5 Steps to Vet a Health and Wellness Marketing Agency

The FTC’s Health Products Compliance Guidance sets the working standard: every health-related claim must be truthful, non-misleading, and supported by competent and reliable scientific evidence ¹. The guidance is explicit that reviewers first identify all claims the advertising communicates to a reasonable consumer, including implied ones, and holds marketers equally responsible for what a reader could reasonably infer ¹. That test applies whether the copy sits on a landing page for a residential program, a paid social ad for a wellness supplement sold into recovery communities, or a testimonial reel featuring an alumnus of a treatment center.

An agency that treats substantiation as a legal afterthought is a liability. During vetting, the marketing director should ask how the agency identifies implied claims before publication, what evidence tier it requires for outcome language such as recovery rates or symptom improvement, and how it documents that evidence in a file the compliance officer can pull. The FTC’s baseline advertising guidance reinforces the same rule across all channels: claims must be truthful, cannot be deceptive or unfair, and must be evidence-based ⁵.

The 2024 enforcement posture is not theoretical. The FTC has been sending warning letters to businesses marketing healthcare-related products and insurance plans, flagging misrepresented costs, deceptive endorsements, robocalls, and false affiliations with government programs ⁶. An agency that cannot describe its own warning-letter risk map, in plain language, has not done the work.

A substantiation audit produces documents, not adjectives. Before signing, the marketing director should request five artifacts from each shortlisted agency and score them against the FTC framework.

1. A sample substantiation file for a live client campaign, redacted as needed. The file should tie each outcome, clinical, or wellness claim to a specific citation, study, or internal data source, with the reasoning for why that evidence meets the competent and reliable scientific evidence standard ¹. Marketing copy without a matching evidence line is a gap.
2. An endorsement and testimonial disclosure log. The FTC guidance treats endorsements as claims by the advertiser and expects material connections, typicality of results, and disclosure adequacy to be documented ¹. Ask how the agency vets alumni testimonials from treatment programs, how it discloses paid influencer relationships, and whether it retains signed releases confirming the endorser’s experience is representative.
3. A claim-review workflow showing who reviews copy before it publishes, at what stage, and how disagreements are resolved between creative, legal, and clinical reviewers.
4. A warning-letter and correction log covering the past 24 months, including any FTC inquiries, platform ad rejections, or client-side legal escalations. An agency that has never been challenged has either not run enough volume or is not tracking.
5. A running training log confirming account and copy staff have current instruction on FTC health advertising standards and the December 2024 enforcement priorities on healthcare product marketing ⁶.

If any of the five documents does not exist in a form the agency can produce within a week, the substantiation function is informal. That is the finding to bring to procurement.

HIPAA’s marketing rule is narrower and stricter than most agency pitches assume. HHS guidance states that the Privacy Rule requires an individual’s written authorization before protected health information is used or disclosed for marketing, with only limited exceptions ¹⁰. The FAQs sharpen the point: authorization is required for uses or disclosures of PHI for all marketing communications except two circumstances, face-to-face communications between the covered entity and the individual, and promotional gifts of nominal value ¹¹. An email nurture sequence, a targeted paid social campaign, a telemarketing list, and a cross-sell of a wellness product to a former patient all fall outside those two exceptions.

The vetting question is whether the agency can articulate that framework without prompting. A marketing director should ask three things:

1. How does the agency distinguish a treatment communication, which HIPAA does not treat as marketing, from a promotional communication that requires authorization?
2. When a proposed campaign uses any patient-derived data, even a list of past inquiries or a segment of former admissions, what authorization language does the agency require the covered entity to have on file?
3. How does the agency document that authorization exists before a send goes live?

An agency that describes HIPAA as a general obligation of the client, rather than a workflow it enforces inside its own campaign approvals, has offloaded the risk. A behavioral health organization owns the covered-entity liability. The agency owns whether the campaign should have run at all.

The operational failure points sit in the plumbing between the agency’s ad platforms and the client’s data. A pixel firing on a treatment-program landing page, a custom audience built from CRM contacts, a lookalike model seeded with prior admissions, and a conversion API sending call events back to Google or Meta can each move PHI into a vendor environment that has no Business Associate Agreement in place.

Shortlist agencies should be asked to walk through, in writing, exactly which platforms touch identifiable data on behalf of the client and which BAAs cover those platforms. Meta and most standard ad networks do not sign BAAs for health data. If the agency proposes uploading a hashed email list of prior patients into a custom audience, that is a marketing use of PHI under HHS guidance and requires written authorization from each person on the list ¹⁰. Hashing does not remove the HIPAA problem, because the covered entity still directed the disclosure.

Three artifacts settle the question during procurement:

• A current BAA between the agency and the covered entity, and BAAs between the agency and any subprocessor that will handle identifiable data.
• A written data-flow diagram naming every system a lead or patient identifier passes through, from form fill to CRM to ad platform.
• A retargeting policy that specifies which pages, events, and audiences can and cannot be used to build audiences.

If any of the three is missing, the agency is running campaigns on the client’s compliance risk.

Compensation is where marketing arrangements most often collide with federal fraud and abuse law. The Anti-Kickback Statute reaches any remuneration knowingly offered or received to induce referrals for items or services reimbursable by a federal health care program, and payments tied to the volume or value of referrals are the classic pattern courts and enforcers flag ⁴. A per-admission fee to a marketing vendor for a Medicare, Medicaid, TRICARE, or federally funded SUD patient is the textbook case. A per-lead fee that reliably converts into admissions can carry the same exposure depending on how the arrangement is structured and documented.

OIG Advisory Opinion 21-20 illustrates how carefully the agency parses these arrangements. The opinion analyzed an online health platform selling advertising to healthcare and non-healthcare companies and noted that selling advertising to health care advertisers could generate prohibited remuneration under the AKS if the requisite intent were present, though OIG declined to impose sanctions because of specific safeguards the requestor had built in, including restrictions on which providers could advertise ². The takeaway for a marketing director is not that advertising is safe or unsafe in the abstract. It is that structure and intent determine exposure, and structure has to be documented before a campaign runs, not reconstructed after a subpoena.

During vetting, the marketing director should ask each agency how it prices behavioral health work, whether any deliverable is measured or invoiced against admissions, calls transferred to intake, or insurance-verified inquiries, and how the agency’s counsel has evaluated that model against AKS.

Three compensation models dominate behavioral health marketing procurement, and their AKS risk postures are not equivalent. The comparison below maps each to the doctrinal frame in OIG Advisory Opinion 21-20 and the law review analysis of marketing arrangements under the Anti-Kickback Statute ^{2, 4}.

Federal rules set the floor. Professional ethics codes sit above them, and any campaign that touches physicians, psychologists, or licensed therapists inherits those standards whether the agency knows it or not. AMA Opinion 9.6.1 states that a physician’s advertisement should be determined in advance to be explicitly and implicitly truthful and not misleading, and that claims require a reasonable evidence basis ⁷. That obligation runs to the physician on the ad, not the agency that produced it, which is precisely why the agency needs to catch problems before the medical director sees them in a licensure complaint.

Psychotherapy adds a second layer. The APA ethics standards analyzed in the peer-reviewed literature require accuracy in public statements about services, fees, and credentials, and prohibit deceptive business practices, with particular scrutiny of aggressive discount offers and outcome claims that overstate what psychotherapy can deliver ⁹. A landing page that promises measurable symptom reduction, a testimonial reel implying typical alumni outcomes, or a paid ad advertising licensed clinicians who are actually associates in supervision each carry ethics exposure the licensing board will read differently than the FTC.

Two vetting questions surface fluency. How does the agency verify licensure, credentials, and scope of practice before naming a clinician in copy? And how does it distinguish aspirational marketing language from outcome claims that a state board would treat as misleading? An agency without answers is drafting complaints, not campaigns.

Any behavioral health organization promoting medication-assisted treatment, psychiatric prescribing services, or co-marketing with a pharmaceutical partner enters FDA territory the moment the copy names a prescription product. The FDA’s draft guidance on character-limited platforms is explicit: prescription drug advertisements must present a fair balance between information relating to risk and information relating to benefit ¹². Fair balance does not survive a 280-character post or a 15-second short-form video by accident. It has to be designed in.

Two failure patterns show up in vetting:

• Short-form social content that names a medication or drug class alongside a benefit claim without prominent risk disclosure in the same field of view, which the FDA guidance treats as a fair balance failure regardless of whether risk information sits behind a link ¹².
• Sponsored content aimed at prescribers, including anything that mimics the embedded promotional formats the AMA has opposed inside EHRs and clinical software ⁸.

Agencies proposing prescriber-targeted native placements should be able to describe how their creative meets AMA advertising guidelines and how risk information holds prominence on each platform. If the answer is a hedge, the campaign belongs off the roadmap.