Healthcare marketing playbook (HIPAA-aware)

The HIPAA reality

The Health Insurance Portability and Accountability Act governs how protected health information (PHI) is handled in marketing. The non-negotiables:

• Never include PHI in ad creative, audience targeting, or analytics tracking.
• Patient identifiers (name, contact, condition, treatment) cannot be combined with marketing data.
• Marketing email lists cannot be cross-referenced with patient records without explicit authorization.
• Pixel-based tracking on patient-portal pages is high-risk and often prohibited.
• Business Associate Agreements (BAAs) required with any vendor handling PHI-adjacent data.

The OCR (Office for Civil Rights) has actively enforced HIPAA in marketing contexts since 2022. The 2023 guidance on online tracking technologies tightened restrictions on pixels and analytics on healthcare-related pages. Audit your stack regularly.

The platform restrictions

Google Ads and Meta Ads both restrict health-related advertising:

• Personalized health condition targeting is prohibited on Meta as of 2022 (post-Cambridge Analytica reforms).
• Google requires certification for prescription drug advertising, telehealth, addiction treatment, and addiction-related products.
• Condition-specific creative and landing pages are restricted for some categories (especially mental health, addiction, eating disorders).
• Geographic restrictions on certain health products vary by state and country.

The channel mix

Channel	Role
Google Search	High-intent queries: "[condition] doctor near me," "[procedure] cost." The dominant healthcare paid channel.
Local SEO + Google Business Profile	Critical for provider-based businesses. Patient reviews drive local search ranking.
Healthgrades, Vitals, Zocdoc	Provider directory listings. Reviews and profile completeness drive visibility.
Meta Ads	Awareness and high-funnel content marketing. Condition-specific targeting restricted.
Content marketing / SEO	Symptom-to-condition educational content. WebMD-style. Long-tail volume.
Direct mail	Still works for primary care, dental, optical, especially in suburban markets.
Local TV and radio	Awareness for major hospital systems and specialty practices.
Referrals (provider-to-provider)	The dominant new-patient source for specialty practices.

Patient acquisition for providers

1. Google Business Profile. Complete profile, regular posts, response to every review.
2. Provider directory listings. Healthgrades, Vitals, Zocdoc, Doximity, U.S. News profiles.
3. Local SEO. Schema markup, local backlinks, citation consistency.
4. Google Search Ads. Condition-specific high-intent campaigns where compliance allows.
5. Reputation management. Birdeye, Podium, or similar for review generation.
6. Insurance landing pages. Many patients filter by "in-network" — make that filter easy.
7. Telehealth offerings. Increasingly expected; differentiator for providers offering it well.
8. Online scheduling. Zocdoc-style scheduling reduces friction from search to appointment.

Digital health marketing

For telehealth platforms, digital therapeutics, health apps, and direct-to-consumer health products:

• Higher emphasis on Meta Ads and TikTok for younger demographic acquisition.
• Educational content as the trust-building foundation.
• App store optimization (ASO) for app-based products.
• Strict consent management and opt-in marketing (especially for sensitive condition categories).
• Outcome-driven marketing — patients want to know "does this work?" with evidence.

The trust-building discipline

Healthcare customers buy on trust more than almost any other vertical. Trust signals:

• Provider credentials, training, hospital affiliations.
• Years in practice and case volume (especially for surgical specialties).
• Genuine patient testimonials (with appropriate consent and disclosures).
• Third-party recognition (Top Doctors lists, hospital rankings).
• Educational content depth.
• Transparency on cost, insurance acceptance, and what to expect.

Measurement under HIPAA constraints

• Tracking is allowed on non-PHI pages; restricted on patient-portal and condition-specific content pages.
• GA4 setup must exclude PHI from event parameters.
• Conversion tracking allowed at aggregate level (form submission count, call count); not at patient-identifier level via marketing pixels.
• CRM integration requires BAA-covered vendors.
• Audit pixels on all pages regularly — accidental PHI capture is a HIPAA violation.

Can I retarget healthcare audiences?

Yes, but with restrictions. No condition-specific targeting in most platforms. Behavioral retargeting (visited service page, started form) is allowed if PHI isn't captured in the audience definition. Audit the pixel implementation to ensure PHI doesn't flow through.

What can't I do with healthcare ads?

Personalized condition-specific targeting on Meta (banned 2022). Prescription drug ads without Google certification. Condition-specific creative for restricted categories (addiction, eating disorders, mental health on some platforms). PHI in ad creative or audience definitions.

Are healthcare reviews allowed?

Yes, with appropriate consent and disclosures. Patients must consent to having their experience shared. Outcomes claims require typical-results disclosures. Verify state-specific rules for your specialty.

How important are provider directory listings?

Very. Healthgrades, Vitals, Zocdoc, Doximity often rank above your own site for "[your specialty] near me" queries. Optimize the listings — complete profiles, recent reviews, accurate insurance/scheduling info.

Should I use pixel tracking on patient portals?

High-risk. The 2023 OCR guidance specifically called out pixel tracking on healthcare-related pages. Most healthcare organizations have removed third-party pixels from patient-facing logged-in pages. Get legal counsel before installing tracking on any patient portal.

What's the typical CAC for healthcare?

Highly variable. Primary care: $100-$400. Dental: $200-$800. Specialty (orthopedics, dermatology): $300-$2,000. Cosmetic surgery: $1,000-$5,000+. Digital health apps: $20-$100 for SMB user acquisition. LTV justifies the spend in most cases.

Operating checklist

1. Define unit economics: CAC, LTV, payback period.
2. Map the funnel stages and conversion events.
3. Choose 2-4 vertical-appropriate channels for the first 90 days.
4. Build measurement to match the vertical's attribution complexity.
5. Establish creative system aligned to vertical norms.
6. Set up compliance/regulatory infrastructure where relevant.
7. Document the playbook for the next operator.