Building a Strategy for Advertising for Healthcare

A recurring misconception inside treatment center marketing teams: FDA sets the rules for their advertising. It usually does not. FDA’s jurisdiction under 21 CFR 202 attaches to prescription drug advertising and promotional labeling — the risk disclosure, fair balance, and information-inclusion requirements that bind pharma promotion ¹. A residential addiction treatment center advertising its program, clinical staff, or admissions line is not making a prescription drug claim and is not operating under 21 CFR 202.1.

The line moves when creative names a specific medication. Ads that reference buprenorphine, naltrexone, or a branded MAT product by name — whether in a paid search headline, a landing page, or a co-marketed piece with a pharmaceutical partner — pull FDA’s fair balance and risk disclosure expectations into scope. Under 21 CFR 202.1(e), advertisements that are “false, lacking in fair balance, or otherwise misleading” are prohibited ².

The practical filter for a CMO’s brief is narrow: does the creative name a regulated drug or biologic, or does it describe a service, level of care, or clinical approach? Service-level advertising sits under FTC. Drug-named advertising imports FDA obligations that most treatment center creative teams are not built to satisfy without pharma-side legal review.

FTC is the regime that actually governs the majority of treatment center advertising. The Health Products Compliance Guidance, issued in December 2022, applies to claims about “drugs, devices, dietary supplements, services, and other health products” — a scope broad enough to cover every program page, paid search ad, and paid social creative a behavioral health organization runs ³. The rule is direct: advertising must be truthful, not misleading, and health benefit or safety claims require “competent and reliable scientific evidence” for substantiation ³.

That standard is the ceiling on what creative can promise. A 78% completion rate, a “proven” modality, a claim that a program “treats” co-occurring disorders — each is a health benefit claim, and each must be tied to evidence the organization can produce on demand. The evidence bar is not “the clinical director believes it works.” It is documentation an FTC investigator would accept as scientifically competent and reliable.

Behavioral health complicates this. Randomized trials for specific residential programs are rare, and outcome definitions vary across the field. The operational consequence is that CMOs should assume every outcome-flavored claim carries a substantiation file — or the claim comes out of the ad. The four regimes below sit next to each other in the reader’s decision framework; FTC is the one that touches nearly every asset.

HIPAA’s marketing definition sits under §164.501 and controls whether a given communication can go out at all without written authorization from the person whose PHI is being used. HHS/OCR guidance is explicit: with limited exceptions, HIPAA “requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing,” where marketing means communications encouraging the purchase or use of a product or service ⁵.

Two carve-outs shape how nurture programs actually run. Treatment communications — reminders, follow-ups, and content about the person’s current care — are not marketing. Disease-management and wellness communications about health-related products or services are also carved out under specific conditions, which is why alumni engagement and case-management outreach can proceed without authorization while cross-sell campaigns often cannot ⁵. The interpretive gray zone is real: HHS acknowledges that the line between educational and marketing communications generates ongoing questions ⁵.

The operational takeaway for a CMO auditing an existing nurture stack: any segment built from PHI that promotes a new service, a different level of care, or a partner program is presumptively marketing and needs authorization documentation before it flights. That check belongs in campaign setup, not in a post-launch privacy review.

CMS enters the frame only when a treatment center’s outreach touches Medicare Advantage plan information — a scenario that matters for organizations serving older adults, MAT programs with dual-eligible populations, or co-occurring care where plan coordination surfaces in the funnel. When it applies, Chapter 3 of the Medicare Marketing Guidelines defines marketing materials broadly to include any information targeted to Medicare beneficiaries that promotes a plan or informs them they may enroll ⁸.

Two rules bind creative immediately. Testimonials cannot use anonymous or fictitious quotes and cannot include negative statements about other plans ⁸. Outbound call scripts must be submitted for review and must include required privacy statements ⁸. Beyond creative, 42 CFR §422.2268 prohibits door-to-door solicitation, sales presentations in provider offices where care is delivered, and targeting higher-income areas without comparable outreach in lower-income areas ⁹.

For most addiction treatment centers, CMS is an edge regime — but the edge is sharper than most CMOs assume, particularly when a call center handles inbound inquiries that touch plan enrollment questions. Building the CMS filter into intake scripts before Medicare-adjacent inventory is purchased prevents the more common failure mode: discovering the requirement after outbound outreach has already run.

Outcome claims are where treatment center advertising most often collapses under review. A landing page states an 82% completion rate. A paid search ad calls a modality “proven.” A programmatic display unit promises “lasting recovery.” Each of these is a health benefit claim, and each falls under the FTC’s rule that such claims require “competent and reliable scientific evidence” — the same standard that governs drugs, devices, and other health products across every channel a behavioral health organization uses ³.

The operational question is not whether the number is accurate internally. It is whether the organization can produce, on demand, the study design, sample, follow-up window, and outcome definition behind it — and whether that documentation would be accepted as scientifically competent by an investigator who does not work in the field. Alumni surveys with self-selected respondents, 30-day post-discharge check-ins, and internal chart reviews rarely clear that bar. Randomized trials for specific residential programs are limited, and outcome definitions vary widely across the sector ³.

The matrix below operationalizes the standard by claim type. Insurance-accepted statements and clinical modality descriptions carry the lightest substantiation burden and remain eligible across paid search, paid social, programmatic, CTV, and email. Outcome and success-rate claims sit at the top of the substantiation ladder and, absent a defensible evidence file, should be cut from creative before media is booked rather than defended after the fact.

Testimonials carry two layers of exposure that most creative teams underweight. The first is FTC: a patient statement about outcomes is itself a health claim, and the endorser’s experience must reflect what typical participants can expect — or the ad must disclose that it does not ³. A single alumnus describing sustained recovery, presented without qualification, functions as an implied success-rate claim and inherits the same substantiation burden as a numeric outcome statement.

The second layer applies when creative touches Medicare Advantage. CMS bars anonymous or fictitious quotes and prohibits testimonials that make negative statements about other plans ⁸. That rule extends beyond obvious plan advertising to any material CMS treats as targeted to Medicare beneficiaries, which can capture co-occurring care creative if enrollment or plan coordination surfaces in the funnel.

Three operational filters keep testimonial work defensible:

• Named participants with documented consent replace composite or anonymous quotes.
• Statements describe the person’s experience of care — modality, staff, environment — rather than quantifying results the organization cannot substantiate.
• Any outcome language inside a quote triggers the same evidence review as an outcome claim written by the marketing team.

Testimonials are not a workaround for the substantiation standard; they are governed by it.

When creative names a device — a TMS system for co-occurring depression, a wearable monitoring tool, a diagnostic used in intake — jurisdiction depends on whether the device is restricted. FDA holds primary responsibility for advertising restricted medical devices, while FTC oversees truthfulness of advertising for most over-the-counter devices ⁴. GAO has flagged coordination gaps in digital and social promotion of devices, which raises the practical risk that a paid social creative referencing a device draws scrutiny from either agency ⁴.

Modality references sit in a cleaner lane. Descriptions of CBT, DBT, EMDR, MAT, or specific therapeutic protocols are service claims under FTC jurisdiction and are governed by the same substantiation standard as any other health claim ³. The distinction matters at the brief stage: a campaign that names a branded medication or a restricted device imports obligations most treatment center creative workflows are not built to satisfy, while a campaign describing clinical approaches stays inside the FTC framework the rest of the article addresses.

Word choice in behavioral health advertising is a performance variable, not a sensitivity issue. NIDA’s guidance for health professionals is direct: person-first construction “shows that a person ‘has’ a problem, rather than ‘is’ the problem,” and the shift from labels to descriptions changes how audiences interpret both the person and the organization addressing them ¹⁰. The 2024 multinational study on SUD stigma reaches the same conclusion from a different angle, finding that replacing terms like “substance abuser,” “addict,” and “junkie” with “person with substance use disorder” and “person in active use” helps “avoid negative connotations, punitive attitudes, and individual blame” ¹³.

The operational consequence for a CMO is straightforward. Search headlines, paid social copy, landing page H1s, and admissions call scripts written in stigmatizing language signal to a person mid-decision that the organization sees them as their diagnosis. That signal degrades trust in the exact moment the funnel depends on it. Person-first construction is the copy standard that keeps the creative aligned with the clinical framing NIDA describes as treating substance use disorders as “chronic, treatable medical conditions” ¹¹.

Personal narrative is the default creative pattern in behavioral health advertising, and it is also the pattern most likely to backfire when it stands alone. Peer-reviewed evidence on stigma communication finds that narratives combining personal stories with depictions of structural barriers to treatment increase willingness to invest in care “without increasing stigma” — while story-only framing, particularly when it links behavioral health to violence or moral failure, can raise support for services and stigma simultaneously ¹².

The directive for creative teams is specific. A campaign built around one person’s experience should sit next to depictions of what got in the way:

• insurance denials
• waitlists
• geographic gaps in MAT access
• employment consequences
• family separation logistics

Those elements are not softening context. They are the mechanism that shifts audience attribution from individual fault to system friction, which is what the evidence links to increased treatment investment support.

Channel selection in behavioral health is bounded less by CPMs than by what data a platform will accept and what a covered entity is permitted to send. Paid search sits in the cleanest lane: keyword intent is not PHI, and query-triggered creative that describes services rather than named individuals stays outside HIPAA’s marketing definition under §164.501 ⁵. That is why paid search remains the workhorse for admissions call generation — the targeting mechanism does not require the organization to disclose or transmit protected information about anyone.

Paid social and programmatic tighten the frame. Custom audiences built from patient lists, retargeting pixels fired on treatment-specific pages, and lookalike models trained on prior admits all involve using PHI to shape marketing communications. HHS/OCR guidance is direct that, absent an exception, such uses require written authorization from the individual before PHI is disclosed for marketing purposes ⁵. Uploading a hashed patient list to a social platform without authorization does not sidestep the rule; the disclosure has already occurred.

The operational filter for a CMO auditing the paid stack: identify every audience that traces to identifiable patient data, and treat each as authorization-gated rather than platform-gated. Channels that require PHI to work efficiently either get authorization workflows built into intake or come out of the plan.

Call volume is the conversion event that matters for admissions, and it is also the point where HIPAA obligations attach fastest. HHS FAQ guidance is explicit: a covered entity may share PHI with a telemarketer only with the individual’s written authorization or under a business associate agreement ⁶. That rule extends to any outsourced call center, overflow answering service, or performance marketing vendor whose staff handle inbound calls where callers disclose diagnosis, insurance, or treatment history.

Call-tracking vendors sit in the same category the moment their platform records, transcribes, or stores calls that contain PHI. A dynamic number insertion tool that captures a caller stating “I need help with fentanyl” is processing protected information on behalf of the covered entity, which triggers BAA requirements before the vendor is deployed — not after a quarterly compliance review discovers the gap.

Script design carries a parallel constraint when Medicare-adjacent inquiries surface. CMS requires outbound call scripts to be submitted for review and to include required privacy statements ⁸. Inbound scripts that pivot into plan enrollment discussion inherit similar exposure. Practical script architecture keeps the initial qualification conversation on service and clinical fit, routes plan-specific questions to trained staff, and logs consent language before any subsequent outreach uses information the caller provided.

Telehealth intake and app-based screening have moved from adjacent tactics to primary funnels in behavioral health, and the advertising rules follow the platform. FTC’s Mobile Health App tool confirms that the FTC Act “applies to most app developers – including developers of health apps” and prohibits false advertising for services delivered through them ¹⁴. Claims about assessment accuracy, matching to appropriate care, or symptom improvement inside an app carry the same substantiation burden as any other health claim.

Privacy overlays sit on top. When an app collects intake information that a covered entity or its business associate will use, HIPAA obligations attach to the data flow, and any downstream marketing use of that information falls under §164.501 ^{5, 14}. The failure mode is a self-guided screener that markets a residential program based on responses without an authorization path built into the tool. Advertising strategy for telehealth intake works when the app’s claims are substantiated and its data pipeline is designed against HIPAA marketing rules from the first wireframe, not retrofitted after launch.