Healthcare — stronghold
Fill the calendar without leaking patient data
You can’t drop a pixel or ask only happy patients for reviews. The workarounds are the whole job
What the data says
Expensive clicks, and a settlement bill for getting tracking wrong
$8.00
Average cost per click for dentists and dental services, against $5.42 across all industries. What happens after the click decides whether that’s worth paying
WordStream, Google Ads Benchmarks 2026
$6.6M
Settlement agreed by Novant Health over patient data sent to third parties by website tracking tools. The University of Rochester Medical Center settled a similar suit for $2.85M
Reported class-action settlements; see HIPAA Journal coverage of tracking-technology litigation
1 in 3
Healthcare websites still found running Meta pixel tracking code in 2024 analysis — long after the risk was widely reported
HIPAA Journal analysis of healthcare website tracking, 2024
The thing most agencies get wrong
The rule was struck down. The risk wasn’t
This is the single most misunderstood issue in healthcare marketing right now, and getting it wrong in either direction costs you — either a settlement, or a decade of flying blind because someone panicked and turned off all measurement
What actually happened, in order
- December 2022. The HHS Office for Civil Rights issued a bulletin treating a broad range of tracking on unauthenticated web pages as a disclosure of protected health information — meaning an ordinary Meta or Google pixel on a page about a condition could be a HIPAA violation.
- June 2024. The American Hospital Association, the Texas Hospital Association and two health systems sued. On 20 June 2024 Judge Mark T. Pittman in the Northern District of Texas ruled that HHS had exceeded its statutory authority and vacated that part of the guidance.
- September 2024. HHS withdrew its appeal, leaving the vacatur standing.
- And yet. Private plaintiffs never needed the bulletin. Novant Health agreed to pay $6.6M and the University of Rochester Medical Center $2.85M to settle pixel-related suits, and state privacy statutes continue to apply. The federal enforcement theory went away; the class-action exposure did not.
So the honest answer to “can we run a pixel” is: that is a risk decision for your counsel, not a technical one for your agency — and any agency telling you it’s simply fine now, or simply forbidden, hasn’t read past the headline. What we can do is build measurement that doesn’t depend on the answer.
Sources — AHA on the 20 June 2024 ruling · HIPAA Journal reporting on the withdrawn appeal and on settlements. General information, not legal advice.
The workaround
Measure the outcome, not the person
Practices tend to land in one of two bad places: still running third-party pixels on condition pages because nobody revisited it, or having ripped out all tracking in 2023 and been unable to tell which campaigns work ever since. Neither is necessary.
The pattern that works is to move measurement server-side. The ad platform receives an anonymous conversion event — an appointment was booked, a call converted — and nothing else. Your CRM holds the identity, inside your control, under your business associate agreements. You get the reporting; the third party gets a number.
It takes real setup work, which is precisely why a third of healthcare sites are still doing it the easy way.
How we run it
The healthcare playbook
In practice, the things that move appointment volume are duller than the things agencies like to pitch
01
Own the map pack before anything elseMost patients pick a practice from local results and a review count, not from a website. A complete, categorised, photographed Google Business Profile with genuine review volume usually moves bookings more than the same money spent on ads.
02
Make booking possible without a phone callAt $8 a click, the conversion path decides the economics. Online scheduling, a form that works on a phone, and someone actually answering during opening hours will outperform any bidding strategy.
03
Rebuild measurement server-sideAnonymous conversion signals to the platforms, identity held in your CRM under your agreements. You keep the reporting without shipping patient data to a third party.
04
Build a compliant review engineAsk every patient, not just the pleased ones — gating is prohibited under the FTC consumer reviews rule that took effect in October 2024. Respond to negatives without confirming anyone was a patient.
05
Develop provider referrals deliberatelyThe slowest channel and the most durable. Relationship-built referrals are fine; anything of value attached to them is federal criminal exposure, so the programme has to be designed accordingly.
06
Write clinical content that can survive scrutinyNamed clinician authors, review dates, cited sources. Search engines apply extra scrutiny to health content, and thin pages about symptoms will not rank — nor should they.
Before you build any referral incentive
Referral development is one of the strongest channels a practice has, and one of the easiest to turn into a federal offence. The line is remuneration.
- Anti-Kickback Statute — prohibits knowingly offering or receiving anything of value to induce or reward referrals reimbursable by a federal health care program. Maximum $100,000 fine and ten years’ imprisonment since the Bipartisan Budget Act of 2018.
- Stark Law — strict liability, no intent required, restricting physician referrals for designated health services to entities they hold a financial relationship with.
- State law — often broader, and frequently applies regardless of who is paying the bill.
Conversations, education, being easy to reach and running a practice worth recommending are all fair game and none of it is remuneration. Anything with a value attached needs a healthcare attorney’s eyes before launch. Our full write-up is in the referral marketing guide.
Source — HHS Office of Inspector General, Fraud & Abuse Laws. General information, not legal advice.
What we run for healthcare clients
The services that fill calendars
Google Business Profile
The highest-return work for most practices, and the most commonly neglected. Categories, services, photos, questions, posts and review velocity.
Corunit PRM
Patient relationship management: recall, reactivation, automated reminders and a full contact history that lives inside your control.
Reputation management
Review generation that asks everyone rather than gating, plus response templates that never confirm who was a patient.
AI assistant
Captures enquiries outside opening hours, answers the routine questions, and books — without becoming another place patient data ends up unprotected.
Paid search
Built around what happens after the click, because at these click prices the funnel decides whether the channel is viable.
Clinical SEO
Depth, named clinician authorship and review dates — the only kind of health content that ranks and the only kind that should.
Good questions
Healthcare marketing, answered
Not sure whether your site is still leaking data to a third party? That’s the first thing we check on a free audit.
Can we run a Meta pixel on our practice website?
The regulatory position changed; the litigation position didn’t. In December 2022 the HHS Office for Civil Rights issued a bulletin treating much unauthenticated-page tracking as a disclosure of protected health information. The AHA and others sued, and on 20 June 2024 a federal judge in the Northern District of Texas vacated that portion as exceeding the agency’s authority; HHS withdrew its appeal that September. That removed the specific enforcement theory — it did not end private class actions or state privacy claims. Novant Health agreed to pay $6.6M and the University of Rochester Medical Center $2.85M to settle pixel suits. Treat it as a live risk decision for your counsel, not a settled technical question.
How do we track performance without exposing patient data?
Move measurement off the browser and away from identifiers. Server-side tracking that sends only a conversion signal, call tracking that records the outcome rather than the conversation, and a CRM that holds identity while the ad platform receives an anonymous event will give you the numbers without shipping anything identifying to a third party. It’s more work than dropping a pixel — which is exactly why so few practices have done it.
Can we pay for patient referrals?
Generally no, and the exposure is criminal. The federal Anti-Kickback Statute prohibits offering or receiving anything of value to induce or reward referrals of business reimbursable by a federal health care program — maximum $100,000 fine and ten years’ imprisonment since the Bipartisan Budget Act of 2018. Stark adds strict-liability civil exposure for physician self-referral, and many states go further regardless of payer. Earning referrals through relationships is fine; attaching value to them is not.
Can we use patient reviews and before-and-after photos?
Only with proper authorization, and the rules stack. Using a patient’s identity or images in marketing needs a HIPAA-compliant authorization, not a verbal yes. The FTC Endorsement Guides then require any material connection to be disclosed, and since October 2024 the FTC rule on consumer reviews carries civil penalties for fake or suppressed reviews. And you can’t answer a negative review by discussing someone’s care — confirming they were a patient is itself a disclosure.
Why are dental and medical clicks so expensive?
Because one new patient is worth a lot over their life with the practice, so everyone bids accordingly. WordStream’s 2026 benchmarks put dentists and dental services at $8.00 per click against a $5.42 average across all industries. At that price the economics are decided after the click: how fast the phone is answered, whether online booking exists, whether follow-up is automated.
What actually fills a practice calendar?
Local search visibility and speed of response, well ahead of clever creative. Most patients choose from the map pack and a review count, then judge you on whether they can book without phoning. A complete Google Business Profile, real review volume and online scheduling typically move the appointment number more than an ad budget increase does.
How should a practice handle negative reviews?
Respond publicly without acknowledging the person was a patient, invite them to a private channel, and fix what caused it. Confirming treatment in a public reply is a disclosure even when the reviewer disclosed it first. And soliciting reviews only from happy patients — review gating — is prohibited under the FTC consumer reviews rule that took effect in October 2024.
Can health tech companies market more freely than practices?
Somewhat, but the exposure moves rather than disappears. A health app that isn’t a covered entity may sit outside HIPAA and still fall under the FTC Health Breach Notification Rule, state health privacy statutes such as Washington’s My Health My Data Act, and general FTC authority over deceptive claims. Outside HIPAA is not the same as unregulated.
How long does healthcare marketing take to show results?
Paid search and local profile work can move appointment volume within weeks, because the demand already exists and you’re competing for it. Building organic authority for clinical topics takes considerably longer — search engines apply extra scrutiny to health content and thin pages don’t rank. Provider referral relationships are slower still, and the most durable of the three.
A partner, not a vendor
See how we can help your business grow with digital marketing
Ready to speak with a marketing expert? Feel free to contact us.
Free
Marketing audit
A 30-minute strategy call, a real audit of what you’re running, and a roadmap — including if the finding is that you’re already in good shape