Nobody teaches this in medical school, and no residency program covers it. You open a practice, you need patients, so you build a website and start advertising. Everything you know about marketing came from being a consumer of it, which means your instincts point directly at tactics that are illegal in your industry.
The uncomfortable part: four separate authorities regulate how you advertise, they do not coordinate, and each one can penalize you independently for the same campaign. A single before-and-after post can violate HIPAA, breach FTC substantiation rules, break a state board advertising regulation, and get your ad account suspended. Four problems, one post, and the practice owner usually learns about all four at once.
This is the plain English map. What each regulator actually covers, where the overlaps are, and the one system that satisfies all of them without a lawyer on retainer for every campaign.
Regulator 1: HIPAA, and what it costs you
What it governs: disclosure of protected health information. Not your claims, not your pricing, just the information.
The part that surprises everyone: PHI includes the fact that someone is your patient. Not their diagnosis, not their chart, just the relationship. This single rule invalidates most instinctive marketing moves. You cannot thank a reviewer for visiting. You cannot post a photo of a patient without a specific authorization. You cannot upload your patient list to Facebook. You cannot run a pixel that tells Google who visited your treatment pages.
Who enforces it: the HHS Office for Civil Rights, plus private class actions that have produced far larger payouts than OCR penalties in recent years.
The practical rule: treat every piece of patient information as locked unless a signed authorization unlocks it for a specific use. We cover the four highest-risk applications in depth: replying to patient reviews, asking patients for reviews, publishing testimonials and photos, and website tracking and analytics.
Regulator 2: the FTC, and the claims problem
What it governs: truth in advertising. The FTC does not care who your patients are. It cares whether what you say about your services is true, substantiated, and not misleading.
Two principles carry the whole framework: advertising must be truthful and not misleading, and advertisers must have adequate substantiation for objective claims before running the ad. That word “before” matters. Lacking a reasonable basis for a claim is itself the violation, whether or not the claim later turns out to be true.
The standard is higher than most owners assume. For health claims, the FTC generally expects competent and reliable scientific evidence, and its guidance emphasizes high quality randomized, controlled human clinical trials for health-related claims. Patient anecdotes and your own practice’s outcome tracking are not substantiation for a general efficacy claim.
The testimonial trap. Advertisers cannot make claims through testimonials that would be deceptive if the advertiser made them directly. A patient’s honest opinion is not enough on its own. The implied claim that the same result is typical still needs evidence behind it, and material connections such as free or discounted treatment in exchange for the testimonial must be disclosed.
Net impression is what gets judged. The FTC evaluates the overall impression of the ad, including imagery, not just the literal words. A disclaimer that contradicts the main message of the ad does not fix the ad. And liability can attach even when only one reasonable interpretation of a claim is false.
Who can be held liable: not just the practice. Owners, officers, and the ad agency that ran the campaign can all be liable for deceptive marketing. That is worth knowing when you hire.
Regulator 3: your state board, and your license
What it governs: professional advertising conduct, under the licensing authority that lets you practice at all.
Why it is the scariest of the four: the others take money. This one can take your license. Penalties range through public reprimand, fines, suspension, and revocation.
Rules vary by state, and you are responsible for knowing yours. Common prohibitions include guaranteeing results, comparative superiority claims without evidence, and false or misleading advertising designed to attract attention to a practice. Requirements differ meaningfully: some states require disclaimers when photos show atypical results, some mandate specific consent documentation for patient images, and some require the supervising physician’s name in promotional materials for certain practice types.
The trigger you should expect: competitor complaints. State boards investigate advertising complaints, and the person most motivated to file one is the practice down the street losing patients to your campaign. Documentation is your defense.
Your action item: find your board’s advertising regulations, read them once, and note anything specific to your specialty. Redo this if you open in a new state. One hour, once.
Regulator 4: the ad platforms, and their private rulebook
What it governs: everything the other three do, plus rules the platforms invented themselves.
Google and Meta are not regulators, but they hold the switch. Google prohibits health-based personalized advertising outright, requires certification for categories like telemedicine and addiction treatment, and restricts prescription drug terms across ads, keywords, and landing pages. Meta restricts health and wellness advertisers’ use of event data. Neither will sign a Business Associate Agreement for their advertising products.
Platform enforcement is automated, inconsistent, and arrives after your campaign is already running. It is also the fastest feedback loop you have. We break down the five most common disapproval causes and how to fix each one in a dedicated post, and the retargeting restrictions in another.
Where the four overlap
The overlaps are where practices get hit multiple times for one mistake.
A before-and-after photo needs HIPAA authorization, FTC substantiation for the implied outcome claim, a state board disclaimer if the result is atypical, and platform compliance if it runs as an ad.
A patient testimonial needs the same authorization, plus an FTC material connection disclosure if the patient got anything for it, plus evidence supporting the implied efficacy claim.
A retargeting campaign fails HIPAA on the data pipeline, fails Google’s personalization policy, and can draw FTC attention under its health data enforcement.
The word “guaranteed” violates FTC substantiation, most state board rules, and Google’s misrepresentation policy simultaneously.
Notice the pattern. Compliance is not four separate checklists. It is one review that asks four questions of every asset.
The one system that satisfies all four
You do not need a compliance department. You need a review step that happens before publication, every time.
Build a pre-publication checklist with four questions. Does this asset disclose patient information, and if so is there a valid signed authorization covering this exact use and channel? Can every objective claim in it be substantiated with evidence I could produce on request? Does it violate any of my state board’s specific advertising rules? Does it comply with the policies of the platform where it will run?
Get counsel to review your templates once, not your campaigns weekly. One legal pass over your authorization form, your review response library, your claim language standards, and your intake consent forms covers most of what you will publish for years. That is a defined project, not a retainer.
Document your decisions. Keep a short record of why each piece of creative complies. This does double duty: it supports a platform appeal when an ad gets wrongly disapproved, and it demonstrates due diligence if a competitor files a board complaint.
Train everyone who touches public communication. Front desk staff replying to reviews and social posts need the same rules the marketing vendor follows. HIPAA training for these roles is required anyway.
Vet your vendors. Any tool receiving patient data needs a signed Business Associate Agreement. Any agency running your campaigns should be able to describe all four regulators without prompting. If they cannot, they will eventually create a problem you pay for, and FTC liability can reach both of you.
Frequently asked questions
I run a small cash-pay practice. Do all four really apply to me?
Yes. HIPAA applies based on covered entity status rather than billing model, state board rules apply to every licensee, FTC authority reaches health advertising broadly including businesses outside traditional HIPAA coverage, and platform policies apply to any account running health ads.
Can I just copy what larger practices in my area are doing?
No. Their marketing may be non-compliant, may be covered by certifications or authorizations you cannot see, or may simply not have been caught yet. Competitor behavior is not a safe harbor, and competitors are also the most common source of state board complaints.
Which regulator should I worry about most?
Weigh by consequence. Platform disapprovals are frequent but recoverable. FTC and HIPAA exposure is financial and can be large. Your state board holds your license. Most practices under-weight the board precisely because enforcement is quieter.
Does hiring a marketing agency transfer the liability?
No. The practice remains responsible, and FTC principles extend liability to agencies and individuals who participate in deceptive marketing rather than shifting it away from the advertiser. Contractual indemnification helps with costs, not with a board complaint.
Is there anything I can say freely?
Plenty. Your credentials, your training, the services you provide, your locations and hours, your languages, your insurance participation, and factual descriptions of procedures are all safe ground. The restricted zone is patient information and outcome claims, not information about your practice.
How much does compliant marketing cost compared to normal marketing?
Somewhat more, mostly in the review layer and in tools that carry BAAs. The offset is that the compliant tactics available to healthcare, especially local search and high-intent keywords, are also the highest-converting ones. You are giving up cheap tactics that work poorly for practices anyway.
The bottom line
Four regulators, one review step. Ask whether the asset discloses patient information, whether every claim is substantiated, whether your state board allows it, and whether the platform permits it. Get your templates reviewed once, document your decisions, and train the people who post. That system takes a week to build and then runs quietly behind everything you publish.
The practices that struggle are not the ones taking risks deliberately. They are the ones who never learned the map, marketing on consumer instincts in an industry where those instincts are illegal.
CGColors builds healthcare marketing with the compliance layer designed in from the start: vetted tooling, counsel-ready templates, documented creative decisions, and campaigns built on the tactics that are both permitted and effective. That is how a practice grows without inviting a regulator, and how it gets found first, called first, booked first.
