For clinics and practices
One unsubstantiated line in your ad copy or a well-meaning review-gating habit can cost more than the campaign it came from, and the fear of that is what keeps a lot of practices generic and hard to find. The rules that govern healthcare marketing are not a growth tax. They push careless competitors into risk, or out of the category entirely, and reward the practices willing to build visibility inside the lines.
What is healthcare marketing compliance?
Healthcare marketing compliance is four separate rule systems landing on the same website, ad account and review profile at once: HIPAA on how patient data may be collected, FTC rules on claims and testimonials, FDA rules where a drug or device is named, and state medical board rules on advertising. They are enforced by different bodies and clearing one says nothing about the others. Specific applications belong to a healthcare attorney or compliance officer.
Source: Semrush keyword research, verified in live pulls. Demand shifts; we re-verify before every engagement.
The rules are not the obstacle. They are what removes the careless from your category.
It is not one rule. It is four systems that all apply to the same website, the same ad account, and the same review profile at once.
A single unsubstantiated line in ad copy and a page that outranks the competition run on the same test: whether the claim on it can be backed up. Healthcare marketing compliance covers what a practice can say about results, how it collects and displays reviews, what tracking technology runs on patient-facing pages, and how it represents credentials and certifications, all under FTC substantiation rules, HIPAA's restrictions on patient data, and whatever state medical board requirements apply. Practices that treat these rules as a floor rather than a ceiling tend to out-rank and out-convert the ones that don't, because the same structure that satisfies a regulator also satisfies a skeptical buyer doing research before they book.
The practical effect: every shortcut a competitor takes, exaggerated result claims, filtered reviews, a pixel firing where it shouldn't, is a liability sitting on their site whether or not anyone has caught it yet. A practice that builds inside the rules from the start doesn't carry that liability, and it survives both regulatory attention and algorithm changes better, because none of its authority depends on a claim it can't back up.
Under FTC Act Section 5, any claim that a treatment relieves, reduces, or cures a condition needs competent and reliable scientific evidence behind it before it runs, not after a complaint arrives. That standard applies to the practice's own copy, to a patient testimonial the practice chooses to publish, and to an affiliate or influencer the practice pays. There is no size exemption. A single-location aesthetics practice and a national telehealth brand answer to the same bar.
The expensive move usually isn't outright fraud. It's the ordinary habit of writing ad copy the way every competitor writes it: "get rid of stubborn fat for good," "finally lose the weight," "permanent results." Those phrases read as marketing to a founder and as an unsubstantiated efficacy claim to the FTC. The fix isn't weaker copy, it's copy anchored to what can actually be shown: mechanism, process, what patients report experiencing, credentials, and years in practice, none of which require a clinical claim to be persuasive.
The Trade Regulation Rule on the Use of Consumer Reviews and Testimonials took effect in 2024 and gave the FTC a direct enforcement tool against fake, bought, and manipulated reviews, instead of relying on general deception authority. It prohibits four things a lot of practices do without recognizing them as violations: writing or buying fabricated reviews, paying for reviews without disclosing the payment, review gating (soliciting reviews from happy patients only while routing unhappy ones elsewhere), and suppressing or threatening a patient over a negative review. Penalties run up to $51,744 per violation.
Review gating is the one that catches healthcare practices most often, and it's usually built into a well-meaning post-visit survey: patients who report high satisfaction get routed straight to Google, patients who report low satisfaction get sent to an internal form and never asked publicly. That is textbook review gating under the rule, even when nobody involved intended to break it.
Source: FTC Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465 (effective 2024).
LegitScript certification is issued per facility, not per marketing agency. A pharmacy, telehealth platform, or addiction treatment provider gets certified directly against LegitScript's standards. The agency running that provider's marketing cannot hold the certification on its behalf, and for addiction treatment specifically, agencies aren't eligible for certification at all. Anyone claiming an agency is "LegitScript certified" for a client's medical service is describing something that doesn't exist under the program's own structure.
What an agency can do is operate correctly under a client's existing LegitScript posture: keep ad copy inside the claims the certification allows, keep landing pages matched to what it covers, and flag anything in a campaign that would put the certification at risk before it runs, not after a platform suspends the account. That's the work we do on the two regulated medical accounts we run today, and it only functions when the practice and its counsel own the certification decision itself.
The Meta Pixel and Google Ads conversion tag are default installs on most marketing sites, and on a general information page that's rarely a problem. On a patient portal, appointment scheduler, or any page a user only reaches after identifying themselves as a patient, the same pixel can transmit protected health information to a third-party ad platform. That's the exact scenario HHS flagged in its December 2022 guidance on tracking technologies, and it's the basis for the wave of litigation and enforcement activity that followed.
The fix isn't removing all measurement, it's routing it correctly: server-side tagging behind a consent layer, no pixels on authenticated or patient-identifying pages, first-party data collection where it's genuinely needed, and a documented basis for what's tracked and where. This is table-stakes work on the two active medical accounts we run, not a hypothetical add-on.
Source: HHS Office for Civil Rights, Bulletin on the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.
It is not one rule. It is four systems applying to the same site, the same ad account and the same review profile at once.
Medical board advertising rules are set at the state level and differ in specifics: some restrict testimonial use more tightly than the FTC does, some carry disclosure requirements tied to non-physician ownership, some regulate how a med spa can describe a supervising-physician relationship. We flag what we see against the patterns we know across accounts. We do not give legal advice, and the practice's own healthcare counsel makes the final call on anything state-specific. That division of labor is deliberate: an agency that also tells you what's legal is usually wrong about one of the two jobs. See how this plays out day to day for medical practices on our clinics page.
| Practice | Compliance status |
| Before/after photos with signed consent and accurate labeling | Generally allowed. Get written consent, disclose stock or altered images, avoid captions that imply an assured outcome. |
| Patient testimonials describing specific outcomes ("cured my," "eliminated my") | High risk. FTC substantiation applies even when the claim is voiced by a patient, not the practice. |
| Responding publicly to negative reviews, without payment or pressure | Allowed and advisable. Good-faith public responses aren't the manipulation the FTC targets. |
| Removing, hiding, or pressuring patients to delete negative reviews | Prohibited under 16 CFR 465 (review suppression). Penalties up to $51,744 per violation. |
| Offering a discount for a 5-star review, undisclosed | Prohibited. Requires disclosure at minimum; most platforms treat the incentive itself as a violation. |
| Ad pixels firing on booking, intake, or patient-portal pages | Real HIPAA exposure. Move to server-side, consent-gated tracking with identifiers stripped. |
| "Risk-free" or "cure" language in ad copy | Prohibited without substantiation most treatments don't have. The single costliest line item in FTC enforcement. |
| Landing pages written to match a client's existing LegitScript posture | Required for Google/Meta ad approval in regulated categories. Certification sits with the facility, not the agency. |
Three steps, and we never touch a login or make a claim on your behalf.
An external-only scan that shows you what a regulator or a competitor's counsel would find first: review patterns, tracking behavior visible from outside, claim language, schema. No logins, no account access, delivered in about 48 hours. See what's included.
A paid audit that verifies defects across four published classes. $1,500 for the first market ($2,500 in a major metro), credited in full to month one, refunded if we verify fewer than three defects. Full pricing on the pricing page.
Ongoing build of compliant authority assets, monitored monthly against exact prompts across ChatGPT, Perplexity, and AI Overviews. One client per category per market, so the work compounds instead of competing with itself.
A North Florida aesthetics clinic had reviews removed by Google without notice. Our monitoring caught the drop and got them reinstated in roughly two days, not the weeks it usually takes when nobody's watching.
A Ventura County medical clinic moved four tracked terms to No. 1 in one four-week cycle, including a flagship term that went from position 8 to 1, with 27 of 43 tracked keywords in the top 3 and organic sessions up 19% month over month. Built entirely on structure and proof, not claims.
Source: Semrush Position Tracking and GA4, one four-week cycle, one medical clinic. Results vary by market and category.
We track AI-answer visibility monthly with the exact prompts we test, across ChatGPT, Perplexity, and Google AI Overviews. We report what's cited and what isn't, the same discipline we apply to a line of ad copy: state what's verified, not what we wish were true.
Free Market Findings is an external-only scan, no logins required, delivered in about 48 hours. You'll see what a regulator, a platform, or a competitor's lawyer would see if they looked today.
What your buyers ask AI, every day
“can a medspa advertise Botox prices in [your state]”
“is it legal to ask patients for Google reviews”
“what happens if a clinic gets flagged for its ads”
We run questions like these monthly, on every engine, and log exactly who gets named. If it is not you, that is the gap we work.
LegitScript certification is a review process that verifies a business, most often a pharmacy, telehealth platform, or treatment provider, meets specific legal and safety standards for its category. Google, Meta, and other ad platforms require it before approving certain regulated ad categories, including online pharmacies, prescription telehealth, and addiction treatment. Whether your practice needs it depends on what you're advertising and on which platform, not on your specialty alone. A local aesthetics practice running standard search ads typically doesn't need it, while a telehealth prescribing service usually does.
No. LegitScript certifies the facility or business providing the service, not the agency marketing it, and for addiction treatment specifically, agencies aren't eligible for certification at all. An agency's role is to operate correctly under the certification the practice already holds, keeping ad copy and landing pages inside what that certification covers and flagging anything that could put it at risk before a campaign runs.
The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect in 2024 and gives the agency direct enforcement authority over fake or bought reviews, undisclosed incentivized reviews, review suppression, and review gating, which is soliciting reviews only from satisfied customers while routing unhappy ones elsewhere. Violations can carry civil penalties up to $51,744 each, and review gating is the one healthcare practices trigger most often without realizing it.
Yes, on any page a user reaches after identifying as a patient, such as a portal login, appointment scheduler, or intake form. A standard pixel on that page can transmit protected health information to a third-party ad platform, which is the scenario HHS flagged in its December 2022 guidance and the basis for subsequent enforcement and litigation. General information pages carry less risk; patient-specific pages need server-side, consent-gated tracking instead of a default pixel install.
Yes. State medical boards set their own advertising rules on top of federal FTC and HIPAA requirements, and they vary on specifics like testimonial restrictions, disclosure requirements for non-physician-owned practices, and how med spas can describe supervising-physician relationships. We flag patterns we recognize across accounts. We don't give legal advice, and a practice's own healthcare counsel should make the final call on any state-specific question.