Marketing Medical Services for Patient Acquisition

Patient acquisition in behavioral health has quietly become an integration problem, not a channel problem. The centers gaining census in 2025 are the ones whose marketing promises match what happens when the phone actually rings, and whose measurement stack can prove attribution without leaking protected health information to ad platforms. Everything else is a lawsuit exposure or a wasted media budget.

Three forces have reshaped the operating context in the past 24 months. First, federal enforcement moved from theoretical to concrete. The FTC has brought named actions against addiction-treatment marketers for search-ad impersonation, deceptive referral claims, and sharing sensitive health data with advertising platforms, with civil penalties reaching $3.8 million in the R360 matter alone ¹¹. Second, HHS Office for Civil Rights issued detailed guidance on how HIPAA applies to pixels, cookies, and analytics tools on healthcare websites, forcing a rebuild of most attribution stacks that once relied on standard Meta and Google tags ². Third, the FTC’s Consumer Reviews and Testimonials Rule took effect October 21, 2024, authorizing civil penalties for knowing violations involving fake reviews, incentivized sentiment, and undisclosed insider endorsements ⁶.

None of these developments changed what a CMO is trying to do. They changed what a defensible acquisition program looks like when admissions, compliance, clinical, and legal all have to sign off on the same operating model. Media mix, creative testing, and CPA targets still matter. They just no longer sit above the compliance layer; they run through it.

The sections that follow treat patient acquisition as a joint operating model across demand sizing, enforcement risk, admissions handoff, access, measurement, reputation, and portfolio economics — grounded in the evidence a CMO can defend to a board.

Most behavioral health TAM decks conflate two audiences that behave very differently in a funnel. The CDC’s 2024 National Health Interview Survey found that 19.3% of U.S. adults took medication for their mental health in the prior 12 months, while 14.0% received counseling or therapy from a mental-health professional in that same window ¹. Those figures describe adults already engaged in some form of mental-health treatment. They do not describe adults searching for a residential SUD program, and they do not describe families trying to place a loved one this week.

The distinction matters for media planning. A campaign that treats every mental-health query as an in-market signal will burn budget on people whose next action is a refill request to a prescriber they already have, not an inbound call to an admissions line. Segmenting the two audiences by intent, condition, payer mix, and stage of decision keeps CPA math honest and prevents the common error of treating aggregate mental-health prevalence as addressable demand for a specific level of care.

The evidence on how prospective patients actually behave online reinforces the segmentation argument. A meta-analysis of 44 studies covering 54 empirical samples identified perceived quality, trustworthiness, and utility as the dominant predictors of online health-information seeking, with instrumental factors outweighing psychological ones ¹⁶. In practical terms, the person researching a condition wants a different asset than the person comparing programs, and both want something different than the person ready to verify benefits. A single content library that collapses these stages into generic “treatment” pages under-serves each of them.

A defensible demand model for a behavioral health CMO separates three streams:

• Educational search from adults exploring symptoms or medications
• Comparison search from families evaluating providers
• High-intent search tied to admission, insurance, and geography

Each stream carries its own creative brief, landing structure, and downstream metric. Only the third should be judged on cost per qualified VOB. The first two should be measured on assisted contribution and organic pipeline built over quarters, not weeks.

Four FTC actions in the past three years have redrawn what an addiction-treatment marketing program can defensibly do. Read together, they map to the exact tactics most centers still use every day: search advertising, referral networks, admissions telemarketing, and pixel-based conversion tracking.

The earliest of the four, R360, produced a $3.8 million civil-penalty judgment in May 2022 for alleged misrepresentations about how treatment centers in a referral network were evaluated and selected ¹¹. The Commission cited the Opioid Addiction Recovery Fraud Prevention Act of 2018, which authorizes civil penalties for unfair or deceptive acts involving SUD treatment services, referrals, and recovery housing ¹². The operational read for any CMO running a partner or referral program: claims about clinical matching, expert selection, or individualized placement now need documented criteria and consistent execution, not marketing language written after the fact.

The Monument settlement in April 2024 shifted the focus from referral claims to data flows. The FTC alleged that Monument disclosed personal information to third-party advertising platforms through pixels and APIs from 2020 to 2022, including data revealing that users were receiving help to recover from alcohol addiction, and imposed a $2.5 million civil penalty that was suspended based on inability to pay ⁸. The proposed order included a prohibition on sharing health data for advertising. That is a bright line for every conversion pixel, custom audience upload, and remarketing list currently running against SUD landing pages.

Two 2025 complaints extended the pattern into paid search itself. In January, the FTC sued Evoke Wellness and its executives, alleging that search ads and telemarketing caused consumers to believe they had contacted specific treatment providers when they had instead reached Evoke-related operations ⁹. In June, the Commission filed a similar complaint against Mercury Marketing, alleging clinic impersonation in Google search ads that deceptively routed consumers seeking particular SUD providers to the defendants’ clinics ¹⁰. Both matters remain allegations, not final adjudications, but they signal where enforcement attention now sits: brand-term bidding, ad-copy identity, phone-number ownership, landing-page attribution, and the exact words admissions counselors say when the call connects.

The through-line across all four cases is that the deceptive act was not the campaign concept. It was the gap between what the ad, referral, or pixel implied and what the operation actually did. For a CMO, that translates into three concrete controls:

1. Written substantiation files for every objective claim in market, consistent with the FTC’s health-advertising substantiation standard ⁵
2. Documented ownership of every domain, phone number, and Google Ads account tied to a facility name
3. A call-center script audit that confirms admissions counselors identify the clinic accurately on every inbound call

None of this is optional strategy. It is the minimum documentation required to defend an active campaign if a Civil Investigative Demand arrives.

A media plan can deliver a qualified inbound call and still lose the admission in the first ninety seconds. The evidence that the failure point sits inside the operation, not the campaign, comes from a 2024 mystery-shopper audit of community behavioral-health providers in a large urban county: callers could schedule an appointment in only 17% of contacts, and just 38% of schedulers reported that their center offered trauma-informed therapy ¹⁷. The study covered outpatient community providers in one metropolitan area, so the specific rate should not be generalized to residential SUD admissions nationally. What generalizes is the pattern. When researchers phoned providers the way a prospective patient would, most attempts ended without a scheduled visit.

For a CMO measuring cost per qualified VOB, that pattern reframes the P&L. Every dollar spent moving a prospect from impression to click to call is exposed to a downstream conversion step the marketing team does not control: whether the phone is answered, whether the counselor confirms clinical fit, whether the modality the caller needs is actually available this week, and whether the scheduler can navigate insurance without dropping the call. If any of those steps fails at scale, media efficiency ratios will look like a targeting problem when the defect is operational.

Three controls make the handoff auditable rather than assumed:

1. Weekly joint review of call recordings and dispositions between marketing and admissions leadership, scoped to inbound calls sourced from paid and organic channels. Recording and retention must be structured around HIPAA and 42 CFR Part 2 obligations for SUD program records ⁴, which shapes what can be stored, who can listen, and how disposition data can be shared with vendors.
2. A script audit that confirms counselors identify the specific facility on every call — the exact control point the FTC’s Evoke Wellness and Mercury Marketing complaints put in the spotlight ^{9, 10}.
3. A service-availability feed from the clinical operations team into the ad and landing-page layer, so campaigns for a level of care pause automatically when that program is at capacity or when a promised modality, such as trauma-informed therapy, is not currently staffed.

The measurable output of this handoff is not lead volume. It is the percentage of marketing-sourced calls that reach a scheduled admission, tracked by channel, by campaign, and by day of week. That number, not CPL, is the ceiling on what any media investment can produce.

Access is a conversion factor before it is an equity issue. A prospective patient who cannot schedule in their preferred language, cannot reach a live scheduler, or cannot use the website with a screen reader is a lost admission regardless of how the ad performed. Three access variables carry the most weight for a behavioral health CMO: caller language, care modality, and web usability.

Language access is where the gap is most measurable. A 2025 secret-shopper study of outpatient behavioral-health services for children found that among facilities contacted in both languages, 71% attempted to schedule an English-language caller compared with 24% for a Spanish-language caller, and only 25% communicated with Spanish-language callers in their preferred language ¹⁸. The study focused on Pennsylvania children’s services and Medicaid-insured families, so residential SUD operators should localize the test before generalizing the numbers. What the finding establishes is that a translated landing page does not create language access. Access is created by a bilingual scheduler picking up the phone during the hours the ad is running. A parallel California safety-net study found that 22% of Spanish-speaking callers who reached a live scheduler encountered someone who did not engage and could not provide appointment information ¹⁹. Marketing spend directed at Spanish-language keywords should be gated on staffed bilingual coverage during those campaign hours, not on Spanish-language creative alone.

Modality is the second variable. A New York City behavioral-health clinic that transitioned to telemedicine saw an adjusted odds ratio of 1.92 for visit completion in 2020 versus 2019 ²⁰. The finding is clinic-specific and does not transfer to residential admissions, but for outpatient and IOP levels of care where telehealth is clinically appropriate, offering a telehealth intake option measurably reduces the drop between scheduled and completed visits. The California safety-net data showed 64% of clinics offering both telehealth and in-person visits, which is now the baseline expectation for outpatient acquisition pages ¹⁹.

The third variable is the website itself. DOJ web-accessibility guidance identifies the practical baseline for a public-facing site ²¹:

• Sufficient color contrast
• Alternative text for images
• Video captions
• Structured headings
• Keyboard navigation
• A mechanism for reporting accessibility problems

For admissions pages, the operational read is narrower: forms that fail keyboard navigation, phone numbers embedded as images without alt text, and video testimonials without captions each remove a segment of the addressable audience before the call ever happens. Access audits belong on the same quarterly cadence as conversion-rate testing, not on a separate legal-review track.

Most treatment-center measurement stacks were built when a Meta Pixel on a thank-you page was considered attribution best practice. That era ended when HHS Office for Civil Rights clarified that tracking technologies on healthcare websites can disclose protected health information whenever a page visit, form field, IP address, or device identifier reveals a connection between an individual and past, present, or future care ². For a behavioral health CMO, the practical read is that a standard pixel on a level-of-care landing page, an insurance-verification form, or a scheduling confirmation almost certainly transmits data the vendor cannot use for marketing without a business associate agreement and an applicable HIPAA permission.

HIPAA’s marketing definition tightens the frame. Communications that encourage a person to purchase or use a product or service are marketing, and using PHI to build audiences, seed lookalikes, or retarget prospects generally requires written authorization from the individual ³. Uploading a hashed list of prior inquirers into an ad platform, or firing a conversion event that identifies a user as an SUD-treatment prospect, is exactly the pattern the FTC alleged against Monument when it imposed a $2.5 million civil penalty and prohibited the company from sharing health data for advertising ⁸. For any facility subject to 42 CFR Part 2, the constraint is stricter still: records that identify a person as having sought or received SUD services carry heightened use-and-disclosure restrictions that apply to call recordings, CRM entries, and vendor integrations, not just clinical files ⁴.

The programs that will keep running paid media at scale are the ones that rebuild measurement around four controls:

• Consented first-party data collection replaces implicit pixel firing on sensitive pages.
• Server-side tagging routes conversion signals through a controlled endpoint that strips identifiers before anything reaches an ad platform.
• Signed BAAs cover every vendor touching call recordings, form data, or CRM records, including analytics, call-tracking, chat, and A/B-testing tools.
• PHI-scrubbed conversion events report only what the platform needs to optimize — a bid signal, a channel tag, a de-identified conversion value — not the condition, program, or intake status of the caller.

Rebuilt this way, measurement becomes a competitive advantage rather than a liability. Centers that can prove attribution without exposing sensitive data can keep bidding on high-intent terms, keep running remarketing to educational content, and keep testing landing pages, while competitors pull campaigns down under legal review or operate blind on outcome-agnostic vendor defaults. The moat is not the technology stack itself. It is the documented ability to defend every data flow if a Civil Investigative Demand or an OCR inquiry arrives, and to keep spending confidently in the meantime.

Reviews and educational content sit on the same conversion path, and both are now regulated more tightly than most treatment-center marketing teams have adapted to. A systematic review of 63 studies on patient online reviews concluded that reviews have grown significantly and increasingly shape how patients choose healthcare providers ¹⁴. A controlled survey experiment quantified the effect: moving a physician’s rating from 2 to 4 stars increased the relative log odds of being chosen, and participants weighted commercial nonclinical ratings as heavily as government clinical ratings ¹⁵. The experimental setup does not replicate a family choosing a residential program at 2 a.m., but the direction is clear enough to treat star rating as a live conversion variable, not a vanity metric.

The regulatory frame around that variable changed on October 21, 2024, when the FTC’s Consumer Reviews and Testimonials Rule took effect and authorized civil penalties for knowing violations ⁶. The prohibited-conduct list reads like a catalog of common reputation-management shortcuts ⁷:

• Buying or selling fake reviews
• Compensating reviewers on the condition of a particular sentiment
• Publishing undisclosed insider testimonials from employees or their relatives
• Operating a review site that claims to be independent while it is controlled by the business
• Suppressing negative reviews through intimidation or unjustified legal threats
• Fake social-media indicators such as purchased followers or engagement

The operational read for a CMO running a review program is that solicitation is still permitted; direction of sentiment is not. Asking every discharged patient for honest feedback is different from asking satisfied patients only, and different again from offering a gift card contingent on a five-star post. Alumni testimonials used in advertising need documented authorization consistent with HIPAA’s marketing definition, since a communication that encourages someone to use a service is marketing and generally requires written permission before PHI is used ³. For facilities subject to 42 CFR Part 2, the additional constraint is that a testimonial identifying a person as a former SUD patient is itself a Part 2 record, and its use requires consent that meets the regulation’s specific requirements ⁴.

Educational content operates under a parallel set of substantiation rules. The FTC’s health-advertising guidance requires competent and reliable scientific evidence for objective health claims before an ad is disseminated, and a disclaimer will not reliably cure a misleading headline or an implied outcome promise ⁵. Success-rate statistics, sobriety percentages, and completion figures used on landing pages, in ad copy, or in organic content need a documented substantiation file that predates publication. Content that avoids outcome claims and instead explains conditions, levels of care, insurance verification, and what to expect during intake performs a different job: a meta-synthesis of 48 studies found that online health information was associated with patients asking better questions during consultations, more professional visits, and improved adherence to physician advice ¹³. That kind of educational asset supports the decision without making a claim the marketing team cannot defend on paper.

The practical program has four moving parts:

1. A review-solicitation workflow that requests feedback from every eligible former patient or family member, records the request neutrally, and routes negative reviews to service recovery rather than to suppression.
2. A monitoring layer that reads reviews for recurring operational signals — call wait times, admissions responsiveness, billing clarity — and feeds them back to the operations team, since the systematic review evidence suggests reviews often surface service issues before internal QA does ¹⁴.
3. A substantiation library that pairs every outcome or expertise claim in market with the underlying evidence and the date it was reviewed.
4. An alumni-content process built on documented authorizations that satisfy both HIPAA and Part 2, with an internal veto on any testimonial that implies a guaranteed result.

Programs built this way keep the conversion lift that reviews and content produce while removing the specific practices the FTC has now made penalizable.

The audience narrows here. Multi-facility operators — regional groups, private-equity-backed platforms, and health-system service lines with three or more sites — carry a different math problem than single-site CMOs. Every facility that runs its own ad account, its own pixel configuration, its own review-solicitation workflow, and its own admissions script multiplies the enforcement surface without a proportional gain in census. A siloed portfolio is not just inefficient; it is the operating structure the FTC has repeatedly reached into, from R360’s referral-network claims ¹¹to the search-ad impersonation alleged against Mercury Marketing across affiliated clinics ¹⁰.

Centralization changes the unit economics along three axes:

1. A single measurement layer — server-side tagging, PHI-scrubbed conversion events, one BAA stack covering analytics, call-tracking, and CRM — replaces per-facility pixel configurations that HHS tracking guidance flags as high-risk when deployed on level-of-care or scheduling pages ².
2. One substantiation library governs every outcome claim in market, so an ad running for a Florida IOP and an Arizona residential program answers to the same evidence file under the FTC’s health-advertising standard ⁵.
3. A shared review-solicitation and monitoring workflow keeps each site inside the Consumer Reviews and Testimonials Rule instead of relying on facility-level marketers to interpret it independently ⁶.

The directional shifts a portfolio should expect from consolidation, using variables rather than invented benchmarks:

None of these deltas require inventing a cost-per-admission benchmark to justify the model. The financial case sits on two anchors already in the record: the $3.8 million R360 civil-penalty judgment ¹¹and the $2.5 million penalty in the Monument matter ⁸. Both are framing for risk, not performance targets. A centralized layer is what makes those numbers avoidable across a portfolio rather than a single site.

Pulling the preceding sections into one operating model gives a behavioral health CMO a defensible answer to the board question that eventually arrives: what does the marketing program actually do, and how do you know it works? The answer runs across six coordinated layers rather than a media plan.

Demand segmentation sets the ceiling. Educational, comparison, and high-intent streams get their own creative, landing structures, and downstream metric, with only the third judged on cost per qualified VOB. Enforcement controls sit underneath every active campaign: substantiation files for objective claims ⁵, documented ownership of every domain and phone number tied to a facility name, and script audits that confirm accurate clinic identification on inbound calls. The admissions handoff is measured weekly on the percentage of marketing-sourced calls that reach a scheduled admission, not lead volume. Access is treated as a conversion variable, with bilingual scheduler coverage gated to the hours Spanish-language campaigns run and telehealth intake offered wherever clinically appropriate. Measurement runs through server-side tagging, signed BAAs, and PHI-scrubbed conversion events consistent with HHS tracking guidance ². Reputation is managed through neutral solicitation and monitoring inside the Consumer Reviews and Testimonials Rule ⁶.

Built this way, the acquisition program is auditable end to end. That is the standard partners like Active Marketing work to when marketing, admissions, compliance, and clinical leadership all need to sign the same operating model.