The standard PPC playbook is the same in every industry. Drive traffic, pixel every visitor, retarget the ones who did not convert, build lookalike audiences from your customer list, and let the algorithm find more people like them. It works for e-commerce, SaaS, home services, everything.
Healthcare marketers open that playbook and find most of the pages torn out. Retargeting site visitors, uploading patient lists, building lookalike audiences, targeting by condition: each one is blocked by an ad platform policy, a federal privacy law, or both. Agencies that treat a medical practice like any other account discover this the expensive way, sometimes through disapprovals and sometimes through a regulator.
This post explains the three walls that make standard remarketing impossible for medical practices, the enforcement cases that prove the rules have teeth, and the replacement playbook that actually fills appointment books.
Wall 1: Google prohibits health-based personalization
Google’s personalized advertising policy bans targeting people based on health conditions, treatments, disabilities, and related sensitive categories. This is not a gray area. For a medical practice, the ban covers:
- Remarketing lists built from visitors to your treatment or condition pages
- Custom audiences that imply anyone in them has a health status
- Interest and affinity segments tied to medical conditions
The logic is simple from Google’s side. A person in a “visited the depression treatment page” audience carries an implied diagnosis, and following them around the internet with ads reveals it. So the audience itself is prohibited, no matter how tastefully the ad is written.
Note what this means in practice: the audience feature still exists in your account. Google Ads will let a practice build a remarketing list and attach it to a campaign. The tools do not stop you. The policy does, and enforcement arrives after the ads run, not before. We covered how those violations surface and escalate in our post on Google Ads disapprovals for medical practices.
Wall 2: Meta shut the same doors, then bolted them
Meta removed detailed targeting options tied to health causes back in 2022. Then it went further. Restrictions that rolled out in January 2025 limit businesses categorized as health and wellness from using their event data for lower-funnel optimization, which guts custom audiences and conversion-optimized campaigns built on website activity. [STAT CHECK: verify current scope of Meta’s health and wellness data restrictions before publishing, as Meta has adjusted the rollout.]
Practices feel this as a sudden performance collapse. Campaigns that optimized toward appointment form fills lose the signal they optimized on. The fix is not a clever workaround. Workarounds that re-identify health interest through proxy audiences violate the same policies and add legal exposure on top.
Wall 3: HIPAA and the FTC block the data itself
Even if the ad platforms allowed health retargeting, the data plumbing behind it would still be illegal for a covered practice. Retargeting requires a pixel on your site transmitting visitor identifiers to the ad platform. For a medical practice, visitor identifiers tied to health pages can constitute protected health information, and neither Google nor Meta signs a Business Associate Agreement for their ad products. No BAA, no permitted disclosure. Our Google Analytics and HIPAA post covers this pipeline problem in detail.
Uploading lists makes it worse, not better. Customer Match on Google and custom audiences on Meta both work by uploading hashed patient emails or phone numbers. Hashing is not de-identification under HIPAA. Sending a patient list to an ad platform without individual written authorization is a disclosure, full stop. Lookalike audiences inherit the same problem because they are built from that uploaded list.
And HIPAA is no longer the only enforcer watching. The FTC has used its Health Breach Notification Rule and Section 5 authority against companies that shared user health data with advertisers. GoodRx paid a $1.5 million civil penalty. BetterHelp agreed to pay $7.8 million after sharing user data with ad platforms for retargeting. Cerebral reached a settlement over similar practices. [STAT CHECK: verify all three settlement amounts and current case status before publishing.] Two of those three are not even HIPAA-covered entities in the traditional sense. The regulatory net is wider than HIPAA, and it specifically caught retargeting.
What the ban actually costs you
Be honest about the loss before replacing it. Retargeting exists because most visitors do not convert on the first visit, and reaching warm traffic again is cheap. Healthcare gives that lever up. Lookalike expansion, the other workhorse of scaled PPC, goes with it.
What remains is a different kind of advantage. Healthcare demand is intent-rich. Nobody idly browses “root canal near me.” When a person searches for a provider, the purchase intent is already formed, often urgent, and tied to a location. The replacement playbook is built entirely on capturing that intent and converting it in one session, because you may not get a second one.
The replacement playbook
1. Own the high-intent search. Put the budget retargeting would have consumed into search campaigns on service-plus-location keywords. “Pediatric dentist in [city],” “same day physical therapy [city],” “anxiety therapist near me.” Targeting the search is allowed. Targeting the searcher afterward is not. This distinction is the entire strategy.
2. Defend your branded terms. Patients who saw you once and come back later search your practice name. Branded search campaigns are the closest legal cousin to retargeting: they re-capture warm demand at the moment it returns, at low cost, without touching a single audience list.
3. Use contextual, not behavioral, placement. Contextual targeting places ads based on the content of the page being viewed, not the history of the person viewing it. A sports medicine practice advertising alongside running content targets the context. No user data, no pixel pool, no policy conflict. [STAT CHECK: if adding performance claims about contextual targeting here, source them from a named study first.]
4. Go hard on geography. Location is the most powerful legal targeting dimension a practice has. Tight radius targeting around your locations, bid adjustments by neighborhood, and location-specific ad copy do real work. One caution: aggressive geofencing around hospitals or clinics crosses into regulated territory, and some state privacy laws, including Washington’s My Health My Data Act, restrict geofencing health facilities outright. Target your service area, not other people’s waiting rooms.
5. Convert the first click like there is no second one. Without retargeting, landing page performance carries the whole load. Dedicated landing pages per campaign, click-to-call prominence, online booking above the fold, and fast load times stop being optimizations and become the strategy. This is where healthcare accounts win or lose.
6. Follow up through owned channels, not ad platforms. The compliant version of “staying in front of warm leads” is your own CRM. A prospective patient who calls or submits a form and consents to contact can receive follow-up by phone, email, or text under your own HIPAA-compliant systems. The nurture sequence did not die. It moved from Meta’s servers to yours, where a BAA-backed toolchain can legally run it.
The math that makes it work
Practices worry the restrictions make PPC unaffordable, and healthcare clicks are genuinely expensive. But the account-level math changes when you rebuild around intent.
Retargeting inflates platform conversion numbers partly by taking credit for people who would have returned anyway. Search intent campaigns capture demand at its peak, so a larger share of clicks represent someone ready to book now. Combine that with landing pages built for one-session conversion and call tracking configured without capturing PHI, and cost per booked patient, the only metric the practice actually runs on, often lands in sustainable territory even at high CPCs. Measure that number, not click-through rate, and judge the channel on it.
Frequently asked questions
Is retargeting completely illegal for medical practices?
The combination of ad platform policy and privacy law makes standard website retargeting effectively unusable for covered practices. Google bans health-based personalized audiences, Meta restricts health and wellness advertisers’ event data, and the pixel pipeline behind retargeting raises HIPAA problems regardless of platform policy.
Can I upload my patient email list as a custom audience if it is hashed?
No. Hashing does not de-identify data under HIPAA, and uploading patient identifiers to an ad platform is a disclosure that requires individual written authorization. Lookalike audiences built from such a list carry the same problem.
My ad account still lets me build remarketing lists. Doesn’t that mean it’s allowed?
No. The platforms enforce policy after ads serve, not by disabling features. A campaign can run for weeks before disapproval, and the privacy exposure exists from the first impression regardless of whether the platform ever flags it.
What about retargeting people who only visited non-health pages, like our careers page?
The theory sounds cleaner than the practice. Audience definitions drift, tags fire more broadly than intended, and defending the distinction in an investigation is expensive. Most healthcare counsel advise against maintaining any visitor-based ad audiences, and the return rarely justifies the risk.
Does this apply to my practice if we never bill insurance?
Ad platform policies apply to health-related advertising regardless of your billing model, and FTC enforcement has reached companies outside traditional HIPAA coverage. Cash-pay practices should follow the same playbook.
How do I stay in front of interested patients without retargeting?
Branded search captures people who return to look for you. Owned channels handle the rest: once someone contacts the practice and consents, follow-up runs through your HIPAA-compliant email, text, and phone systems instead of ad platforms.
The bottom line
The retargeting ban is real, layered, and not going away. Practices that fight it with workarounds collect disapprovals and legal exposure. Practices that accept it rebuild around the one asset healthcare marketing has that other industries envy: patients search with urgent, local, high-stakes intent. Capture the search, convert the first visit, and move follow-up onto systems you own.
CGColors builds healthcare PPC on exactly that model: intent-first search campaigns, compliant tracking, landing pages engineered for one-session conversion, and follow-up architecture that respects HIPAA. The playbook is different, and it works. Your practice gets found first, called first, booked first.
