7 Red Flags When Hiring a Healthcare PPC Company

Why Vendor Selection Is a Compliance Decision, Not a Media-Buying Decision

Most agency pitches for addiction treatment and behavioral health campaigns lead with click-through rates, cost per lead, and admissions volume. While these metrics are important, they do not determine the federal and state liability an operator might incur from a paid-search engagement. Instead, the vendor’s data handling, claim substantiation, and compensation structure are the critical factors.

The HHS Office for Civil Rights generally requires prior written patient authorization for most uses of protected health information (PHI) in marketing, with limited exceptions ^{1, 8}. This rule significantly impacts routine PPC activities: remarketing lists, CRM uploads, conversion APIs, and lookalike audiences all involve PHI considerations before performance metrics. Although a 2024 federal court ruling vacated part of the HHS online tracking bulletin, the underlying privacy obligations and enforcement interest in tracking technologies remain ².

The FTC adds another layer of scrutiny. Health-related advertising claims must be supported by competent and reliable scientific evidence. Outcome claims about treatment often necessitate randomized controlled human clinical testing for substantiation ^{3, 11}. A vendor proposing sobriety percentages or success-rate copy without a substantiation file introduces significant enforcement risk.

For substance use disorder (SUD) providers, state laws introduce a third filter. Every state patient-brokering statute cataloged through 2022 explicitly covers SUD referrals and prohibits associated fees or commissions ⁵. Vendor selection is thus at the intersection of these three regulatory regimes, meaning red flags are assessed against specific rules rather than an agency’s reputation.

Pixel Stacks and Audience Uploads That Treat Intake Pages Like E-Commerce

When an agency presents a measurement setup that includes multiple pixels (e.g., Meta Pixel, GA4, TikTok pixel, LinkedIn Insight Tag) and a server-side conversion API all firing on the same intake form, it indicates a configuration designed for retail funnels, not regulated healthcare. The issue is not the functionality of these tools, but what data they transmit when a visitor interacts with health-related content, such as typing a condition keyword into a chat widget, landing on a diagnosis-specific page, or submitting a form with substance, level of care, or insurance details.

HHS OCR’s marketing guidance is clear: with few exceptions, written patient authorization is required before PHI is used or disclosed for marketing ^{1, 8}. PHI extends beyond medical record numbers; an identifier combined with health status, like an IP address linked to a URL revealing a condition, can fall under this definition once it leaves the covered entity’s environment for a third-party ad platform ². A vendor suggesting a CRM upload of past inquiries for a Google Customer Match audience or a lookalike model based on a discharge list is proposing a PHI disclosure for marketing without the necessary HIPAA authorization ^{9, 10}.

The 2024 federal court ruling specifically vacated the part of the HHS online tracking bulletin that applied HIPAA to unauthenticated public webpages where health conditions were inferred solely from page content. However, the bulletin’s stance on authenticated pages, patient portals, and any tracking that transmits identifiable health information to a third party remains in effect, as does OCR’s interest in pixel-driven disclosures ². A vendor unable to differentiate between the vacated and remaining provisions is configuring tags based on incomplete information.

The operational consequences are twofold. First, ad-account suspension: Google and Meta can disable accounts that transmit sensitive health data in violation of their policies, potentially halting campaigns and disrupting admissions. Second, breach exposure: an impermissible disclosure to a tracking vendor can trigger OCR reporting obligations and class-action lawsuits. Operators should ask prospective PPC partners for data flow diagrams for intake pages, lists of fields excluded from server-side events, and the rationale for every third-party tag that activates after a visitor identifies a condition.

Success Rates, Sobriety Percentages, and Other Claims Without a Substantiation File

Reviewing an agency’s proposed headline copy and landing-page mockups for numerical claims is a quick way to identify legal risk. A hero block stating “87% of our patients stay sober at one year” or “3x the national recovery rate” is not merely a creative choice. It is an express health claim that the FTC requires advertisers to support with competent and reliable scientific evidence, often randomized controlled human clinical testing ³. A vendor drafting such a claim without first requesting the underlying outcomes study, cohort definition, follow-up methodology, and substantiation file is proposing a deceptive advertising claim under the FTC Act ^{4, 11}.

The 2022 FTC Health Products Compliance Guidance superseded the 1998 dietary supplement guidance, explicitly extending substantiation expectations to all health-related products and services ³. This guidance outlines a clear evidence hierarchy: randomized controlled human clinical testing is paramount, followed by broader competent and reliable scientific evidence. Testimonials, internal chart reviews, or anecdotal recovery stories are at the bottom and rarely suffice to substantiate an outcome claim independently ³. This hierarchy applies equally to a 30-character Google Ads headline and a supplement label.

Implied claims are subject to the same enforcement standards as express ones. A landing page featuring a smiling family with the phrase “reclaim your life” and a footer testimonial like “I’ve been sober for five years” conveys an outcome promise, even without a specific percentage ³. The FTC assesses the net impression a reasonable consumer takes from an advertisement. Short-form PPC copy often lacks the space for qualifying language that might mitigate such claims ¹¹. Behavioral health presents an additional challenge: relapse rates, comorbidity, and varied levels of care make it difficult to substantiate broad success metrics at the RCT level preferred by the guidance ³.

Per-Admission Pricing and Lead-Resale Arrangements That Echo Patient Brokering

Compensation structure is a critical area where a PPC engagement can transition from marketing to an impermissible referral. When an agency proposes a flat fee per admission, a bonus tied to monthly census, or a hybrid model where payment is contingent on a caller becoming a billable patient, the contract resembles a paid referral pipeline rather than media buying. This distinction is crucial because every state patient-brokering law cataloged through 2022 explicitly addresses SUD referrals and prohibits associated fees or commissions ⁵.

A 2025 descriptive study identified two parallel tracks of state action: patient-brokering statutes targeting referral financial mechanics, and deceptive-marketing statutes addressing SUD advertising content ⁵. All patient-brokering laws in the catalog covered SUD referrals and banned fee-for-referral arrangements. All deceptive-marketing laws prohibited false or misleading statements about services ⁵. A multi-state operator is subject to both, meaning a single per-admission compensation structure can create exposure in every state where the agency generates traffic.

Lead-resale arrangements exacerbate this risk. If an agency operates a generic addiction-treatment domain, captures inquiries via a shared call center, and routes callers to the facility that paid the highest bid, the operator is purchasing a lead simultaneously offered to competitors. Peer-reviewed analysis of for-profit SUD treatment shows how volume-based referral payments and lead-selling can distort clinical decision-making, sometimes directing individuals with opioid use disorder to facilities chosen for economic reasons rather than clinical suitability ⁶. Operators accepting per-admission pricing are funding an incentive structure linked to these outcomes.

The 2018 Congressional hearing on SUD treatment advertising brought these patterns to federal attention, with testimony detailing deceptive online ads and patient-brokering schemes, prompting calls for stronger FTC enforcement ¹². This hearing contributed to Google’s LegitScript certification and Meta’s tightened addiction-treatment ad policies, leading to routine platform review of vendor compensation arrangements.

Operators should structure PPC partner engagements based on media spend, retainer, or measurable campaign deliverables, rather than completed admissions. The contract should also prohibit the agency from selling, sharing, or rebidding inbound leads to other facilities, and require disclosure of any call-center or aggregator relationships that introduce additional compensation layers between the click and the intake call.

Call Centers and Lookalike Funnels That Quietly Reassign the Caller

A polished pitch deck often omits the most compliance-critical part of the funnel: what happens to a caller between clicking a Google Ad and reaching the admissions team. If a prospective agency operates its own intake call center, routes calls through a shared 800 number, or uses a third-party answering service that screens inquiries before transferring them, the operator must understand the handoff structure and who makes placement decisions.

The risk pattern is consistent: a caller dials a number from what appears to be the facility’s landing page, reaches an agent who collects substance, insurance, and location details, and is then transferred or referred based on undisclosed criteria. Peer-reviewed analysis of for-profit SUD treatment highlights this layer as where lead-selling and inducement arrangements typically reside, with marketing partners influencing where individuals with opioid use disorder are directed ⁶. While an agency may not label it brokering, a call center routing inbound calls to different facilities based on bid, capacity, or commission performs the exact function state patient-brokering statutes aim to address ⁵.

HIPAA introduces a parallel concern. The HHS FAQ on marketing states that sharing PHI with third-party telemarketers or vendors for promotional outreach requires authorization ⁸. A call center collecting condition and insurance information on the operator’s behalf must either be a business associate operating under a signed BAA or it creates an impermissible disclosure with each data capture ¹.

Operators evaluating a PPC partner should require a written call-flow diagram, the name and BAA status of every entity involved in inbound calls, and a contractual prohibition against routing the operator’s media-driven calls to any competing facility.

Impersonation Domains, Generic ‘Rehab Near Me’ Sites, and Brand-Bidding Schemes

A common pattern during agency vetting is the offer to direct paid traffic to a domain owned by the agency rather than the operator’s own site. The agency might claim efficiency, stating it already ranks a generic property (e.g., a city-plus-rehab page), captures form fills, and routes inquiries to the facility. However, the operator is effectively purchasing a marketing surface that misrepresents who the caller is reaching, placing the engagement squarely within the deceptive-marketing statutes that every state with such a law applies to SUD services ⁵.

Similar risks arise when an agency proposes bidding on the operator’s brand terms from a domain not controlled by the operator, or when it runs nearly identical landing pages for several competing facilities, switching phone numbers based on capacity. The 2018 Congressional hearing on SUD treatment advertising documented these exact patterns, calling for FTC Truth-in-Advertising enforcement against misleading rehab sites and deceptive online ads ¹². The FTC’s position is that ad claims must be truthful and non-deceptive, a standard covering the advertiser’s identity, the service’s nature, and any implied affiliation a visitor might reasonably infer from the page ¹¹.

Brand-bidding schemes introduce a second layer of exposure. If an agency bids on a facility’s name to intercept branded search traffic and routes clicks through a property that does not clearly disclose its relationship to the operator, it can imply a false affiliation with the trademark owner. If the same agency manages competing facilities and rotates the destination, the operator is paying to compete against its own brand while underwriting an arrangement that state deceptive-marketing laws describe as a false or misleading statement about the nature of services offered ⁵.

Operators evaluating a PPC partner should require that paid traffic lands on operator-owned and controlled properties. Any agency-owned landing page must clearly disclose the marketed facility, and the contract should prohibit bidding on the operator’s brand terms from any third-party domain. The vendor should also disclose, in writing, every other treatment center it markets in the same metro area and the rules it applies to prevent cross-routing of inbound calls.

Missing or Hollow BAAs and Vague Data-Handling Language

The Business Associate Agreement (BAA) translates abstract HIPAA conversations into a contract enforceable by an OCR investigator. If a prospective PPC agency handles inbound call recordings, conversion data linked to identifiable visitors, CRM exports, or any analytics feed combining identifiers with health status, that agency is a business associate. A signed BAA is required before work commences ^{1, 10}. A vendor who dismisses this requirement, offers a generic one-page template, or claims no BAA is needed because they “never see PHI” signals either inexperience or a workflow that avoids accountability for the data it actually handles.

Hollow BAAs are a more common issue. The document may be signed, but its language is often silent on critical data flows: which subprocessors receive event data, how call recordings are stored and purged, what happens when a tracking pixel transmits a URL containing a condition keyword, and which party reports a breach if a third-party tag malfunctions. HIPAA’s marketing rule prohibits PHI disclosures to other entities for remuneration to promote their own services, a restriction directly relevant to agency relationships with ad platforms, analytics vendors, and call-tracking providers ⁹. A BAA that fails to name these subprocessors and bind them to equivalent standards leaves the operator solely responsible for disclosure risk.

Vague data-handling language further exacerbates the problem. Phrases like “industry-standard security” or “we follow HIPAA best practices” are not contractual terms. Operators should insist the BAA specifies the categories of PHI the agency may encounter, the minimum-necessary standard applied to each data flow, retention windows for call recordings and form submissions, encryption requirements for data at rest and in transit, breach notification timelines, and the right to audit the agency’s subprocessor list at any point ^{1, 10}. A vendor resisting these specifics is asking the operator to trust an unseen workflow.

Dismissing the 2024 Tracking Vacatur as a Reason to Loosen Controls

“That HHS tracking rule got struck down, so we can run the pixels normally now.”

The federal court vacated only a narrow part of the HHS Office for Civil Rights bulletin on online tracking technologies. Specifically, it concerned the extension of HIPAA to unauthenticated public webpages where a visitor’s identity and health condition were inferred solely from page content ². All other provisions of the bulletin remained intact. Tracking on authenticated patient portals, transmissions of identifiable health information from any page to a third-party ad platform, and OCR’s stated enforcement interest in pixel-driven disclosures all survived the ruling ². The fundamental HIPAA marketing rule, which mandates written authorization for PHI use or disclosure in marketing (with limited exceptions), was not challenged in the case and remains unaffected ^{1, 8}.

A vendor portraying the vacatur as a green light to reinstall Meta Pixel on intake forms, restore IP-plus-condition events to GA4, or resume CRM uploads to ad platforms is treating a partial legal setback as a complete repeal. This is incorrect. The HIPAA prohibition on disclosing PHI to other entities for remuneration to promote their own services still applies to every business associate handling treatment-center data ⁹. State deceptive-marketing statutes governing SUD advertising operate independently of the federal tracking question ⁵.

Operators should view any pitch based on “the rule was struck down” as an opportunity to ask which specific paragraphs of the bulletin the vendor believes were vacated, which still apply to their proposed configuration, and how the agency’s data flow diagram has changed in response. A partner unable to answer these questions immediately is likely proposing a configuration based on a headline rather than a thorough understanding of the legal order.

Mapping Red Flags to Regulators, Consequences, and Contract Levers Across Multiple Locations

While the preceding discussion focused on single-facility operators, the considerations change for multi-state portfolios, franchise networks, and PE-backed groups managing campaigns across several legal entities. A vendor configuration that creates a single exposure in one state can replicate that exposure across every market where the agency operates, and a single ad-account suspension can halt an entire portfolio’s operations. The table below consolidates the seven red flags, identifying the relevant regulator, the multi-location consequence, and the contractual lever operators should adjust before signing.

This table functions as a unified instrument because regulators like OCR, the FTC, and state attorneys general approach investigations of portfolios similarly. A single vendor configuration, contract template, and compensation structure typically govern every entity within a group, meaning a single agency selection decision establishes the risk baseline for the entire footprint.

A Scoring Framework Built Around Substantiation Files, BAA Scope, and Comp Structure

The recurring theme across these seven red flags is that the highest-risk vendor behaviors are often revealed within three key documents that an operator can review before signing:

• the substantiation file supporting any outcome copy,
• the Business Associate Agreement (BAA) and its named subprocessors, and
• the compensation schedule.

A scoring framework centered on these three documents transforms legal abstractions into a practical procurement exercise for admissions leaders.

The substantiation file is the primary tool. A prospective agency should provide written evidence for every health claim it proposes, including the cohort definition, follow-up window, measurement method, and disclosure language ^{3, 4}. A vendor unable to meet the FTC’s evidence expectations for outcome claims scores zero on this axis, regardless of their media-buying proficiency ¹¹.

The BAA is the second critical component. The contract should explicitly name every subprocessor handling call recordings, form submissions, or conversion data. It must specify retention windows and breach timelines, and bind the agency to the HIPAA prohibition against disclosing PHI to other entities for remuneration ^{1, 9, 10}. A generic BAA signed without these details fails to protect the operator from the actual data flows managed by the agency.

The compensation schedule is the third. Pricing based on media spend, retainer, or measurable campaign deliverables falls outside the patient-brokering perimeter enforced by every cataloged state statute against SUD referrals ^{5, 6}. Conversely, per-admission bonuses, lead-resale arrangements, and call-center revenue shares disqualify a vendor before creative review even begins. Operators who prioritize these three documents over pitch-deck performance claims are evaluating vendors against the same standards regulators apply, which is how specialized partners like Active Marketing are assessed.