Evaluating a Marketing Agency for Healthcare Providers

Ready to See Results?

From strategy to execution, we turn underperforming campaigns into measurable wins. Let’s put our expertise to work for your business.

Key Takeaways

Treat agency selection as risk-adjusted growth diligence, screening for HIPAA fluency, FTC substantiation discipline, and tracking-pixel hygiene before evaluating creative, channels, or pricing ^{6, 4}.
Require a written data-flow inventory, a Business Associate Agreement, and a claim-substantiation log pairing every outcome assertion to source data, cohort, and methodology ^{6, 1}.
Judge channel strategy by trust hierarchy rather than cost-per-click: paid search captures urgency, organic and clinician-facing channels build the authority families verify before calling ¹⁰.
Focus next on a three-week diligence sequence—documentation, creative and channel review, then economics—with location-level attribution and branded-search isolation built into reporting ^{7, 1}.

The Real Stakes Behind an Agency Decision in Behavioral Health

Choosing a marketing agency is one of the few operating decisions that can move census in either direction within a single quarter. The upside is well understood: more qualified inquiries, lower cost per admission, steadier utilization. The downside gets less attention. A campaign that overstates outcomes, mishandles a tracking pixel, or sources testimonials without the right disclosures can convert a growth investment into an enforcement file.

The regulatory floor has risen sharply. In December 2022, the FTC issued its first comprehensive update to health-products advertising guidance in nearly 25 years, signaling tighter scrutiny of outcome claims, endorsements, and implied benefits across health services ⁴. HIPAA, separately, restricts most uses of protected health information for marketing without written patient authorization, and the rule reaches every vendor that touches that data ⁶. An agency that does not operate fluently inside both frameworks is not a growth partner. It is a liability the operator absorbs.

Treatment center owners already carry clinical, payer, and accreditation risk. Adding advertising and privacy exposure on top is a poor trade for incremental calls. The sections that follow treat agency evaluation as risk-adjusted growth diligence: which compliance filters disqualify a partner outright, how outcome claims should be substantiated before they ever reach a landing page, what channel mix matches how patients actually decide, and which economic signals reveal whether an agency can sustain admissions without inflating downstream cost.

Compliance as the First Filter, Not the Last Check

HIPAA Marketing Rules That Disqualify Most Generalist Agencies

The HIPAA Privacy Rule treats most uses of protected health information for marketing as off-limits without written patient authorization. The exceptions are narrow: face-to-face communications, promotional gifts of nominal value, and communications that qualify as treatment or health care operations rather than marketing ⁶. This distinction can be challenging in practice. For example, an email to past patients promoting a new IOP track is considered marketing and requires authorization, while a relapse-prevention message tied to an active treatment plan is considered operations and is exempt. Generalist agencies routinely miss this distinction.

The rule also prohibits selling PHI lists to third parties for their own promotional use without explicit consent from each individual ⁷. Treatment center owners should interpret this broadly. Sharing a discharge list with a partner facility for a referral campaign, handing alumni contacts to a sober-living vendor, or piping admissions data into a third-party ad platform without authorization can each trigger a violation. The agency does not have to be the entity that gains commercially; the transmission itself is the regulated event.

HIPAA marketing decision logic: when patient authorization is required versus when treatment and operations exceptions apply ⁶.

Three operational filters can disqualify most generalist agencies:

Ask how the agency distinguishes marketing from treatment communications in a written policy.
Inquire which campaign types in their proposal would require patient authorization under the Privacy Rule and how that authorization is collected, stored, and revoked.
Ask whether they have ever declined a client request because it would have required PHI use without authorization.

An agency that cannot provide clear answers to these questions is likely operating on the assumption that enforcement is unlikely, rather than on compliance with the rule.

Visualize the decision logic for when HIPAA patient authorization is required versus when treatment and operations exceptions apply, directly supporting the section's explanation of these distinctions

Tracking Pixels, Wellness Apps, and the FTC Layer Beyond HIPAA

Privacy exposure extends beyond HIPAA. The FTC asserts jurisdiction over digital health tools, wellness apps, and tracking technologies that often fall outside the Privacy Rule but still collect sensitive information from individuals seeking care ⁸. Enforcement in this area has focused on deceptive data practices, misleading app ratings, and inadequate privacy disclosures. This means any martech component in an agency’s stack can become a regulatory concern, even when no formal PHI is exchanged.

Common pressure points include:

A Meta pixel on a treatment-locator page transmitting IP addresses and behavioral signals related to addiction searches.
A symptom quiz used as a lead magnet may collect responses that function as health information, regardless of how the form is labeled.
A retargeting list built from visitors to a detox landing page can encode sensitive inferences about the audience.

While these tactics are standard for generalist agencies, each has faced documented FTC scrutiny in the mobile-health and digital-health contexts ⁸.

Vetting questions should be specific: Which third-party scripts fire on clinical pages, and what data fields do they transmit? Are conversion events configured to exclude health-condition signals? Does the agency use server-side tracking with hashed identifiers, or browser-side pixels that broadcast raw data to ad platforms? How are quiz tools, chatbots, and assessment widgets disclosed to users before data collection begins?

An agency that dismisses these questions as paranoid rather than routine is revealing its operational norms. The FTC’s expanding stance on health-adjacent digital tools means the cost of non-compliance has shifted from theoretical to enforcement-grade ⁸.

Business Associate Agreements and Data Flow Vetting

Any agency that creates, receives, maintains, or transmits PHI on behalf of a covered treatment center requires a Business Associate Agreement (BAA) before commencing work. The BAA is not merely paperwork; it legally binds the agency to the same Privacy and Security Rule obligations as the provider, extending these requirements to all downstream subcontractors ⁶.

The key vetting question is not whether the agency will sign a BAA, as most will. Instead, it’s whether the agency’s data flows genuinely necessitate one and if the agency can accurately map those flows on demand. Request a written inventory detailing which systems hold patient-identifying data, which staff have access, which subcontractors receive any portion of it, and where data resides at rest and in transit. Email service providers, call-tracking vendors, CRM integrations, and ad platforms each represent potential disclosure points ⁷.

If an agency cannot produce such an inventory within a week, their BAA is largely ineffective. Operators should consider the data-flow map a prerequisite deliverable before contract signing, not a document to be created after an incident occurs.

Substantiating Outcome Claims Before They Reach a Landing Page

The fastest way to assess an agency’s risk posture is to examine its outcome language. Recovery rates, success percentages, before-and-after stories, and comparative claims against other facilities all fall under the FTC’s substantiation framework. This framework mandates competent and reliable scientific evidence for health benefit claims, and for certain claims, well-controlled human clinical studies ¹. The December 2022 guidance, the first comprehensive update in nearly 25 years, explicitly applied this standard to health services, similar to how it’s applied to supplements and devices ⁴.

This standard does not yield to marketing convenience. A landing page promising a specific completion rate requires underlying data from the facility’s own records, consistently defined, with the cohort and timeframe disclosed in a manner a regulator could replicate. An agency that drafts copy first and seeks substantiation later has an inverted workflow.

Claim type mapped to FTC substantiation expectations: outcome and benefit claims generally require competent and reliable scientific evidence, with well-controlled human clinical studies for certain benefit claims; testimonials must reflect typical results or carry clear disclosure; implied claims are evaluated the same way as express ones ¹.

Four claim categories frequently appear in treatment center creative, each with distinct evidentiary requirements:

Outcome claims, such as “78% of clients complete the program,” demand facility-specific data that aligns with the advertised definition.
Testimonial claims must reflect what consumers can generally expect, or include a clear disclosure if results are not typical ¹.
Comparative claims, like “higher success rates than traditional 28-day programs,” necessitate substantiation for both sides of the comparison.
Implied claims, often overlooked, are evaluated by the FTC with the same rigor as express claims; for instance, an ad showing a smiling client on a beach next to “start your recovery” can imply an outcome the facility cannot substantiate ².

Endorsements introduce another layer of scrutiny. Any material connection between the facility and an endorser, including alumni receiving discounts, free services, or paid roles, must be disclosed clearly and conspicuously ³. This rule applies to influencer partnerships and affiliate referral programs. Agencies that relegate disclosure to a footer tag rather than integrating it into the creative itself are employing tactics the FTC has already flagged in related industries.

The vetting process should be systematic. Before any creative goes live, the agency should provide a claim-substantiation log. This log should pair each on-page assertion with its source document, the date range covered, and the methodology used for calculation. If the agency cannot produce such a log for its existing client portfolio, this gap becomes the operator’s liability upon contract signing ¹.

Map four claim categories to their FTC substantiation expectations, directly supporting the section's framework for evaluating outcome claims

Ethical Messaging That Holds Up to Clinical Scrutiny

Legal minimums represent the floor, not the ceiling. The AMA Code of Medical Ethics dictates that professional communications must not be false or misleading, a standard that extends to all promotional activities associated with a physician’s practice or clinical service ⁵. In behavioral health, where prospective patients and families often arrive in crisis, the ethical bar is notably higher than the regulatory one. An advertisement that is technically substantiated can still exploit urgency, prey on shame, or imply guarantees that no clinician would make during an intake conversation.

The AMA’s stance on direct-to-consumer advertising provides an operational test. Promotional content should facilitate informed decisions, maintain a balance between benefits and risks, and avoid creating expectations that a clinician will later need to manage at admission ⁹. Treatment center creative that promises certainty, omits risk language, or presents alumni stories as universal outcomes fails this test, even if each individual sentence passes FTC review.

Three signals distinguish agencies operating at an ethical standard from those merely meeting legal requirements:

Creative briefs should involve the clinical team, not just the marketing director, for framing outcomes and risks.
Crisis-related ad copy should be reviewed against intake-script language to ensure the call experience aligns with the advertisement’s promise.
Alumni stories should include the cohort context that a clinician would naturally provide in person.

Owners who incorporate a clinician sign-off step into creative approval can identify these discrepancies before media spend, rather than after a complaint.

What to Measure When Selecting a Healthcare Marketing Partner

Active Marketing’s data-driven approach is built on 20+ years of behavioral health marketing expertise, delivering predictable admissions growth and lower cost per acquisition for treatment centers.

See Proven Outcomes

Channel Strategy Anchored to How Patients Actually Find Care

Channel mix in behavioral health favors agencies that accurately understand the trust hierarchy. Pew Research Center’s analysis of how Americans seek health information indicates that clinicians remain the most trusted source, with online resources and social networks playing supporting roles that vary significantly by topic and demographic ¹⁰. Treatment decisions, often made under crisis conditions by a family member rather than the patient, fall at the high-trust end of this spectrum. A channel plan that approaches addiction inquiries like e-commerce conversions misinterprets the decision-making context.

Trust hierarchy in health information: clinicians lead, with online sources and social networks as secondary channels whose influence shifts by topic and audience, reflecting post-pandemic gains in online health information use ¹⁰.

Three implications arise for evaluating an agency’s proposed channel strategy:

While paid search and organic search target the same intent, their roles differ. Paid placement captures immediate urgency, whereas organic authority builds consideration. An agency allocating 80% of its budget to paid acquisition without a parallel investment in clinical content authority is essentially buying admissions on rented land, neglecting the trust layer where families often make decisions ¹⁰.
For crisis-driven services, social channels serve as amplification tools rather than primary acquisition channels. They influence the consideration window when a family member researches options for another, requiring a different message than a direct-response ad aimed at the patient.
Clinician-facing channels—such as referral networks, professional directories, and content cited by other clinicians—feed the source patients trust most. Agencies unable to articulate a clinician-influence strategy are applying a consumer playbook to a clinical market.

The vetting question is whether the agency’s channel logic explains each line item in terms of trust, not solely cost-per-click. Owners should expect to see how organic content supports the clinical authority a family will verify before calling, how paid channels intercept moments of urgency without overpromising, and how reputation signals—reviews, third-party coverage, accreditation visibility—bridge the gap between an ad impression and a phone call. A media plan that fails to map to this sequence is optimizing for the wrong metrics.

If You Operate Multiple Facilities: Portfolio-Level Agency Requirements

This section addresses operators managing two or more locations, multi-brand portfolios, or a consolidated admissions center serving multiple sites. Agency requirements change significantly at this scale, and criteria suitable for a single facility often fail across a portfolio.

Three structural shifts drive these differences:

Centralized admissions mean a single call routes to multiple facilities, requiring the agency to manage location-level attribution rather than just brand-level reporting.
Multi-brand portfolios necessitate creative governance that maintains a consistent compliance standard across sites, which may target different payer mixes, levels of care, or geographies.
Per-location performance variance means budget allocation must shift between facilities based on census utilization and contribution margin, not merely historical spending.

The operator economics are best understood through an internal working table rather than agency benchmarks:

Lever	Per-facility input	Compliance constraint
Cost per qualified call	Tracked by location and level of care	Call recordings and routing data may contain PHI; BAA must cover the call-tracking vendor ⁶
Cost per admission	Reconciled against facility-level intake data	Admissions data flowing back to the agency triggers authorization analysis ⁷
Contribution margin per admission	Set by payer mix and length of stay per site	Margin-driven targeting cannot use PHI segments without authorization ⁶
Census utilization	Updated weekly per facility	Bed-availability signals shared with the agency stay outside PHI when aggregated

Two operational filters distinguish portfolio-ready agencies from single-site shops:

Location-level call tracking with documented PHI handling across every routed call, as a single missed BAA on a shared vendor exposes every facility ⁷.
Per-facility creative review, because a substantiated outcome claim at one site is not automatically substantiated at another with different cohorts or programs ¹.

Owners who consolidate marketing under a single agency for efficiency should require both controls in writing before the contract covers a second location.

Attribution, Reporting, and the Economics That Reveal Agency Fit

The clearest indicator of agency competence is not the dashboard itself, but the chain of evidence connecting a media impression to a paid admission, and the transparency with which the agency reports any gaps in that chain. Treatment center owners who can analyze attribution at the cohort level can identify problems six weeks earlier than those who only review it at the channel level.

Three reporting outputs differentiate effective operators from mere vendors:

A qualified call definition with audio review, not just call duration thresholds, ensures the agency and admissions team agree on what constitutes a qualified call before the month ends.
Cost per admission should be reconciled against the facility’s intake records on a defined lag, including payer mix and length of stay, because a low cost per admission with a poor payer mix is not a true win.
Channel-level contribution should isolate branded search, which often inflates paid performance when underlying demand is generated by organic authority or referrals. Agencies that resist isolating branded search are protecting a number, not accurately reporting one.

Reporting cadence reflects operational discipline. Weekly call quality review, monthly admissions reconciliation, and quarterly creative and substantiation audits should be part of the engagement calendar. When call recordings and routing data are shared with the agency for review, the BAA and PHI handling controls established earlier in the diligence process ensure the workflow is legal ⁶. Reporting without this data chain is merely opinion.

A Working Due Diligence Sequence for Owners

The vetting process described above can be condensed into a three-week sequence for owners, without delaying growth timelines. The order is crucial: compliance filters come first to quickly and cost-effectively disqualify candidates. Evidence and channel review follow, requiring the agency to produce tangible artifacts rather than just presentations. Economics and attribution are last, as they are only relevant for partners who have cleared the initial two gates.

Week one focuses on documentation. Request the agency’s written policy distinguishing marketing from treatment and operations communications, its BAA template, a data-flow inventory for an existing client, and a claim-substantiation log for live creative ⁶. Agencies that provide these within five business days demonstrate established controls; those that promise to assemble them likely do not.
Week two addresses creative and channel strategy. Review a current client’s entire funnel: landing pages, quiz tools, retargeting setup, endorsement disclosures, and the substantiation behind every outcome statement ^{1, 3}. Ask which channels the agency would not recommend for behavioral health and why. A partner with no exclusions is selling tactics, not judgment.
Week three covers economics. Collaboratively define a qualified call, establish the reconciliation cadence against intake data, and agree on how branded search will be isolated in reporting. Only sign the contract after all three weeks of due diligence are satisfactorily completed.

Visualize the three-week diligence sequence (documentation, creative/channel review, economics) described in the section as an actionable owner workflow

Frequently Asked Questions

What disqualifies a marketing agency from working with a behavioral health provider?

Three key issues can disqualify an agency. First, if the agency cannot clearly differentiate between marketing communications and treatment or operations communications under HIPAA ⁶. Second, if it treats outcome claims as creative decisions rather than evidence-backed assertions requiring substantiation ¹. Third, if it deploys tracking pixels, quizzes, and retargeting lists on clinical pages without documenting what data these tools transmit to third parties ⁸.

Does a marketing agency need a Business Associate Agreement with a treatment center?

Yes, a Business Associate Agreement (BAA) is required whenever the agency creates, receives, maintains, or transmits protected health information (PHI) on behalf of the provider. The BAA legally binds the agency and its subcontractors to the same Privacy and Security Rule obligations as the treatment center ⁶. A more critical question is whether the agency can produce a data-flow inventory showing which systems, staff, and vendors actually handle PHI. Without this map, the BAA is largely ineffective ⁷.

How should an agency substantiate outcome or success-rate claims in treatment center ads?

Every outcome assertion must be supported by facility-specific data, precisely matching the definition stated in the ad, with the cohort, timeframe, and methodology documented before launch ¹. Comparative claims require evidence for both sides of the comparison. Implied outcomes, conveyed through imagery or adjacent phrasing, are evaluated against the same standard as express claims ². The correct workflow prioritizes evidence first, then copy. Reversing this order exposes the operator to risk.

Are patient testimonials allowed in behavioral health marketing?

Testimonials are permissible but must reflect what consumers can generally expect, with clear and conspicuous disclosure when results are not typical ¹. Any material connections between the facility and the endorser, such as discounted services, alumni perks, or paid roles, must be disclosed within the creative itself, not hidden in a footer ³. Additionally, AMA ethics guidance states that testimonials should not create expectations that a clinician will need to manage during intake ⁵.

How do agency requirements change for operators running multiple facilities?

Portfolio operators require location-level call tracking with documented PHI handling across every routed call, as a single missed BAA on a shared vendor can expose the entire network ⁷. Creative review must be conducted per facility, because an outcome claim substantiated at one site is not automatically valid for another with different cohorts, levels of care, or payer mixes ¹. Centralized brand governance with site-level attribution is the minimum reporting standard.

What attribution and reporting should owners expect from a healthcare marketing agency?

Owners should expect a qualified call definition with audio review, cost per admission reconciled against intake records (including payer mix and length of stay), and channel-level contribution that isolates branded search from paid performance. The engagement calendar should include weekly call quality review, monthly admissions reconciliation, and quarterly substantiation audits. When call recordings are shared with the agency, the BAA and PHI handling controls ensure the workflow is legal ⁶.

References

Health Products Compliance Guidance. https://www.ftc.gov/business-guidance/resources/health-products-compliance-guidance
Health Claims. https://www.ftc.gov/business-guidance/advertising-marketing/health-claims
Advertising and Marketing. https://www.ftc.gov/business-guidance/advertising-marketing
FTC Announces New Business Guidance for Marketers and Sellers of Health Products. https://www.ftc.gov/news-events/news/press-releases/2022/12/ftc-announces-new-business-guidance-marketers-sellers-health-products
The Code of Medical Ethics of the American Medical Association. https://pmc.ncbi.nlm.nih.gov/articles/PMC3399321/
Marketing. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html
What are the HIPAA Marketing Rules?. https://www.hipaajournal.com/hipaa-marketing-rules/
The Federal Trade Commission and Consumer Protections for Mobile Health Apps. https://pmc.ncbi.nlm.nih.gov/articles/PMC8329941/
Direct-to-Consumer Advertisements of Prescription Drugs. https://code-medical-ethics.ama-assn.org/ethics-opinions/direct-consumer-advertisements-prescription-drugs
Where Do Americans Get Health Information, and What Do They Trust?. https://www.pewresearch.org/science/2026/04/07/where-do-americans-get-health-information-and-what-do-they-trust/