Published · Last updated:
This guide reflects federal guidance and platform policies as of October 2026; every rule below links to its primary source with the date we read it. It is general marketing guidance for US healthcare practices, not legal advice. The HHS tracking bulletin is partly vacated and HHS says it is evaluating its next steps, so confirm how HIPAA and state privacy laws apply to your website with counsel.
How to Choose a Healthcare Marketing Agency: The Questions That Separate Specialists From Generalists
To choose a healthcare marketing agency, ask three questions first: where its tracking code runs on your patient pages, who owns the ad and analytics accounts, and what the monthly investment covers. A specialist answers all three with specifics, including the June 20, 2024 court order that vacated part of the HHS tracking bulletin. [1] A generalist answers with a sales deck.
- Ask about tracking before anything else. HHS says regulated entities are not permitted to use tracking technologies in a way that results in impermissible disclosures of protected health information to tracking vendors. A court vacated one portion of that bulletin on June 20, 2024; the rest remains on the HHS page. [1]
- Know the enforcement record. In its first Health Breach Notification Rule case, announced February 1, 2023, the FTC said GoodRx would pay a $1.5 million civil penalty for failing to report its unauthorized disclosure of consumer health data to Facebook, Google and other companies. [2]
- Check the analytics stack. Google makes no representations that it satisfies HIPAA requirements and offers no business associate agreement for it. [3]
- Own your accounts. Google requires agencies to give clients their Google Ads customer IDs on request, to report the exact amount Google charged, apart from agency fees, whenever they share cost data, and to run a separate account for each advertiser. [4] [5]
- Read benchmarks as medians, not promises. Physicians and surgeons paid a median $40.04 per search lead in WordStream's 2026 data, drawn from US campaigns run April 2025 to March 2026. [6]
- Most Ambrose clients invest roughly $1,200 to $4,000 a month in marketing, often across more than one channel. Book a free consultation and ask us all 12 questions in this guide.
Most checklists for hiring a healthcare marketing agency ask about experience, case studies and reporting. Those questions matter, but any agency can answer them well in a sales meeting. The questions in this guide are different. Each one has a right answer you can check against a primary source: a federal guidance page, an FTC enforcement action or a platform policy, each linked and dated below.
The stakes sit with your practice. The HHS bulletin is addressed to regulated entities, and it states that a regulated entity's failure to comply with the HIPAA Rules may result in a civil money penalty. [1] So the compliance questions come first, and the price question comes later.
To be clear about scope: Ambrose is a healthcare marketing agency, so read this guide knowing we are one of the agencies you might interview. If your main concern is AI search visibility, our earlier guide to the SEO and AI search questions to ask a healthcare marketing agency covers that ground. This one covers compliance, results, ownership, pricing and fit.
The Tracking Pixel Question Separates Specialists From Generalists Fastest
Ask every agency where its tracking code will run and what it will send. HHS guidance says regulated entities are not permitted to use tracking technologies in a manner that results in impermissible disclosures of protected health information to tracking vendors. [1] A court vacated one portion of that guidance on June 20, 2024, so a specialist explains exactly which portion, and which of your pages still carry risk.
Here is the status, stated the way HHS states it. The bulletin page carries a notice that on June 20, 2024, the US District Court for the Northern District of Texas issued an order declaring unlawful and vacating a portion of the guidance, in American Hospital Association v. Becerra. [1]
The vacated portion is specific. The court vacated the guidance to the extent it said HIPAA obligations are triggered when an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. [1] The notice ends: "HHS is evaluating its next steps in light of that order." [1] The page shows "Content last reviewed June 26, 2024," and that notice was still the current status when we read it on October 20, 2026.
The rest of the bulletin remains on the HHS page, including the parts that matter most to a practice website:
| Page or tool on your website | What the HHS bulletin says | Status after June 20, 2024 |
|---|---|---|
| Patient portal or other logged-in pages | Tracking technologies on user-authenticated webpages generally have access to protected health information (PHI) [1] | Not vacated |
| Online scheduling or a symptom checker without a login | May have access to PHI in certain circumstances, for example an email address or the reason for seeking care [1] | Not vacated |
| Portal login or registration page | Login or registration details entered there are individually identifiable health information, so tracking that collects them discloses PHI [1] | Not vacated |
| Public page about a condition or provider, IP address only | The position that connecting an IP address with that visit triggers HIPAA obligations [1] | Vacated by the court in Am. Hosp. Ass'n v. Becerra |
| Cookie consent banner | Banners that ask users to accept or reject tracking do not constitute a valid HIPAA authorization [1] | Not vacated |
Analytics belongs in the same question. Google says it "makes no representations that Google Analytics satisfies HIPAA requirements" and does not offer business associate agreements for the service. [3] Google also says authenticated pages are likely to be HIPAA-covered and that customers should not set Google Analytics tags on them. [3] An agency that plans to install Google Analytics on your booking flow should be able to explain, in writing, why that is permissible.
The enforcement risk is real. On February 1, 2023, the FTC announced its first enforcement action under the Health Breach Notification Rule: GoodRx, a telehealth and prescription drug discount provider, agreed to pay a $1.5 million civil penalty. The FTC said GoodRx violated the rule by failing to notify consumers, the FTC and the media about its unauthorized disclosure of individually identifiable health information to Facebook, Google, Criteo, Branch and Twilio. [2] That case ran under an FTC rule, not HIPAA. A specialist knows which regulator applies to which kind of business. A generalist treats "HIPAA compliant" as a badge.
Compliance Questions on Reviews and Before-and-After Images
Two more compliance questions expose a generalist: how the agency gets reviews, and how it uses before-and-after images. The FTC's final rule on fake reviews, announced August 14, 2024, bans fake reviews and testimonials and paying for reviews with a set sentiment, and it lets the FTC seek civil penalties against knowing violators. [7] Meta requires ads for cosmetic procedures to target people 18 or older. [8]
The review rule reaches further than fake five-star posts. The FTC's announcement lists insider reviews without a clear disclosure, review suppression through groundless legal threats or intimidation, company-controlled review websites presented as independent, and fake social media indicators such as bot followers. [7] Ask the agency to describe its review program step by step. Any reward tied to a positive review is the answer that ends the meeting.
Before-and-after images follow platform rules that differ by channel. Meta's health and wellness standards allow ads that promote cosmetic procedures depicting a before-and-after transformation only when the ad targets people 18 or older, and they bar statements of inferiority about physical appearance. [8] A specialist names the rule for each platform you plan to use. A specialist also asks whose photos they are and what written patient permission exists before any image is published; confirm the form of that permission with counsel.
Both questions test the same habit. A specialist checks the rule before building the campaign. A generalist builds the campaign and waits for a rejection notice.
Want these compliance questions answered for your own website? Book a 15-minute consult and we will walk through the tracking on your booking pages with you.
Book Your Free Consultation →What Results to Expect: Benchmarks Are Medians, Not Promises
Expect an agency to show you a benchmark, its source and its date, then explain where your practice will differ. In WordStream's 2026 search benchmarks, physicians and surgeons had a median cost per click of $4.76, a conversion rate of 12.43% and a cost per lead of $40.04, from US campaigns run April 2025 to March 2026. [6] An agency that promises a patient count is guessing.
The WordStream figures come from a sample of 13,474 US search campaigns on Google Ads and Microsoft Ads, and the report notes that its "averages" are medians. [6] They describe the middle of a vendor's customer base, not your market. The last column in the table below is our own calculation: search media only, before any agency fee.
| Category (US search ads, April 2025 to March 2026) | Median cost per click | Median conversion rate | Median cost per lead | Leads per $1,000 of search media (our calculation) |
|---|---|---|---|---|
| Physicians and surgeons | $4.76 | 12.43% | $40.04 [6] | about 25 |
| Dentists and dental services | $8.00 | 10.67% | $72.97 [6] | about 14 |
| Health and fitness | $6.17 | 6.94% | $67.36 [6] | about 15 |
| All 23 industries in the report | not used here | not used here | $66.69 [6] | about 15 |
A lead is not a patient. The questions that matter are what the agency counts as a lead, and whether it can report booked appointments by channel from your scheduling system rather than form fills from the ad platform. Our guide to SEO versus paid ads for healthcare practices shows how the two channels report differently.
In my view, the most honest answer to "what results should I expect" is a range, a source, a date and a measurement plan. Not a guarantee.
Ownership Questions: Who Holds the Ad and Analytics Accounts
Your practice should own its Google Ads, analytics and social ad accounts, and the agency should work inside them under its own login. Google requires agencies to use a separate account for each advertiser they manage [5] and to give clients the customer IDs for their Google Ads accounts when requested. [4] Ask for both in writing before any work begins.
Google states its reason plainly: advertisers need the ability to contact Google directly with concerns about a third-party partner, and the customer ID lets Google investigate and help. [4] When an agency shares Google cost data, Google requires it to report the exact amount Google charged, exclusive of any fees the agency charges. [4]
Those rules set a floor. Neither Google page says who owns an account that an agency opened under its own business, so settle it before you sign. The question to ask is simple: "If we part ways, which logins, accounts and data stay with us?" A specialist answers with a list. Analytics, tag manager, Search Console, the Google Business Profile and the Meta business assets all belong on it.
Ownership also decides who can see what your tracking sends. Google advises that customers subject to HIPAA must not use Google Analytics in any way that gives Google access to protected health information. [3] If you do not hold an admin login, you cannot check that yourself.
Pricing Questions: What the Monthly Investment Covers
Most Ambrose clients invest roughly $1,200 to $4,000 a month in marketing, often across more than one channel. Whatever figure an agency quotes, ask what it covers: ad spend, management, content, website work and reporting. Google requires an agency that charges a separate management fee to tell clients clearly, at a minimum in writing before the first purchase and on every invoice. [4]
Price is a scope question before it is a cost question. Two proposals at the same monthly figure can buy very different work, so ask each agency to split its figure into the line items it will report every month. Google already expects the ad spend line to show the exact amount Google charged. [4]
Use the benchmark as a test of any promise. At the 2026 median of $40.04 per search lead for physicians and surgeons, 100 search leads a month would take about $4,004 in media alone, before any management. [6] A proposal that promises that volume for less overall should explain why your practice will beat the median.
The cheapest proposal is often the one that skipped the tracking audit. That work belongs in the price, because the compliance questions in the first two sections of this guide are where the cost of a mistake lands.
Fit Questions: Specialty Experience and Who Does the Work
Ask which practices like yours the agency has worked with, which named person will run your account, and which vendors will touch your patient data. The last question is a compliance question in disguise: the HHS bulletin says a tracking vendor that creates, receives, maintains or transmits protected health information on behalf of a regulated entity for a covered function is a business associate, and a business associate agreement is required. [1]
Specialty experience is easy to claim and easy to check. Ask for two current clients in your specialty you may call. A dental practice, a med spa and a multi-provider medical group face different platform rules, different patient journeys and different questions in the exam room.
The vendor question has a trap a generalist will not see. The bulletin says signing an agreement that contains the elements of a business associate agreement does not make a tracking vendor a business associate if it does not meet the definition. [1] HHS also says that if a vendor will not sign one, a practice can work through a vendor that will, such as a customer data platform that de-identifies the data first. [1] Ask which route the agency uses.
Ask who does the work, by name and role, and whether the person in the sales meeting is the person who will build your tracking. Healthcare is not a vertical anyone should learn on your account. Our healthcare SEO guide shows the depth to expect from whoever runs your organic search.
The Answer Key: 12 Questions and What a Specialist Says
These 12 questions cover compliance, results, ownership, pricing and fit. For each one, the answer key below shows what a specialist answer includes and the reply that should end the conversation. Count the red flags you hear. In my view, one red flag on tracking outweighs a strong answer on everything else, because the HHS bulletin places the obligation on your practice. [1]
Healthcare Agency Answer Key
Red flag: "We put the pixel on every page."
Red flag: "That guidance was struck down."
Red flag: "We give a gift card for five-star reviews."
Red flag: "We post them everywhere."
This answer key does not score agencies or estimate cost, and it is not legal advice. Confirm how HIPAA, FTC rules and state privacy laws apply to your website with counsel. Source: the compliance, results, ownership, pricing and fit sections of this guide and the references below.
The red flags below are the replies we would not accept from any agency, including our own team.
| Red flag reply | Why it matters | Primary source |
|---|---|---|
| "We install the Meta pixel and Google Analytics on every page." | Logged-in pages, portal logins and scheduling tools can disclose PHI to tracking vendors | HHS OCR [1] |
| "The cookie banner takes care of HIPAA." | Cookie banners are not a valid HIPAA authorization | HHS OCR [1] |
| "The tracking guidance was struck down." | A court vacated one portion; the rest remains on the HHS page | HHS OCR [1] |
| "We give patients a gift card for five-star reviews." | Paying for reviews with a set sentiment is banned under the FTC rule | FTC [7] |
| "The ad account is ours; we send you a report." | Google requires customer IDs on request and exact Google charges reported apart from fees | Google Ads policy [4] |
| "Our fee is built into the ad spend." | Google requires management fees disclosed in writing before the first purchase and on every invoice | Google Ads policy [4] |
Contract Terms to Get in Writing Before You Sign
A healthcare marketing contract should state who owns every account and asset, what the monthly figure covers, how tracking is configured on patient pages, which vendors receive data and under what agreement, what gets reported each month, and how you leave. Google already requires agencies to disclose management fees in writing and to give clients their Google Ads customer IDs on request. [4]
Put these five terms in the contract, in this order:
Ownership
Every ad, analytics and social account is opened in the practice's name, with the agency added as a user. Google requires a separate account for each advertiser an agency manages. [5]
Fees and scope
Each line item named, management fee stated in writing, ad spend reported at the exact amount Google charged. [4]
Tracking and data
A written list of every tag on the site, the pages it runs on and what it sends, plus a business associate agreement wherever a vendor meets the HHS definition. [1]
Reporting
Booked appointments by channel from your scheduling system, alongside clicks and leads from the platforms.
Exit
Admin access stays with the practice, and the agency removes its own logins and hands over its tag documentation within a stated number of days.
Have counsel review the data terms. A marketing agency can tell you what its tags send. Only your attorney can tell you what your practice is permitted to send.
Frequently Asked Questions About Choosing a Healthcare Marketing Agency
How much does a healthcare marketing agency cost?
Is it legal to use a Meta pixel on a medical practice website?
What should a healthcare marketing contract include?
Who owns my Google Ads account if I leave an agency?
What results should I expect from a healthcare marketing agency?
References
- U.S. Department of Health and Human Services, Office for Civil Rights. Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. content last reviewed 2024-06-26; read 2026-10-20. hhs.gov
- Federal Trade Commission. FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising. 2023-02-01; read 2026-10-20. ftc.gov
- Google Analytics Help. HIPAA and Google Analytics (13297105). no page date; read 2026-10-20. support.google.com
- Google Advertising Policies Help. Transparency requirements (16489093). no page date; read 2026-10-20. support.google.com
- Google Advertising Policies Help. About Google third-party policies (6086450). no page date; read 2026-10-20. support.google.com
- WordStream. Google Ads Benchmarks 2026: Competitive Data and Insights for Every Industry. last updated 2026-09-16; read 2026-10-20. wordstream.com
- Federal Trade Commission. Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials. 2024-08-14; read 2026-10-20. ftc.gov
- Meta Transparency Center. Health and wellness ad standards. change log entry July 2026; read 2026-10-20. transparency.meta.com
A Specialist Answers the Compliance Questions Before You Ask
Choosing a healthcare marketing agency comes down to evidence. A specialist can tell you which part of the HHS tracking bulletin a court vacated on June 20, 2024, which parts still apply to your booking pages, and why Google Analytics stays off your portal. [1] [3] A specialist hands you the account IDs before you ask and shows the exact amount Google charged on every report. [4]
Take the 12 questions into every meeting, including ours. Count the red flags. Hire the agency that answers with sources, dates and a plan you can check.
Ready to put Ambrose through these 12 questions?
Bring the list to a free consultation and ask us every one. You can also read how we run healthcare marketing for private practices or start a project with Ambrose.
Book Your Free Consultation →This article is general marketing information as of its last-updated date, not legal advice. HIPAA, FTC rules and state privacy laws apply differently to different businesses, and the HHS tracking bulletin is partly vacated, so confirm how they apply to your practice with counsel. Benchmarks are vendor medians, not a forecast or guarantee of your results; individual results vary. Platform policies change, so confirm current rules on each platform's policy page.