We plan and run every US campaign against three overlapping frameworks: HIPAA, the FTC Act, and FDA advertising rules.
HIPAA governs how Protected Health Information can be used in marketing. Any communication that encourages someone to buy or use a product or service counts as marketing, and using PHI for that purpose requires the individual’s signed authorization — not just a checkbox buried in a privacy policy. We do not build retargeting audiences from condition-specific page visits, and we treat contact-form and chat data as PHI until proven otherwise.
The FTC’s role is separate: it polices truthful, evidence-backed advertising. Claims about outcomes, effectiveness, or “board certified” status must be substantiated with real evidence before they go live, and testimonials must reflect typical results rather than best-case outliers. The FTC has also expanded enforcement around tracking pixels — Google and Meta pixels placed on appointment or intake pages have triggered multi-million-dollar settlements industry-wide, so we audit pixel placement on every client site and keep sensitive pages (booking forms, patient portals) free of third-party trackers unless a signed Business Associate Agreement is in place.
In practice this means: authorization-based email and retargeting lists, substantiation files behind every efficacy claim, HIPAA-compliant forms instead of standard contact forms for anything patient-facing, and BAAs signed with every vendor that touches patient data.