Profitable Healthcare Paid Search for Treatment Centers

Three FTC actions in eighteen months redrew the risk map for treatment center paid search. In April 2024, the Commission settled with Monument, Inc., an alcohol addiction treatment service, over allegations that it disclosed users’ personal health information to Meta and Google for advertising without affirmative consent. The order banned Monument from disclosing health information for advertising and required affirmative consent before sharing any such data with third parties.⁹ The remedy targeted the ad-tech plumbing itself, not a specific creative claim.

In January 2025, the FTC sued Evoke Wellness and its top executives for using deceptive Google search ads and telemarketing to masquerade as other SUD treatment providers.⁸ The complaint moved the enforcement lens directly onto the search results page, treating paid search ad text as a primary surveillance surface. The FTC’s follow-up commentary framed the Evoke settlement as a template for how it will apply the Opioid Addiction Recovery Fraud Prevention Act to deceptive addiction-related marketing going forward.¹⁰

The escalation continued with a stipulated order against Mercury Marketing and its principals, permanently enjoining them from participating in the advertising, marketing, promotion, or sale of SUD treatment services.¹¹ A permanent industry ban on a marketing operator is the most severe remedy available short of criminal referral, and it landed on a paid-search-driven lead generation business.

Read as a sequence, the actions climb a clear ladder:

1. Consent-order remediation of ad-tech data sharing at Monument,
2. A federal complaint over deceptive search ad copy at Evoke, and
3. A permanent industry ban at Mercury Marketing.

Each step raised the ceiling on remedy severity while widening the surface area under review. The pattern gives CMOs a defensible planning assumption. FTC scrutiny of SUD paid search is neither episodic nor confined to the smallest bad actors. It is directed at the same channels, tactics, and vendors that produce the majority of admissions calls for the category.

The enforcement curve changes what a bid actually buys. When a claim in ad copy carries a plausible OARFPA exposure, the effective cost of that click is the CPC plus the probability-weighted cost of remedy. When a conversion pixel captures identifiable page views on treatment-service URLs without a business associate agreement in place, the measured conversion may not be usable for optimization without triggering the same data-sharing pattern the Monument order restricted.⁹ Neither cost shows up in the Google Ads interface, and both directly compress cost per verified benefits check and cost per admission.

That is why compliance now belongs upstream of the bidding decision. The choice of which conversion action to import, which audience to build, and which headline variant to test determines whether a campaign can be measured and defended at all. Legal review after launch cannot recover the learning-phase spend lost to a paused ad group or a rejected disapproval appeal. CMOs who wire substantiation, consent, and account-structure decisions into the campaign brief price these constraints before the auction, rather than absorbing them as unmodeled variance in monthly reporting.

The FTC applies a single evidentiary bar to health-related advertising: objective claims must be backed by competent and reliable scientific evidence at the time the claim is made.³ For treatment center paid search, that standard governs every headline, description, and landing page block that asserts a measurable clinical result. A stated success rate, a completion percentage, a relapse-reduction figure, or a comparative outcome claim is an objective claim, not a marketing flourish, and the substantiation file needs to exist before the ad enters the auction.

The Commission’s Health Products Compliance Guidance clarifies what that evidence looks like in practice. Advertisers of health services must ensure claims are truthful, non-misleading, and supported by adequate substantiation, with the type and amount of evidence calibrated to the specificity of the claim.⁶ A general statement that a program uses cognitive behavioral therapy is a lower-substantiation claim than a statement that seventy-eight percent of patients maintain sobriety at twelve months. The second requires study documentation the marketing team can produce on demand.

Implied claims carry the same weight as express ones. A landing page that pairs a stock photograph of a smiling family with the phrase “lasting recovery” implies an outcome the FTC can read as a durability claim.⁶ Treatment center CMOs building the substantiation file before creative review, rather than after a disapproval, keep the campaign optimizing on measurable actions instead of stalling on rewrites.

The Commission’s OARFPA enforcement record supplies a specific vocabulary of flagged phrases. The first OARFPA case targeted a marketer’s representations that it connected consumers with “handpicked” facilities and “cream of the crop” treatment centers selected based on individualized needs, when the selection was driven by referral economics rather than clinical criteria.⁷ Any ad copy that implies curated clinical matching without a documented, disclosed methodology now sits in the same category the FTC has already litigated.

Three claim patterns account for most of the exposure treatment center CMOs currently carry:

• Selection and matching language. “Handpicked,” “cream of the crop,” “top-rated,” and “best-in-class” imply an objective comparative process. Without a documented methodology and supporting data, the FTC treats these as unsupported superiority claims.⁷
• Outcome percentages. Specific success rates, sobriety percentages, and completion figures require competent and reliable scientific evidence tied to the population and time horizon stated.³ A twelve-month outcome number cited without a twelve-month study is a deceptive claim on its face.
• Personalization claims. “Personalized matching” and “individualized placement” imply a clinical assessment. If the intake process is a marketing form followed by a call center script, the claim overstates what the operation delivers.⁶

Competitor keyword bidding is a standard paid search tactic in most industries. In SUD treatment, the Evoke Wellness complaint moved parts of that playbook into enforcement territory. The FTC alleged that Evoke used deceptive Google search ads and telemarketing to masquerade as other substance use disorder treatment providers, capturing calls intended for competing facilities.⁸ The line the Commission drew is not around bidding on a competitor’s brand term, but around ad copy and call handoff that leave a caller believing they have reached the facility they searched for.

Three operational controls keep competitor bidding on the defensible side of that line:

• Display URLs and headlines should identify the advertising facility clearly, not echo the searched brand.
• Call center scripts should confirm the actual facility name in the opening seconds, before insurance verification begins.
• Landing pages served from competitor-term ad groups should not mirror the visual identity of the searched provider.

The Mercury Marketing order shows what happens when those controls fail at scale: a permanent industry ban that removes the operator from SUD marketing entirely.¹¹ For CMOs, the practical takeaway is to treat competitor campaigns as the highest-scrutiny surface in the account and to audit ad copy, call routing, and landing page identity together, not as separate approval workflows.

The March 2024 OCR bulletin resolved a question treatment center marketers had been finessing for years. When a tracking technology has access to information about an individual seeking care on a covered entity’s website, the data it collects can qualify as protected health information, and the HIPAA Rules apply to how it is collected, used, and disclosed.¹ The clarification did not create a new rule. It closed a loophole that had let pixel-based conversion tracking run on treatment service pages as if it were ordinary web analytics.²

Inside a paid search funnel, that determination lands on specific data points differently. A landing page URL for a residential detox program, combined with an identifier such as an IP address or cookie ID, meets OCR’s test for identifiable information tied to health status.¹ A form field capturing insurance details or a substance of concern is PHI the moment it is submitted. A pixel event that fires on an admissions inquiry page and transmits the URL and device identifier to an ad platform is a disclosure of PHI unless a business associate agreement covers the recipient, which the major ad platforms do not sign.¹

Two elements sit on a narrower line. General site traffic on an educational blog post about addiction may or may not trigger the rule depending on whether an identifiable individual is seeking care versus researching in the abstract.¹ Remarketing audience membership built from treatment page visitors is functionally a disclosure that the individual was on a health-service page, which OCR treats as PHI when combined with any identifier.¹ A column-by-column PHI map, produced once and shared with engineering and legal, converts these determinations from repeated legal questions into a standing configuration document.

Once the PHI map is set, the measurement stack rebuilds around three components:

• Call tracking that keeps identifiable health context out of ad platform reporting,
• Server-side conversion imports that send only the signals needed for bidding, and
• Consent gates that document affirmative permission before any third-party sharing occurs.

The Monument order made the last component non-negotiable by requiring affirmative consent before health information is shared with third parties for advertising.⁹

Call tracking carries most of the load. A dynamic number insertion system routes calls from paid search sessions to trackable lines, records the keyword and campaign that produced the call, and hands the admissions team a lead with attribution attached. The critical design choice is what leaves the tracking system. The ad platform needs a conversion event and a value, not a recording, a transcript, or a URL that names the clinical service. Server-side conversion imports, configured through the ad platform’s offline conversion API, let the marketing team send a hashed identifier and a conversion type without exposing the underlying call content or the specific landing page path.

Consent gates sit in front of any browser-side tag that could transmit identifiable data. The gate needs to be affirmative, not implied by continued browsing, and the record of consent needs to persist in a system the compliance team can audit. HHS requires covered entities to implement administrative, technical, and physical safeguards around PHI, and the consent log is part of that record.⁵ A stack built to these specifications reports fewer raw conversions than a legacy pixel setup, but every reported conversion is one the CMO can defend and optimize against without carrying the remedy risk the Monument order established.⁹

Pixel-based remarketing to treatment page visitors is the tactic the OCR guidance most directly disrupts. An audience built by dropping a cookie on visitors to a residential program page discloses to the ad platform that those users were on a health-service page, which the bulletin treats as PHI when paired with any identifier.¹ The Monument order showed what remediation of that pattern looks like when it runs without affirmative consent.⁹

Consent-gated audiences replace the default flow. A visitor who submits a form, checks an affirmative consent box specifying that their information may be used to send follow-up marketing, and is then added to a first-party list is a documented, defensible audience member. That list can be uploaded to the ad platform through a customer match interface as a hashed record, keyed off the identifier the user provided rather than a covert pixel event.

The tradeoff is volume. Consent-gated audiences are smaller than pixel-based ones by an order of magnitude in most treatment center accounts. The offset is that every impression served against them is targeted at someone who has already identified themselves as an inquiry, which raises the conversion rate on the remarketing spend and moves the cost per verified benefits check in the right direction.

The economics shift once a CMO owns admissions targets across two or more facilities. Single-facility guidance treats each compliance constraint as a fixed cost against one budget. Portfolio operators face a different question: how to allocate that cost across accounts, geographies, and clinical entities without letting a strike at one location suspend the campaigns funding the others. The rest of this section speaks to that operator.

Three variables carry most of the portfolio decision weight:

• The scope of LegitScript certification relative to the facilities being advertised,
• The granularity of geo-targeting against the certified service addresses, and
• The ownership of consent capture and call routing across sister locations.

Each variable interacts with the others, and the wrong combination compounds cost per admission across every facility in the portfolio rather than just one.

The core structural decision is whether to run one consolidated Google Ads account for the portfolio or a facility-level account for each clinical entity. Neither is universally correct. The tradeoffs sort along six dimensions operators can score against their own internal cost per admission.

The directional read is straightforward. Consolidated accounts reduce learning-phase waste, simplify compliance review, and lower the fixed cost of running the measurement stack. Facility-level accounts protect each location from another’s policy failure and make LegitScript scope easier to defend during an audit. The Mercury Marketing order is the reference case for why isolation matters: a permanent industry ban on a marketing operator disrupts every clinic that entity served, and account structure determines how far that disruption spreads inside a portfolio.¹¹ Operators with three or fewer facilities in a single state typically consolidate. Operators running across multiple states, or across brands with distinct clinical identities, typically separate at the state or brand boundary and accept the coordination overhead as insurance against a single-point failure.