Skip to content

00   The compliance library

Medical practice marketing, inside the rules.

Most paid media advice assumes you can retarget a visitor, upload a customer list, and send the platform whatever the conversion was worth. A medical practice can do none of those things the ordinary way. This library covers what the rules actually permit, which vendors need an agreement before they touch a patient identifier, and how to measure booked patients without sending anything protected.

Running a practice on leads rather than a storefront? Read the Lead Quality library

Last updated September 2026  ·  6 answers

01   The direct answer

What can a practice
actually run?

A medical practice can run search ads, count conversions, and import booked-patient outcomes, as long as three things hold: every vendor touching a patient identifier is under a signed business associate agreement, nothing leaving your systems says why the patient made contact, and no audience is built from health-related behavior. Remarketing, Customer Match and lookalikes stay off. Measurement moves to the click id and offline import.

That is the shape of it. The questions below cover each constraint on its own, with the specific thing to check rather than a principle to agree with.

One thing to be clear about, and it appears on every page in this library. I am a marketer, not a lawyer, and none of this is legal advice. What a practice is permitted to disclose is a decision for its own counsel or compliance officer, and the answers here are written to give that conversation something concrete to start from.

02   The six constraints

Six constraints
that change the whole job.

  1. CONSTRAINT 01

    The audience tools you were sold are closed to you

    Remarketing lists, Customer Match, and lookalike audiences are the default playbook in every other vertical. Google blocks advertiser-curated audiences for advertisers promoting restricted health content, and the Meta Custom Audiences Terms bar audience criteria built on health information. Different routes, same result. Google gives notice before suspending an account for an ordinary violation, so this is rarely a same-day catastrophe, and it is still an appeal and unscheduled downtime bought for very little upside.

  2. CONSTRAINT 02

    Every vendor that touches a patient identifier needs an agreement first

    Call tracking, form handlers, scheduling widgets, analytics, the mailbox the lead notification lands in. Each one receives something that can identify a patient in the context of seeking care, which is what makes it protected. The question is never whether the tool is popular. It is whether the vendor will sign a business associate agreement, and whether the specific plan you are on is the one that agreement covers.

  3. CONSTRAINT 03

    The conversion you actually care about happens off the website

    A form submit is not a patient. A phone call is not a patient. The booking happens in the practice management system, days later, sometimes on a different phone number than the one that called. Optimizing to form fills teaches the bidding algorithm to buy form fills, and a practice can double its conversion count while booking the same number of appointments.

  4. CONSTRAINT 04

    Sending the outcome back is where most setups quietly break the rules

    The fix for the problem above is offline conversion import, and it is also the easiest place to leak. The platform must never receive a condition, a procedure, a department, or anything that says why the patient called. It receives a click id, a timestamp and a value, and the click-id path sends no personal identifier at all. One conversion action named after a condition is enough to undo that.

  5. CONSTRAINT 05

    The ad copy is regulated by somebody other than the ad platform

    State medical boards set their own advertising rules, and they are often stricter than the ad platforms. Unsubstantiated superlatives, board-certification language, before-and-after imagery, testimonials about outcomes: each is a board matter rather than a policy review. A campaign can be fully approved by Google and still be a complaint waiting to happen, and the board is the only one of these attached to a license.

  6. CONSTRAINT 06

    The policy labels on your keywords mean less than they look like

    Condition keywords interact with the personalized advertising rules and come back carrying a limited status, which reads like a rejection and usually is not one: on Search the keyword generally keeps serving. Meanwhile a phone number in ad text is a flat prohibition, and some healthcare verticals cannot run at all without third-party certification. Telling those three apart before launch saves a fortnight.

03   Check it on your own account

Three references.
No sales call.

  • The Lead Quality Stack

    For businesses that close on the phone.

    A practice books patients by phone, so the conversion the platform sees is never the outcome. This is the architecture that closes that gap.

    Read the stack

  • Google Ads Setup Audit

    Free 25-page PDF. No email gate.

    The workbook I run before touching an account. Not healthcare-specific, and the conversion and trigger sections apply to a practice unchanged.

    Download the audit

  • A practice rebuild, in full

    Named client, every figure traced.

    A hand surgery practice moved off WordPress and its ad account cut over onto the new site, including what I deliberately did not move.

    Read the case study

04   The questions

Every question,
answered in full.

Grouped by which constraint they sit under. Each question links to a self-contained answer. No gate, no email.

01

Compliance limits

3 questions

02

Measurement

2 questions

03

Ad approval

1 question

05   What I do with this

The constraints
come first.

Any practice manager reading this can run the first check today. List every tool that receives a name, a phone number, or an email from somebody contacting the practice: the call tracking, the form handler, the scheduler, the analytics, the inbox the notification lands in. For each one, find out whether the vendor signs a business associate agreement and whether your current plan is covered by it. That list is usually longer than anyone expects, and the gaps are usually in the tools nobody thinks of as medical software.

I am Conner Crowe. I spent a decade inside agencies and in-house teams and have managed more than $15M in ad spend working with founders direct. I build the measurement before I touch a bid, and in a practice that means building it inside the constraints rather than discovering them afterwards. Same person on the call as on the keyboard.

I want to be straight about what I am not. I do not sign off on what a practice may disclose, I do not write the policy, and I will not tell you a setup is compliant. That is your counsel or your compliance officer. What I do is build the pipeline so the question they have to answer is a narrow one, and hand them the specifics rather than a vendor brochure.

Want this checked on your account?

Same constraints,
checked on your account.

Thirty minutes on the phone. Before the call I look at what your ads point at, which vendors are receiving patient identifiers, and whether the conversions you optimize to are the ones that become appointments.

Book a strategy call Request the free audit instead hi@connercrowe.com