How to Choose a Health Advertising Agency That Builds Trust

Picking a health advertising agency in 2025 is closer to hiring outside counsel than hiring a media buyer. Recent federal enforcement has repriced the cost of getting substantiation, health-data handling, disclosure, or measurement wrong, and the invoice increasingly lands on the treatment center whose name sits above the ad. In June 2025 the FTC secured a $1.9 million settlement against Evoke Wellness over allegedly deceptive Google search ads that impersonated other substance-use-disorder providers ³. That case did not turn on creative judgment. It turned on operational choices an agency made inside an ad account.

For CMOs at addiction treatment and behavioral health organizations, the practical implication is a shift in what an agency search is actually selecting for. Media planning skill, creative range, and channel mix still matter, but they no longer sit at the top of the scorecard. The top of the scorecard is whether the agency can absorb regulatory, privacy, and reputational risk on the CMO’s behalf, and prove it with artifacts rather than assurances.

The rest of this article lays out the four evidence-heavy dimensions that separate defensible partners from expensive liabilities, and the specific documents to request before signing anything.

Four dimensions decide whether an outside partner reduces enterprise risk or manufactures it: substantiation discipline, health-data handling, disclosure hygiene, and measurement architecture. Each maps to a body of federal guidance and each can be scored against an artifact the agency either produces on request or does not.

• Substantiation covers every recovery-rate, outcome, and superiority claim the agency proposes to publish. The FTC standard requires adequate evidence in hand before a claim runs, not after a complaint arrives ¹.
• Health-data handling covers what the agency touches on the website, in intake forms, in call tracking, and in advertising audiences.
• Disclosure hygiene covers search ad identity, native content labeling, and testimonial context.
• Measurement architecture covers whether reported performance can be traced to admissions rather than form-fills.

Before reviewing an agency’s creative reel, ask for the evidence file behind a single outcome claim they have run for a current client. Pick something concrete: a recovery-rate percentage, a completion-rate figure, a length-of-stay comparison, or any “leading” or “nationally recognized” phrasing. The FTC standard is that advertisers must hold adequate substantiation for objective claims before dissemination, and health-benefit claims generally require competent and reliable scientific evidence ¹. If the agency cannot produce the file within a business day, that is the answer. Substantiation is either a working process or it is missing.

A defensible evidence file names the claim, the exact wording as it appeared in the ad or landing page, the underlying data source, the population it describes, the date range, and the internal or clinical reviewer who signed off. Testimonials are held to the same bar. The FTC has said advertisers should not use endorsements to convey claims that would be deceptive or unsupported if made directly ¹², which means an alumni quote about “getting my life back in 30 days” carries the same substantiation burden as a headline stating a 30-day outcome. Ask how the agency handles typicality language when an individual story implies a general result ¹¹.

The process questions matter as much as the artifacts. Who inside the agency reviews outcome claims before they run? Is clinical review routed to the treatment center’s medical director, an outside reviewer, or nobody? What happens when the client provides a statistic without a source? A serious partner has a written intake for claim substantiation, a claims log by campaign, and a documented refusal path for numbers that cannot be sourced. A weaker partner treats substantiation as the client’s problem and publishes whatever the brief provides.

Two categories deserve extra scrutiny in this sector. Comparative claims (“the leading,” “the most effective,” “higher success rate than”) almost always require head-to-head evidence the treatment center does not actually have. Clinical framing that presents detox alone, a single modality, or a fixed program length as sufficient for long-term recovery contradicts the underlying evidence base ¹⁷and creates both regulatory and clinical exposure. An agency that pushes back on this language during the pitch is demonstrating the discipline the scorecard is trying to measure. An agency that offers to “make the numbers work” is telling the CMO what the first FTC inquiry will look like.

Request three artifacts before advancing any finalist:

1. a redacted claims log from an active account,
2. the standard substantiation intake form, and
3. a written example of a claim the agency rejected in the last twelve months.

The third item is the tell. Agencies with real substantiation discipline can name a claim they refused to run and explain why.

Health-data handling is the dimension where a well-intentioned agency does the most damage the fastest. A single misconfigured pixel on an intake page can convert routine web analytics into a disclosure of substance-use-disorder status to Meta or Google, and the treatment center carries the liability regardless of who installed the tag. Three federal regimes apply in parallel, and a competent partner can name all three without prompting: HIPAA for covered entities and business associates, 42 CFR Part 2 for SUD treatment records, and the FTC Health Breach Notification Rule for organizations that fall outside HIPAA but still touch health data ^{6, 18, 7}.

The HHS Office for Civil Rights bulletin on tracking technologies is the clearest technical baseline. It requires regulated entities to configure trackers so that PHI is used and disclosed only as HIPAA permits, and to secure electronic PHI under the Security Rule ⁶. That obligation does not stop at the covered entity’s firewall. Any vendor that helps run the site, the forms, the call tracking, the CRM sync, or the ad accounts is inside the compliance perimeter and needs a business associate agreement in place before touching production systems.

The FTC layer catches what HIPAA misses. The 2024 amendments to the Health Breach Notification Rule clarified that health apps and similar technologies fall within scope, and that covered organizations generally must notify affected individuals and the FTC within 60 calendar days of discovering a breach, with media notification triggered at 500 or more people ^{7, 8}. Agencies that assume HIPAA is the only regime that matters underestimate the exposure their martech stack creates. The two subsections below convert this into specific artifacts and a filter that most generalist healthcare agencies fail.

Disclosure hygiene is where a competent-looking agency reveals itself under pressure. The Evoke Wellness matter did not turn on bad creative or weak targeting. It turned on paid search ads that allegedly created confusion about which provider a caller was actually reaching. Ask any finalist to walk through their standard for ad identity on branded and competitor keywords: how the display URL, headline, business name, and phone number make the actual provider unambiguous before the click, and how they audit inbound calls for scripts that could imply an affiliation the treatment center does not have.

Native and sponsored content is the second failure mode. Advertorials, directory profiles, paid placements on recovery blogs, and long-form landing pages written to look like independent editorial all fall under the FTC’s guidance that disclosures must be clear, prominent, understandable, and placed close to the claim or the native ad itself ¹⁰. A serious agency maintains a disclosure library with pre-approved language for each format, a placement rule for above-the-fold versus footer positioning, and a versioned log showing when each disclosure was updated. Ask for the library. If the answer is a screenshot from an old campaign, disclosure is being handled ad hoc.

Testimonials carry the tightest bar in this sector. An alumni story that describes a 90-day arc from admission to sustained recovery communicates a general outcome claim whether or not the headline says so, and the FTC has warned that unrepresentative testimonials mislead unless advertisers explain what consumers can generally expect and disclose any material connection between the endorser and the marketer ¹¹. Three questions cover most of the exposure:

1. How does the agency document consent, compensation, and any ongoing relationship with the person telling the story?
2. What typicality language runs alongside the quote, and where does it sit relative to the endorsement?
3. How are employee, alumni-ambassador, and influencer relationships flagged inside the creative itself?

Request three artifacts before advancing a finalist on this dimension: the current disclosure library with version dates, a redacted testimonial release covering consent and material-connection language, and a sample paid-search account audit showing branded, competitor, and generic queries with the display URLs and call-tracking numbers in use. The pattern to look for is consistency. Agencies with real disclosure discipline apply the same standard whether the medium is a Google text ad, a Facebook video, a sponsored article, or an alumni quote on a landing page. Agencies without it produce clean disclosures on the flagship site and looser copy everywhere else, which is exactly the surface area regulators examine first.

Most agency dashboards stop at the form-fill or the connected call. That is the wrong endpoint. A defensible measurement architecture ties every media dollar to an admitted patient, or explains why it cannot, and it does so without shipping protected health information to the ad platforms that need to be optimized against.

Start the conversation with call tracking. Ask which provider the agency uses, whether call recordings and transcripts are stored inside a business-associate-covered environment, and how dynamic number insertion is configured on pages that could reveal SUD status through referrer or URL data. The HHS Office for Civil Rights bulletin is explicit that trackers on pages relating to an individual’s health, care, or payment sit inside HIPAA’s scope, and call-tracking vendors are not exempt ⁶. If the agency cannot describe the data path from a ringing phone to the CRM without naming the BAA covering each hop, the architecture is not built.

Server-side event handling is the next question. Client-side pixels on intake pages, thank-you pages, and verification-of-benefits forms are the exact pattern that produced the Monument order, where an SUD-adjacent provider was alleged to have disclosed health information to Meta and Google without affirmative consent ⁴. A serious partner runs conversions through a server-side container, strips identifiers before any signal reaches an ad platform, and uses hashed offline conversion imports keyed to admission events rather than form submissions. Consent-mode configuration should be documented per page template, not assumed.

Then ask what a monthly report actually shows. Media source to session, session to qualified inquiry, qualified inquiry to VOB, VOB to admission, admission to length of stay. An agency that cannot close that loop is optimizing to clicks and hoping the census follows. Request a sample admissions-attribution report before the contract is signed.

Baseline quality across health websites is poor, and that is not an opinion. A 2019 systematic review of 153 cross-sectional studies covering 11,785 health-information websites found that only 18% carried HON Code certification and no site received an excellent DISCERN rating, with government-affiliated sources generally scoring higher than commercial ones ¹⁵. The number is a decade-old benchmark rather than a current market read, but it establishes the direction of the problem: without a governance standard, healthcare content drifts toward marketing polish and clinical looseness. A serious agency has a scoring rubric it can defend before the CMO has to ask for one.

Clinical accuracy in this sector has a defined floor. NIDA’s principles hold that no single treatment is appropriate for everyone, that detoxification alone is rarely sufficient for long-term recovery, and that medication is generally the first line of treatment for opioid-use disorder when combined with behavioral therapy ^{16, 17}. Content that presents a 30-day residential stay as a cure, that treats abstinence-only framing as the default, or that positions detox as the endpoint of care contradicts that base. Ask the agency how a landing page describing medication-assisted treatment gets reviewed, who signs off on modality descriptions, and what the escalation path is when a client requests copy the clinical evidence will not support.

Plain-language discipline is the other half. AHRQ’s Health Literacy Universal Precautions Toolkit sets the operational standard: simplify communication, confirm understanding, and make services easier to navigate for readers across literacy levels ¹³. The CDC Clear Communication Index provides a scoring instrument with four introductory questions and 20 items an agency can run against a page, an ad, or an intake sequence before it ships ¹⁴. Request the last three pages the agency scored against either standard. If the answer is that clinical review and readability are handled informally, both are handled inconsistently, and the FAQ section on the flagship site is where regulators and referring clinicians will notice first.

Consolidate the four dimensions into a single scoring sheet before the finalist round begins. Each row names the dimension, the artifact requested, and the pass signal. Any dimension that fails is a full stop, not a weighted average against the others.

Score the scorecard itself against how the agency responds. Finalists that produce four artifacts in a week are demonstrating the operational discipline the FTC guidance assumes advertisers already have ¹⁹. Finalists that promise the artifacts “once we are engaged” are describing the answer to a future subpoena, not a proposal.

CMOs at single-facility organizations can stop at the four-dimension scorecard. Portfolio operators running multiple brands, locations, or joint-venture facilities carry a different exposure profile and should add three questions to the finalist interview before signing a master agreement.

1. How does the agency segregate substantiation files, pixel inventories, and BAAs by brand and by legal entity? Shared tag containers and reused audiences across facilities are a common source of cross-brand data leakage and complicate breach notification when a single vendor incident spans multiple entities ^{6, 7}. Ask to see the folder structure, not a verbal answer.
2. How are competitor-name bidding rules governed when two portfolio brands compete for the same query? The Evoke Wellness matter shows how quickly ambiguous ad identity becomes an enforcement problem ³. A defensible policy names which brand bids on which terms, forbids implied affiliation across sister facilities, and logs exceptions.
3. Does the master services agreement scope 42 CFR Part 2 obligations at the entity level rather than the portfolio level, so a Part 2 program’s data cannot be pooled with non-Part 2 facilities for modeling or audience matching ¹⁸? If the agency cannot answer that in the room, the contract is not portfolio-ready.

Some warning signs surface inside the first hour of a pitch. Any agency that promises a specific admissions volume, cost per admission, or ranking in a defined timeframe is either bluffing or planning to publish claims the FTC standard cannot support ¹⁹. Guarantees are a substantiation problem before they are a delivery problem.

Watch the language around outcomes. Pitches that lean on “proven success rates” without naming the underlying population, date range, or reviewer are recycling client-supplied numbers no one has vetted ¹. Pitches that describe detox programs as recovery outcomes or default to abstinence-only framing are ignoring the clinical base rate ¹⁷.

Listen for privacy shortcuts. “We use the same Meta pixel setup as every other client” is the Monument pattern in a sentence ⁴. Agencies that treat business associate agreements as paperwork to handle after signature, or that cannot name a call-tracking vendor with a BAA on file, are describing a compliance gap the treatment center will inherit on day one.