklist should cover urgency language, self-diagnosis prompts, credentialing disclosure, and risk balance, especially when FDA-regulated products or medications for opioid use disorder appear in the copy, drawing on FDA expectations for prominent, proximate risk information in consumer-directed promotion ³. Request this packet before signing. Agencies that can readily provide it are prepared; those that cannot are asking the CMO to assume their compliance responsibilities.

Scoring the shortlist: cost per admission, qualified call rate, and artifact completeness

Once a few agencies have passed the compliance packet review, the shortlist becomes a scoring exercise. A common mistake CMOs make is applying scorecards used for other vendors—focused on impressions, keyword positions, cost per click, or share of voice—and asking agencies to project these numbers. This approach incentivizes the wrong behaviors and often requires a complete overhaul six months into an engagement.

Three metrics should be prioritized and weighted heavily:

1. First, cost per admission, calculated as total agency-attributable spend (retainer, paid media, tracked production costs) divided by admitted patients sourced through agency channels over a defined lookback window. This metric replaces cost per lead as the primary indicator because it forces the agency to focus on post-call outcomes.
2. Second, qualified call rate—the percentage of tracked inbound calls that meet the admissions team’s qualification criteria, scored by the intake team, not the agency. This replaces landing page conversion rates by isolating lead quality from form-fill volume.
3. Third, artifact completeness, scored against the compliance packet: executed BAA, current authorization matrix, accurate data flow diagram, maintained substantiation log, and applied creative review checklist. Missing artifacts should receive a zero score.

Secondary metrics can provide additional context without overwhelming the scorecard. These include content assets tied to admissions taxonomy rather than keyword volume, and site readability at a grade level appropriate for the audience. The community health center analysis highlighted significant variability in how clearly services and eligibility were described ⁵, a diagnostic CMOs can apply to an agency’s past work. Response time on compliance questions, measured in hours, and account team turnover are also relevant.

Scoring should occur quarterly, not just at contract renewal. Agencies that resist quarterly reviews of these top three metrics are likely protecting aspects of the engagement that cannot withstand scrutiny. Those that welcome it are the ones worth retaining.

If you manage a multi-site portfolio: consolidation math without invented benchmarks

For CMOs and marketing VPs managing three or more facilities, or a private-equity-backed portfolio with shared services, the agency selection question changes. While the scorecard from the previous section still applies at the facility level, the procurement decision shifts to a higher level: whether fragmented agency relationships across sites yield better admissions economics than a single specialist partner operating under one governance structure.

This calculation should use variables the portfolio already tracks, rather than relying on industry averages that lack defensible data. Four key inputs drive this decision:

• Blended cost per admission across all sites, weighted by admission volume;
• Qualified call rate variance between the highest and lowest performing sites;
• Total agency retainer spend across all vendors, including facility-level line items;
• Paid media spend by facility, flagging duplicate keyword bidding where facilities in the same market share an agency-managed account or, worse, operate independently.

Fragmentation often conceals three types of costs:

• First, duplicate compliance overhead, where each agency requires its own BAA review, substantiation workflow, and creative review cycle, multiplied by the number of vendors ¹³.
• Second, inconsistent tracking architecture across sites, which compromises portfolio-level attribution and creates variable exposure under the FTC’s expanded definition of health information ¹.
• Third, unmanaged intra-portfolio competition in shared media markets, where two facilities might bid against each other on the same terms.

Consolidation is not always the optimal solution. While a single specialist partner can reduce governance load and standardize the compliance packet, it also concentrates execution risk on one account team. A defensible decision involves running the numbers for both fragmented and consolidated structures against the same three top-line metrics—blended cost per admission, qualified call rate, and artifact completeness—and selecting the option that scores higher, rather than simply defaulting to the incumbent’s recommendation.