Vetting a Digital Health Marketing Agency for Admissions

What Counts as Marketing Under HIPAA When an Agency Touches Patient Data

HHS Office for Civil Rights defines marketing under HIPAA narrowly, and that definition governs what an agency can and cannot do with patient data. A communication that encourages someone to purchase a product or service is marketing, and patient authorization is generally required before protected health information can be used for that purpose.¹The rule carves out specific exceptions: communications about the individual’s own treatment, case management, care coordination, face-to-face communications between the covered entity and the patient, and nominal-value promotional gifts.¹

The exceptions are where agencies get sloppy. An appointment reminder is a treatment communication. A branded remarketing ad served to a former alumni email list is not. A testimonial page featuring a named patient is not. A paid social campaign that segments audiences from a call-tracking log tied to intake data is not. HHS is explicit that even where disclosure would otherwise be permitted, PHI cannot be disclosed in exchange for remuneration without authorization.⁹That single clause reshapes any campaign built on shared data with a paid vendor.

The vetting question a CMO should ask directly: for every campaign asset the agency proposes, which HIPAA category does it fall into, and where is the written authorization if the category is marketing? An agency that cannot answer that question at the tactic level — retargeting audience, lookalike model, testimonial video, alumni email drip, review-solicitation flow — is not operating a defensible workflow. The map below tracks common admissions-marketing outputs against the HHS/OCR authorization boundary, and it should sit inside the diligence file the agency delivers, not inside the agency’s head.

The infographic accompanying this section maps common communication types against the HHS/OCR authorization requirement, drawn from the marketing definition and its exceptions.¹

Pixels, Call Recordings, and Remarketing Audiences: The Documentation to Demand

Three artifacts carry most of the day-to-day PHI risk in behavioral health admissions marketing:

• tracking pixels installed on treatment-related pages,
• recorded intake calls routed through third-party call-tracking systems, and
• remarketing or lookalike audiences built from site behavior and CRM data.

Each one is a covered vendor workflow, and each one demands specific documentation before a contract is signed.

For pixels, the agency should produce a page-by-page inventory of what third-party tags fire on the domain, what parameters those tags transmit, and which pages are excluded because they carry indicators of a person seeking treatment. Meta, Google, TikTok, and programmatic pixels placed on a “verify insurance” form or a “detox program” landing page can transmit URL strings, form values, or IP-linked identifiers that function as PHI in context. HHS has been clear that combining identifying data with information suggesting someone is seeking care can meet the definition of PHI, and disclosing that in exchange for ad platform value implicates the remuneration rule.⁹

For call recordings, the agency should document the call-tracking platform’s Business Associate Agreement, retention schedule, transcript-handling workflow, and whether recordings are used to train audience models or fed back into ad platforms. A recording is a marketing asset the moment it becomes an input to targeting.

For remarketing and lookalike audiences, the agency should show the source list construction: what event triggered inclusion, whether the seed data was hashed before upload, and whether any authorization was obtained for individuals whose data is used to build the model. If the answer is that lookalikes are built from admitted-patient CRM records without authorization, the workflow is misaligned with HIPAA’s marketing rule.¹

Screening for Overstated HIPAA Credentials

A CMO screening for overstated credentials should ask three questions:

1. Has the agency signed a Business Associate Agreement with the treatment center, and does it name the specific services covered?
2. Can the agency point to the actual HHS/OCR text supporting its interpretation of a given practice, rather than a summary produced by a compliance-training vendor? OCR says its guidance materials are produced directly by OCR or reviewed by OCR before publication, and any interpretation an agency offers should trace back to that source.³
3. Does the agency’s own marketing materials imply HHS approval, a “HIPAA seal,” or partnership with a federal agency? Those signals correlate with the misleading-claims problem OCR has flagged.³

Credentials are not the standard. Documentation is.

Outcome Claims, Success Rates, and Before-and-After Language

The FTC applies one standard to health advertising: objective claims must be truthful, not misleading, and backed by competent and reliable scientific evidence.²That standard travels with the advertiser, not the agency. A treatment center that publishes a “73% success rate” on a landing page owns the substantiation file behind that number, and the agency that wrote the copy is a co-author of the risk.

The diligence question is procedural. When an agency proposes outcome language — completion rates, sobriety milestones, relapse reduction, “evidence-based” program descriptions — the CMO should ask to see the substantiation memo the agency intends to keep on file. What population produced the number? What measurement window? What follow-up methodology? Are the survey respondents self-selected? A defensible file references internal outcomes data, its collection method, and any qualifiers a reasonable reader would need to interpret the claim honestly. An agency that shrugs at the question, or that offers to “soften” the number into a “research-informed approach” without changing the underlying substantiation problem, is describing a workflow that puts the center on the wrong side of the FTC’s evidence requirement.²

Before-and-after language deserves particular scrutiny. Any claim that implies a typical result — recovery odds, quality-of-life improvement, family-reunification outcomes — is an objective claim under the FTC framework and requires evidence proportional to the specificity of the promise.²Vague inspirational copy is not a substantiation strategy; it is a red flag that the agency has not built one.

Testimonials, Endorsements, and Social Proof Under Advertiser Liability

Testimonials are where FTC exposure and HIPAA exposure converge, and where agencies most often understate the operational lift required to run them cleanly. The FTC holds advertisers liable for misleading endorsements across social media and other channels, including endorsements that fail to reflect typical results or that omit material connections between the endorser and the advertiser.²A former patient posting a five-star recovery story after receiving a free anniversary gift, a discounted alumni retreat, or any nominal benefit has a material connection that must be disclosed.

Two documents belong in the diligence file for any testimonial program the agency proposes to run:

1. The endorser workflow: how patients are approached, what authorization is obtained under HIPAA before their story appears anywhere the agency controls, and how the center documents that the endorsement reflects the endorser’s honest experience.¹
2. The typicality file: what evidence supports that the outcome described is representative, or, if it is not, what disclosures accompany the endorsement.²

Paid influencer campaigns, alumni-referral programs with any form of compensation, and review-solicitation flows that offer incentives all intersect with the same rules. An agency proposing to seed reviews, gate incentives on positive ratings, or run a testimonial campaign without a documented authorization-and-typicality workflow is proposing a campaign the center cannot defend.

Pay-Per-Admission, Per-Lead, and Referral-Style Arrangements

Compensation structure is the fastest way to disqualify a digital health marketing agency. When a vendor proposes a fee tied to admissions, verified leads, or completed intakes, that arrangement moves from advertising into territory federal regulators have flagged for decades. The Federal Register’s anti-kickback safe-harbor rulemaking is explicit: remuneration may not be used for the purpose of marketing items or services or for patient recruitment activities.⁷OIG framed the same concern earlier, noting that many marketing and advertising activities may involve remuneration that can implicate the anti-kickback statute when tied to referrals.⁸

The practical translation for a CMO is straightforward. A flat monthly retainer for media management, content production, or SEO work sits inside the permitted zone. A variable fee that scales with admissions, insurance verifications converted to intake, or qualified phone calls attributed to a specific patient sits outside it. The economic logic is identical to a referral fee, and the regulatory analysis follows the money, not the invoice line item’s label.

Three arrangement patterns should end the conversation:

1. Per-admission bonuses layered on top of a base fee, which reintroduce the referral incentive the safe-harbor rules were written to prevent.⁷
2. Shared-revenue models where the agency takes a percentage of collections tied to campaigns it ran.
3. Third-party lead aggregators that sell exclusive intake calls priced per verified insurance benefit, then split economics with the marketing agency that placed the ads.

Each pattern involves remuneration for what is functionally patient recruitment.^{7, 8}

HIPAA compounds the exposure. When PHI is involved in the workflow that generates the compensated lead — an intake note, a benefits verification, a call recording tagged with clinical information — the HHS/HITECH rule against disclosing PHI in exchange for remuneration attaches directly.⁹An agency comfortable proposing pay-per-admission is often equally comfortable moving patient data through the pipeline that justifies the invoice.

The infographic accompanying this section contrasts permitted outreach structures against the remuneration-based patient-recruitment models federal regulators have identified as high-risk, drawn from the anti-kickback rulemaking record.^{7, 8}

Portfolio Operators: Where a Single Agency Workflow Compounds Risk

For CMOs at multi-facility, multi-state treatment groups, the vetting math changes. A single agency workflow — one retargeting pixel, one testimonial page template, one pay-per-admission compensation schedule — replicates across every facility on the roster the moment the master services agreement is signed. That is the compounding problem portfolio operators inherit that single-site CMOs do not.

Consider the mechanics. A shared pixel deployed across ten facility domains transmits the same PHI-adjacent parameters ten times, and HHS treats disclosure of PHI in exchange for platform value as a remuneration event whether the domain count is one or fifty.⁹A national testimonial page template that omits authorization workflow creates ten sites of exposure under the HIPAA marketing rule, not one.¹A pay-per-admission arrangement negotiated at the parent level applies the same remuneration-for-recruitment structure to every facility, and the anti-kickback analysis runs per-facility.⁷

The diligence adjustment is procedural. Portfolio CMOs should require the agency to document workflow-per-facility rather than workflow-per-contract: which pixels fire on which domains, which authorization language applies to which patient population, which state licensing conditions affect which testimonial. An agency that pitches “one system across the portfolio” without that facility-level granularity is offering scale that magnifies the exposure it cannot see.

How FindTreatment.gov, the National Directory, and the Helpline Shape Intent-Stage Traffic

Paid media is not the top of the funnel in behavioral health. It is one layer inside a federal discovery stack that most agencies underweight because it does not show up cleanly in a media dashboard. A prospective patient — or, more often, a family member calling on behalf of one — moves through public referral pathways before, during, and after any ad exposure. An agency that models admissions demand only from Google Ads impressions and organic keyword volume is working with an incomplete map.

SAMHSA’s FindTreatment.gov is the federal locator for substance use and mental health services. Searches can be filtered by state, county, and distance from a specific location, which means a facility’s inclusion, address accuracy, and service tagging inside the tool directly influence whether it appears in the geographically constrained results a searcher receives.⁴The 2025 National Directory of Mental Health Treatment Facilities builds its records from facility responses to the 2024 National Substance Use and Mental Health Services Survey, so what a facility submits to SAMHSA becomes the record a caller, referrer, or state agency sees.⁵Earlier directory guidance notes that the online listing is updated more frequently than the static PDF version, which matters because printed and cached copies circulate long after facility details change.⁶

The SAMHSA National Helpline sits alongside the directory as a free, confidential, 24/7, 365-day-a-year treatment referral and information service.¹¹It routes callers to state services and local providers, competing with and complementing paid intent capture at the exact moment a family decides to act. Callers who dial the helpline first are not addressable through a retargeting pixel, and they will not show up in a paid-search attribution report.

The infographic accompanying this section maps that federal discovery stack — FindTreatment.gov, the 2025 National Directory, the National Helpline, and organic and paid search — so a CMO can see where an agency’s scope currently ends and where intent-stage traffic is being formed outside the agency’s field of view.^{4, 5, 11}

Facility Data Hygiene as an Agency Scope Question

If federal directories shape intent-stage traffic, the accuracy of what a facility submits to them belongs inside the marketing agency’s scope, not adjacent to it. The 2025 National Directory is built from N-SUMHSS survey responses, and any drift between what a facility reported and what its current programs actually deliver becomes a public data problem the moment a caller filters by service type.⁵

A defensible agency scope should name three ownership questions in writing:

1. Who updates the facility’s N-SUMHSS response and FindTreatment.gov record when a program, license, or level of care changes.⁴
2. Who reconciles the online SAMHSA listing against the static PDF directory copies still circulating with referrers.⁶
3. Who monitors service-tag accuracy — medication-assisted treatment, adolescent services, co-occurring capacity — against what admissions actually accepts today.

An agency that treats federal directory hygiene as the facility’s problem is scoping around demand it does not want to be measured against. An agency that owns it produces a quarterly reconciliation memo the CMO can hand to a state auditor.