Hiring Guide: Finding a Health Care Marketing Agency

HHS Office for Civil Rights defines marketing as a communication about a product or service that encourages the recipient to purchase or use it, and it generally requires written patient authorization before protected health information is used or disclosed for that purpose ¹. That definition is broader than most operators assume, and it is where agency scoping conversations should begin.

The practical consequence is that common tactics behave differently under the rule. A retargeting pixel that fires on a treatment-page visitor and pushes that identifier into an ad platform’s audience is a marketing use of PHI-adjacent data, not a permitted operations activity. An email sequence sent to a list built from admissions inquiries is a marketing communication that generally requires authorization unless it fits a narrow exception. Lookalike modeling built from a seed list of prior patients pulls from the same restricted well ¹.

Certain communications fall outside the marketing definition. Case management, care coordination, and treatment communications are treated differently under the Privacy Rule’s use and disclosure framework ². An agency that cannot articulate which of its tactics touch PHI, which sit inside treatment or operations exceptions, and which require signed authorization is not ready to run a behavioral health account.

Three questions surface the answer during vendor scoping:

1. Where does form-submission data live between the website and the CRM, and who has access to it.
2. Which advertising pixels are deployed on pages that identify a visitor as a prospective patient, and what data leaves the domain in those calls.
3. Does the agency execute a Business Associate Agreement, and does its subprocessor list, from hosting to analytics to email platform, do the same.

Vendors that answer with product names rather than data flows are describing tools, not compliance. Operators should ask for a data-flow diagram before a media plan.

NIST publishes the technical playbook the vendor stack should map to. SP 800-66 Rev. 2 provides mappings of HIPAA Security Rule standards to NIST Cybersecurity Framework subcategories and SP 800-53r5 controls, giving covered entities and their business associates a concrete framework for protecting electronic PHI ⁸. NIST positions the guidance to help the industry maintain the confidentiality, integrity, and availability of ePHI across systems that touch patient data ⁷.

For a health care marketing agency, that framework applies to more surfaces than most owners realize. Web forms, call tracking platforms, CRM integrations, tag managers, and analytics warehouses all sit inside the scope. A vendor that stores intake form submissions in a general-purpose marketing automation tool without control mappings to access management, audit logging, transmission security, and incident response is running an environment that would not survive a Security Rule assessment.

Concrete questions align with the SP 800-66 Rev. 2 domains:

• Role-based access controls
• Encryption in transit and at rest
• Audit logs on systems handling inquiry data
• Documented incident response with breach notification timelines ⁸

Ask for the control mapping, not a security-page marketing claim.

The FTC’s baseline is direct. Advertisers must have adequate substantiation before disseminating objective claims, and health-related claims generally require competent and reliable scientific evidence ⁴. That standard applies to every landing page, ad headline, outcome graphic, and paid social asset an agency produces.

Claim types carry different requirements, and the audit an owner should run against existing creative maps to those categories:

• Efficacy claims (“proven to reduce relapse”) require competent and reliable scientific evidence, which for clinical outcomes generally means well-controlled human studies rather than agency-collected testimonials ⁴.
• Outcomes claims (“85% of our clients complete treatment”) require substantiation for the specific number, the population it describes, and the methodology used to derive it.
• Patient testimonials must be truthful, reflect the honest experience of the endorser, and be accompanied by clear and conspicuous disclosure when results are not typical ⁵.
• Paid endorsements, including influencer content and affiliate-style promotion, require disclosure of the material connection in plain language such as “This is an ad for BRAND” ⁵.

Behavioral health adds a second layer. AMA ethics guidance emphasizes informed consent, context, and putting patient interests ahead of promotional goals in physician branding and patient imagery ¹². It also calls for disclosure of financial interests and accuracy in social media promotion ¹³. Agencies that produce testimonial reels from clients in active or recent treatment are colliding with both FTC substantiation standards and clinical ethics norms simultaneously.

The audit is mechanical. Pull every outcome statistic on the live site and demand the underlying data. Pull every testimonial and confirm authorization, typicality disclosure, and consent boundaries. Pull every influencer or affiliate post and confirm the material connection is disclosed clearly and above the fold, not buried in hashtags. Agencies that cannot produce that documentation on request are not maintaining substantiation files, which is the first thing an enforcement inquiry asks for ⁴.

Treatment centers offering medication-assisted treatment or promoting content that names specific prescription drugs step into a second regulator’s jurisdiction. FDA’s Office of Prescription Drug Promotion enforces that prescription drug promotion must not be false or misleading and must present a fair balance of efficacy and risk information, and OPDP explicitly regulates internet-based promotion, including social media ⁶.

Fair balance is the operative concept. Landing pages, ad copy, and organic posts that name buprenorphine, naltrexone, or methadone products by brand and describe benefits without proportionate risk information are the class of asset OPDP’s Bad Ad Program was built to flag ⁶. An agency running paid social for a MAT program should be able to produce a review process that pairs efficacy language with risk disclosure on the same asset, on the same screen, at the same emphasis.

Category depth is legible in the artifacts. A behavioral health specialist produces landing pages that reflect ASAM levels of care by name, distinguishes detox from residential from partial hospitalization in intake copy, and treats co-occurring disorders as a clinical reality rather than a search keyword. A generalist shop repurposes dental or med-spa templates and swaps the hero image.

The audit is fast. Pull the agency’s client roster and count the behavioral health accounts. Pull three of their live sites and check whether the level-of-care pages describe clinical criteria for admission, typical length of stay, and what happens after discharge, or whether they read like symptom-keyword doorways. Pull the blog and look for content that would survive review by a clinical director: accurate withdrawal timelines, honest framing of MAT, and no promises about outcomes that the FTC would treat as unsubstantiated efficacy claims ⁴.

Two operational tells separate specialists from tourists:

1. The agency has a documented review process that routes clinical content past a licensed reviewer before publication.
2. It can name the specific compliance boundaries it has already navigated with prior clients, testimonial constraints, patient imagery limits under AMA ethics guidance ¹², PHI-adjacent form data, without reading from a script.

Fluency shows up as vocabulary the sales team did not have to rehearse.

Verification of benefits is where behavioral health marketing either connects to admissions or leaks. A landing page that ends in a generic contact form treats the visitor as a lead. A landing page built for admissions treats the visitor as a prospective patient with a payer, a policy number, and a narrow window of readiness.

Specialist agencies design intake flows around that reality. Insurance verification prompts sit above the fold, in-network payer logos are current rather than aspirational, and the form fields collect the minimum information needed to route the call, not a full patient history that pulls the exchange into PHI territory the agency should not be holding ¹. Copy names what happens next in operational terms: a call from an admissions coordinator, a benefits check, and a clinical assessment.

The tell during vendor evaluation is whether the agency asks about the admissions team’s VOB workflow in the first scoping call. Agencies that never ask are building pages for form-fill metrics. Agencies that ask are building pages for the admit rate.

Social media is the channel where agency pitches most often exceed what the research supports. A systematic review of systematic reviews on social media in public health and medicine found that overall evidence of effectiveness was minimal, with qualitative benefits concentrated in psychosocial support and psychological functioning rather than direct behavior change ⁹. A separate review of social media in healthcare found that patients generally use these channels to complement, not replace, professional care, and that effects on the patient-provider relationship run in both directions ¹⁰. A third review reported that social media integration in health interventions is accepted by target populations and can increase health knowledge and behavior adoption, without claiming reliable conversion outcomes ¹¹.

Those findings share a shape. Social media builds trust, extends reach, and supports engagement among people already considering care. It is not a direct-response admissions engine, and agencies that pitch it as one are extrapolating past the evidence.

The operational implication is a budget conversation. Social should be scoped as a trust and reach layer with defined qualitative goals, brand recall, community engagement, review velocity, while paid search, organic search, and call-driven channels carry the admissions number. Agencies that promise admissions from organic social should be asked to show the attribution.

The measurement chain that matters in behavioral health has four stages, and the reporting gap between specialist and generalist agencies is legible in which stage the dashboard ends at.

1. Stage one is the click. Cost per click, click-through rate, and impression share describe media efficiency at the top of the funnel.
2. Stage two is the call. Cost per qualified call is the first admissions-adjacent KPI, and it requires disposition coding to separate a prospective patient inquiry from a wrong number, a job applicant, or a family member calling to ask about visiting hours.
3. Stage three is verified benefits. VOB rate, the share of qualified calls where insurance is confirmed as in-network and covered for the requested level of care, is the KPI where marketing spend meets payer reality.
4. Stage four is the admit. Cost per verified admit is the terminal number, and it is the only figure that connects a monthly retainer to census.

CMS notes that provider directory infrastructure is designed to help patients find providers for care and treatment ³, which frames the search-to-call handoff but does not measure what happens after the phone rings. Generalist agencies typically stop reporting at stage one or stage two. Specialist agencies report through stage four, with admits reconciled monthly against the CRM. An agency that cannot show cost per verified admit in its standing report is optimizing for a proxy, and the proxy and the census will drift apart.

Call tracking is where the attribution chain either holds or fails, and it is also where HIPAA exposure often enters through the back door. A dynamic number insertion platform that captures caller identifiers, ties them to a marketing source, and pushes that pairing into an ad platform for optimization is using patient-adjacent data for marketing, which HHS OCR guidance treats as requiring written authorization absent a narrow exception ¹.

Two operational controls matter:

1. A Business Associate Agreement with the call tracking vendor, with subprocessor coverage extending to any transcription or analytics layer.
2. Disposition coding at the admissions team, where every inbound call is tagged as qualified inquiry, out-of-network, wrong number, or not a fit, so cost per qualified call is calculable rather than assumed.