Compliance by Design
Growth that never puts your practice at risk.
Healthcare marketing has rules that most agencies learn the hard way. Here is how I handle them from day one. This is my working approach, not legal advice.
PHI stays out unless it must be in
PHI (Protected Health Information) is any data that links a person to their health. Most growth work never needs it, so I design it out: forms on marketing pages don't ask about conditions, and ad platforms never receive health details.
A BAA before any patient data
When a project does need PHI, for example an AI note workflow or a patient follow-up program, a BAA (Business Associate Agreement) is signed first, and only tools covered by a BAA are used. Ideally the work runs inside your own systems.
Tracking with care
A federal court limited the HHS guidance on tracking public web pages in 2024, but pages behind a login, such as patient portals, remain restricted, and state laws still apply. I keep ad pixels off portal and form-result pages and prefer setups where you control exactly what data leaves your site.
Ad policies handled up front
Google requires US telemedicine and online pharmacy advertisers to hold LegitScript or NABP certification plus Google's healthcare certification, and does not allow ads for unproven treatments. Meta limits health advertisers' conversion tracking. Campaigns are planned around these rules, not discovered after a rejection.
Claims you can stand behind
No promises of results, no comparisons that suggest compounded drugs equal approved ones, and every clinical statement approved by your team before it goes live.
Access you can revoke
Named accounts, multi-factor login, the least access a task needs, and everything removed within two business days when work ends.
Every build passes these checks
Rules change. I review them regularly, and your own counsel should review anything specific to your programs.
- A data-flow diagram shows where any patient data goes, and every tool on that path is covered by a BAA.
- No tracking scripts on pages behind a login.
- Ad accounts are checked for certification needs before launch.
- No unproven treatment claims in any copy.
Find out where your practice leaks patients.
15 questions, 3 minutes, a score for every stage of your patient flow. No health data asked.