Selecting Healthcare Advertising Companies: A Guide

The strongest healthcare advertising companies do not win treatment center contracts on creative reels. They win on the boring paperwork: signed Business Associate Agreements, written authorization templates that hold up under audit, and substantiation files behind every outcome claim on a landing page. That reframing matters because the wrong agency does not just underperform — it introduces regulatory exposure that outlives the engagement.

HIPAA sets the baseline. With limited exceptions, the Privacy Rule requires written patient authorization before protected health information is used or disclosed for marketing purposes ¹. The FTC layers on a second standard: health advertising must be truthful, not misleading, and backed by adequate substantiation for every objective claim ². Any agency handling retargeting audiences, alumni testimonials, or clinical outcome copy is operating inside both frameworks, whether it acknowledges them or not.

The diligence problem is that most agencies pitching treatment centers cannot cleanly demonstrate how their workflows produce compliant artifacts on demand. Portfolio screenshots do not answer whether the authorization form was countersigned before the testimonial ran, or whether the CBT outcome statistic on the homepage has a source file behind it.

Selection, then, is closer to vendor risk review than to creative evaluation. The sections that follow build a screening protocol organized around the specific artifacts a treatment center CMO should request — before the media plan, before the retainer, before the first ad ever renders.

HIPAA governs whose data an agency can use. The FTC governs what an agency is allowed to say once the ad runs. Health advertising must be truthful, not misleading, and backed by adequate substantiation for every objective claim ². That standard applies to the treatment center as the advertiser, regardless of which agency wrote the copy.

The operational implication is a claims file. Every objective statement on a landing page, ad, or organic asset — completion rates, sobriety outcomes, staff credentials, accreditation status, average length of stay, insurance acceptance — should have a corresponding entry documenting the source of the data, the population it describes, the date range, and the internal owner who verified it. Agencies that write treatment outcome copy without maintaining that file are producing exposure the treatment center owns ⁴.

During diligence, the request is direct: show a claims file from a past client engagement, redacted as needed. A capable agency will produce a spreadsheet or document that maps each on-page claim to a substantiation source. An incapable agency will describe its process in the abstract and never surface a document.

Two claim categories cause the most trouble in behavioral health:

• Establishment claims — statements framed as clinically proven or backed by studies — require competent and reliable scientific evidence, not internal marketing analysis ².
• Comparative claims, such as “higher success rate than traditional programs,” require substantiation for both sides of the comparison.

Agencies that soften these into feeling-based language without deleting the underlying claim have not solved the problem.

The scorecard below consolidates the four regulatory diligence pillars into a single artifact the treatment center can carry into an RFP. Each pillar names the rule, the agency capability, and the specific document to request before signing.

Testimonials are where healthcare advertising companies most often trip two regulators at once. The FTC treats reviews and endorsements as material to the consumer decision and requires that they be genuine, that material connections be disclosed clearly, and that businesses not suppress negative feedback ³. HIPAA treats the underlying identification of a patient as a marketing use of PHI, which triggers the written authorization requirement before the story runs ¹.

Three workflow tests separate agencies that handle this cleanly from those that create exposure.

1. The first is the authorization sequence. A capable agency executes a patient authorization form — naming the media, the duration, the specific uses, and the right to revoke — before any filming, quoting, or photography occurs. Ask to see the sequence: intake, authorization, content capture, legal review, publication. If content capture precedes authorization, the workflow is backwards.
2. The second is the review-solicitation script. Agencies running Google, Yelp, or platform-specific review programs must ensure requests go to all patients rather than only those likely to leave positive feedback, and must not offer compensation contingent on a particular sentiment ³. Request the actual solicitation copy and the segmentation logic behind it.
3. The third is disclosure treatment for compensated or incentivized stories. Alumni ambassadors, paid creators, and staff-adjacent testimonials all carry material connections that must be disclosed in a way the average viewer will notice — not buried in a bio link ³. Agencies that describe disclosures as “tasteful” without showing placement standards are describing a risk, not a control.

Short-form ad units are where compliance and creative collide. Google Responsive Search Ads cap headlines at 30 characters. Meta primary text truncates on mobile. TikTok in-feed copy runs even tighter. FDA draft guidance on internet and social media platforms with character space limitations addresses exactly this problem: how to present risk and benefit information when the format itself constrains disclosure ⁹. Agencies working in behavioral health should have a documented approach, not an improvised one.

The diligence test is straightforward. Request sample RSAs and paid social creative the agency has produced for prior treatment center clients, along with the reasoning behind how risk-relevant information was handled. A capable agency will show how it balances benefit claims with material qualifications in the visible ad unit itself, rather than relying on a click-through to surface anything a regulator would consider necessary context ⁹. Agencies that treat the landing page as a catch-all for disclosures the ad omitted are misreading the guidance.

Two patterns signal weak fluency:

• The first is outcome language in headlines — “Get Sober in 30 Days,” “Proven Recovery” — without substantiation and without any qualifying context in the visible creative. The FTC’s substantiation standard does not relax because the ad unit is small ².
• The second is influencer and creator content on TikTok or Reels where material connections are disclosed only in a bio link or a comment, not in the video itself ³.

The operational ask during selection: a short library of the agency’s own compliant creative for behavioral health, with a written rationale for headline, primary text, and disclosure choices under each platform’s character constraints.

A quick way to test whether a healthcare advertising company has kept pace with behavioral health delivery: look at the landing pages it built in the last twelve months. If the primary conversion path still funnels every visitor toward an on-site tour or an in-person admissions appointment, the agency is marketing a 2015-era intake model to a patient population that now expects a virtual door.

SAMHSA facility data shows how sharp the shift has been. Substance use treatment facilities using telemedicine rose from 25.7% in 2015 to 58.6% in 2020, and mental health facilities rose from 22.2% to 68.7% over the same period ¹⁰. Whatever the current-year figure, the direction is clear: telehealth intake is no longer a secondary channel for most facilities, and ad creative that ignores it wastes qualified traffic.

The diligence questions are concrete:

• Does the agency’s proposed landing page architecture surface a virtual assessment option alongside residential and outpatient tracks, or is telehealth buried three clicks deep?
• Does the call tracking configuration distinguish virtual intake inquiries from in-person admissions, so cost per admission can be measured against the right service line?
• Do paid search keyword clusters include intent-specific terms — virtual IOP, online assessment, telehealth evaluation — or does the media plan treat every query as a residential lead?

The creative test is equally direct. Ad copy and imagery should reflect that a meaningful share of first contacts will not physically visit the facility before admission. Agencies still leaning on drone shots of the campus and “tour our facility” CTAs are optimizing for a shrinking segment of the funnel. Ask to see how the finalist’s prior work handled the split between virtual and in-person conversion paths, and how attribution was reconciled across the two.

An agency that cannot answer these questions with specific artifacts — page templates, call routing logic, keyword maps — is not building for how patients actually enter treatment now.

Cost per lead is the metric most agency pitches optimize against. Trust is the metric that decides whether those leads pick up the phone. A 2025 systematic review of 49 studies on trust in digital healthcare found that trust directly shapes adoption, acceptance, and perceived usefulness, and is driven by privacy concerns, data accuracy, digital literacy, and the degree of human interaction in the experience ¹³. For a treatment center CMO, that means the cheapest CPL agency often produces the worst admissions economics: patients arrive at a low-trust page, disengage before the form completes, and never reach the intake team.

A separate 2025 systematic review of digital-health adoption barriers synthesizes the problem into three pillars — digital literacy, functionality and usability, and trust ¹⁷. Each pillar corresponds to a concrete agency deliverable a treatment center can request and measure.

Digital literacy

Shows up as reading level. Behavioral health landing pages written at a college reading level lose patients in active crisis and family members translating clinical language under pressure. Ask the agency for a reading-level audit of its recent treatment center pages and the target grade it writes to. Patient perspective research points to health literacy and digital literacy as primary barriers to engagement, alongside privacy concerns ¹⁵.

Functionality and usability

Show up as page performance and form design. Request mobile page-speed benchmarks, form abandonment rates, and the accessibility standard the agency builds to. Patient experience research finds that digital engagement depends on physical, cognitive, and communication capabilities, not just intent ¹⁶— a slow, cluttered intake form filters out patients the media plan already paid to acquire.

Trust

Shows up as privacy signaling and human interaction. On the privacy side, request the agency’s standards for how HIPAA notices, encryption disclosures, and data-use language appear on intake forms — not buried in the footer. On the human interaction side, ask how the funnel surfaces a real clinician or admissions counselor before the form submission, since the trust review identifies human interaction as a determinant patients weigh directly ¹³.

The diligence request is a single artifact: a page-level scorecard from the agency showing reading level, mobile performance, privacy signaling, and the point in the funnel where a human enters the conversation. Agencies that cannot produce it are optimizing traffic they will never convert.

Three engagement structures dominate treatment center marketing contracts, and each ties the agency to a different point in the funnel. The choice determines how quickly problems surface, who owns attribution disputes, and whether the agency has any stake in whether calls actually convert to admissions.

The project retainer

Buys deliverables: a set number of landing pages, ad units, blog posts, and reports per month. Accountability stops at output. It is the least expensive structure on paper and the most common source of misalignment, because the agency is paid whether the treatment center’s cost per admission moves or not. It fits organizations with a mature in-house team that can absorb strategy, attribution, and QA — and that only needs execution capacity.

The performance retainer

Ties a portion of fees to a downstream metric the agency can influence: qualified calls, verified benefits, or scheduled assessments. It forces the agency to care about form quality, call routing, and intake handoff, not just impressions. The tradeoff is definitional friction. Both sides must agree on what counts as a qualified call, how disqualified insurance is handled, and how self-pay inquiries are scored — before the contract is signed, not after the first dispute.

The in-house-plus-specialist model

Keeps strategy, brand, and attribution inside the treatment center and buys narrow expertise on retainer: SEO, paid media, compliance review, or creative production. It produces the tightest accountability because the internal team owns the number, but it requires a marketing leader with the bandwidth to run the model.

The selection question is not which model is best in the abstract. It is which model matches the treatment center’s internal capacity to define qualified inquiries, audit compliance artifacts, and reconcile attribution across virtual and in-person intake paths.

The framework so far assumes a single treatment center CMO evaluating one agency contract. Portfolio operators running three or more facilities across state lines face a different diligence problem: the same agency will produce compliant work at one location and expose the operator at another if the compliance model does not scale with the footprint.

Three questions surface issues before they compound:

1. Does the agency maintain state-specific claim substantiation, or does it recycle outcome copy across facilities licensed under different regulatory regimes? FTC substantiation applies to every asset the operator publishes, and a claim that fits one facility’s data does not automatically fit another’s ².
2. Does the BAA structure account for shared CRM, shared call tracking, and shared retargeting audiences that move PHI between facility brands under one parent entity ⁵?
3. Does the authorization workflow track which facility a testimonial was captured at, so alumni content is not repurposed across brands the patient never consented to appear under ¹?

Portfolio operators should also require facility-level reporting, not aggregated dashboards. Averaged cost per admission across five locations hides the site that is bleeding budget.

Certain phrases in a pitch deck should end the meeting:

• “We build custom retargeting audiences from your patient list” describes a marketing use of PHI without acknowledging the authorization requirement that governs it ¹.
• “We guarantee a specific cost per admission” describes an outcome the agency does not control, since the admissions team, insurance mix, and clinical fit all decide whether a call converts.
• “Our creative doesn’t need disclosures because the landing page handles it” misreads how regulators treat character-limited ads ⁹.

Three quieter signals matter as much:

• The agency cannot name the FTC substantiation standard when asked how it vets outcome copy ².
• The agency describes testimonial workflows in emotional language — “authentic stories,” “real voices” — without producing an authorization template or a disclosure standard for material connections ³.
• The agency’s case studies report only impressions, clicks, and CPL, with no line of sight to verified benefits or admissions.

A useful closing question: ask the finalist to describe the last compliance issue it flagged to a client and how it was resolved. Agencies with real workflows have a specific answer. Agencies without them change the subject.