Hiring a Compliant Healthcare PPC Agency: Key Steps

HHS guidance defines a business associate as any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity, including for data analysis or administration ¹¹. A paid search agency rarely admits to handling PHI in pitch decks, yet the data flows it operates almost always qualify once they touch a treatment center’s identifiable patient context.

The artifacts that pull an agency inside the BAA requirement are concrete. Call tracking platforms that record inbound admissions calls capture voice content and caller phone numbers tied to a center advertising SUD treatment. Webhooks that sync form submissions from a landing page to the admissions CRM carry name, contact data, and the implicit fact that the individual is inquiring about clinical care. Customer match list uploads to Google Ads or Meta push hashed identifiers paired with the center’s audience context, which OCR has treated as PHI-equivalent in many configurations. Server-side conversion APIs forward event data tied to user identifiers from a healthcare property. Pixels firing on intake or insurance verification pages collect identifiers combined with health context ¹¹.

A defensible BAA enumerates each of these data flows, names the subprocessors involved (call tracking vendor, tag manager, CRM, ad platform), and assigns breach notification timelines that align with the operator’s own obligations. An agency that offers a one-page template BAA referencing only “marketing services” has not done the work.

“relates to an individual’s past, present, or future health, healthcare, or payment for healthcare,”

“are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules”

In June 2024, a federal district court vacated a portion of the guidance, but OCR has continued to emphasize Security Rule compliance and enforcement around tracking technologies ⁷. Operators should not read the partial vacatur as a signal that the analytics stack is now unregulated. The Security Rule obligations on confidentiality, integrity, and availability of electronic PHI did not move.

The practical implication is that standard ad-tech contracts from Google, Meta, and TikTok do not contain business associate terms covering PHI transmission, and OCR has noted that such contracts often fail to meet business associate requirements ⁷. A compliant configuration:

• moves identifiable conversion data through a server-side endpoint the operator controls,
• strips or hashes identifiers before any platform call,
• suppresses pixel firing on URLs that imply diagnosis or service line, and
• uses modeled conversions or aggregated reporting where direct identifiers would otherwise flow to the platform.

A compliant agency answer describes specifically how its Google Tag Manager containers, server-side GTM endpoints, Meta Conversions API setup, and call tracking integrations handle identifiers on pages tied to clinical context. It can name which URLs trigger which events, which fields are hashed, and where the data terminates.

A disqualifying answer treats the issue as solved by “using a HIPAA-compliant CRM” or by signing a BAA with the call tracking vendor while leaving client-side pixels firing freely on intake pages. The pixel does not become compliant because the downstream CRM is. The PHI exposure occurs at the moment the identifier and the health context leave the operator’s domain together ⁷.

For addiction treatment operators, Part 2 sits on top of HIPAA and tightens what is permissible. The statute and rule, codified at 42 U.S.C. 290dd-2 and 42 CFR Part 2, protect the confidentiality of patient records for people receiving services for substance use disorders, and Part 2 generally prohibits disclosing SUD patient-identifying information without written consent ¹⁰.

“each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent”

For a PPC partner, the operational consequence is that any data flow carrying SUD patient-identifying information, including call recordings of intake conversations, transcripts, CRM records, and any audience list built from prior admissions, sits inside Part 2’s scope. A consent that authorizes operations communications under HIPAA does not automatically authorize what Part 2 treats as further disclosure, and any disclosure made with consent must travel with the consent document or its scope description ⁵.

A compliant agency answer identifies which of its workflows touch Part 2-protected information, confirms that call recording vendors and CRMs are configured to support Part 2 consent metadata, and demonstrates how remarketing audiences are built without using SUD treatment status as a targeting criterion or seed.

A disqualifying answer treats Part 2 as a clinical concern that does not apply to marketing. The rule is record-based, not department-based. If the agency’s systems hold information that identifies someone as a current or former SUD patient, Part 2 governs it ¹⁰.

“As a general matter, substantiation of health-related benefits will need to be in the form of randomized, controlled human clinical testing”

The broader substantiation framework, articulated in the FTC’s training document, requires advertisers to substantiate all claims, express and implied, that an ad conveys to reasonable consumers before dissemination, with health benefit and safety claims requiring competent and reliable scientific evidence ¹.

Treatment center ad copy and landing pages routinely contain language that triggers this standard:

• “95% completion rate.”
• “Industry-leading outcomes.”
• “Proven to reduce cravings.”
• “More effective than traditional rehab.”

Each is a health benefit or comparative effectiveness claim, and each is the kind of statement the FTC expects to be backed by controlled human clinical testing or an equivalent body of evidence specific to the program being advertised ⁶.

A compliant agency maintains a substantiation file for every clinical, outcome, or comparative claim it places in headlines, descriptions, sitelinks, callouts, and landing page copy. The file ties each claim to the underlying study, internal outcomes data with stated methodology, or a clinician-reviewed source. Implied claims are reviewed under the same standard, because the FTC holds advertisers responsible for all reasonable consumer interpretations, not just literal wording ¹.

A disqualifying answer is “the client gave us the copy.” Liability for substantiation extends to the agency that drafted and placed the ad. If the operator cannot produce the underlying evidence on request, the claim should not be in the ad ⁶.

Inbound calls are where paid search converts in this category, and they are also where compliance frequently breaks. A recorded admissions call captures voice data, caller phone numbers, often insurance details, and statements that establish the caller as a current or prospective SUD patient. Under HHS guidance, the vendor recording, storing, or transcribing those calls is creating and maintaining PHI on behalf of the covered entity and therefore qualifies as a business associate requiring a BAA ¹¹. Under Part 2, the recording is also protected SUD treatment information once it identifies the caller in connection with treatment ¹⁰.

Two operational risks deserve specific attention:

1. The first is call recording configuration: recordings should not be retained in vendor systems that lack BAA coverage, transcripts should not be piped into third-party analytics that fall outside the BAA chain, and quality-assurance scoring tools must be evaluated under the same standard.
2. The second is third-party lead buying. Agencies that supplement direct PPC with purchased calls or form fills from aggregators introduce a chain where the operator often cannot verify the consent disclosures the lead saw, the platforms the data passed through, or whether PHI was disclosed to third parties in exchange for remuneration so they could advertise their own services, which HIPAA marketing rules prohibit without authorization ¹².

A compliant agency documents its call infrastructure end to end, refuses to bolt on lead sources that cannot produce consent records and BAA coverage, and treats every recording the same way clinical records are treated. A disqualifying answer minimizes the lead source question or claims the aggregator “handles compliance on their end.”

This subsection applies to a narrow slice of treatment operators: facilities running dual-diagnosis or older-adult tracks that bill Medicare Advantage. For everyone else, the five core checkpoints already cover the field.

CMS Medicare Marketing Guidelines layer an additional rulebook onto any PPC activity that promotes plan-affiliated services, with specific definitions separating “marketing” from “communications,” required disclaimers, and constraints on how provider names, logos, and benefit information appear in advertising ². Some materials require CMS submission for review; others do not, and the distinction shapes how landing pages and ad extensions must be structured ². The 2024 revisions tightened rules around third-party marketing organizations and digital practices, which directly affects how agencies handle lead generation and call routing for Medicare-eligible inquiries ².

A compliant agency working this segment uses CMS standardized outreach and educational materials as the language baseline for call scripts, landing page disclosures, and remarketing copy targeting Medicare populations ³. A disqualifying answer is silence on CMS submission workflow or reliance on generic insurance-acceptance copy that names plans without the required disclaimers.

This subsection narrows again, this time to operators running wellness-adjacent service lines that may fall outside HIPAA coverage: cash-pay coaching, app-based recovery support, executive wellness retreats, or alumni programs structured outside the clinical entity. HIPAA is not the ceiling for these properties.

State and municipal legislatures are filling the gap. The District of Columbia bill introduced in 2024 would require regulated entities to obtain consumers’ informed consent before collecting and sharing personal health data, and would restrict using that data for targeted advertising, explicitly reaching entities that fall outside HIPAA ⁸. Washington’s My Health My Data Act and Nevada’s SB 370 follow similar logic, and more jurisdictions are moving in the same direction ⁸.

A PPC agency operating a non-covered wellness brand under the same parent organization should still apply consent-first collection, opt-out honoring, and audience-building constraints aligned with the strictest jurisdiction the operator serves.