At a physical therapy clinic in South Tampa, the owner has 40 minutes between patients. The plan: boost a Facebook post about a new service, reply to a nice Google review, and check whether last month’s ad budget produced any appointment requests. Then an industry newsletter lands in her inbox. A practice two states away just paid a settlement because its appointment page was quietly sending visitor data to an ad platform. She closes the laptop and boosts nothing.
That freeze happens at medical and wellness businesses every week. The privacy rules are real and the penalties are real, so the safest-feeling move is to stop marketing entirely. Doing nothing has a cost too. The practice down the street that figured out the compliant playbook is taking the new patients. Treat it as general guidance and run final decisions past your attorney or compliance officer.
Why is healthcare marketing more restricted than other industries?
Because the data most marketing tools run on is protected. HIPAA governs how covered providers handle patient information, and the FTC polices health data at companies HIPAA never touches. Both have treated website tracking and ad targeting as enforcement priorities in recent years.
Two groups need to pay attention. Covered entities, meaning practices, clinics, and anyone who bills insurance, live under HIPAA and its rules about what counts as a disclosure of patient information. Wellness businesses like gyms, supplement brands, and coaching practices often assume they are exempt, and then discover the FTC has pursued telehealth and health app companies for sharing user data with advertising platforms.
The common thread is simple. When a person’s identity gets paired with a signal about their health, that pairing is regulated, whoever holds it. Most marketing software was built on the assumption that data flows freely between your website and ad platforms. Healthcare removes that assumption, and everything else follows from there.
Can you put tracking pixels on a healthcare website?
Not on pages connected to seeking care, unless you have safeguards most ad platforms refuse to provide. A pixel on a booking page, patient portal, or condition-specific page can send a visitor’s identity plus a health signal to a third party, and regulators have treated exactly that as an improper disclosure.
A pixel is a small piece of code from Meta, Google, TikTok, or an analytics vendor that reports what visitors do on your site. On a retail site, that is routine. On a healthcare site, “this identifiable person viewed the knee replacement page and then opened the booking form” is a different kind of information. Federal guidance to hospitals and health systems has said as much, and the logic extends to small practices. Ad platforms generally will not sign a business associate agreement covering their pixels, which means a cookie consent banner does not fix the problem.
What to do instead, starting this week:
- Inventory every script on your site. Tag managers make this worse, because pixels added years ago keep firing after everyone forgets them. List what loads on every page, especially booking flows and portals.
- Strip ad pixels and retargeting from care-related pages. Booking, portals, symptom and condition pages, and intake forms. General brand pages carry less risk, but decide that with counsel, not by default.
- Measure in systems you control. Count new-patient form submissions on your own server, ask “how did you hear about us” at intake, and watch call volume by week. A clean measurement setup that respects these limits still answers the question owners actually have: is the marketing working.
Can you use patient testimonials in your marketing?
Yes, with written authorization from the patient, and with real care in how you respond to public reviews. The story a patient volunteers publicly is theirs to tell. The confirmation that they are your patient is yours to protect.
For anything you publish yourself, get a signed HIPAA authorization that names the specific use: the quote, the photo, the video, the site or channel it will appear on. Keep it on file and honor a revocation if one comes. This applies to anything that identifies the person, including a recognizable face in a waiting room photo.
Reviews work differently because the patient published first. You can and should reply, but never confirm patient status, even when the reviewer describes their visit in detail. “Thank you for the kind words” works. “We loved treating your shoulder” does not. Use the same restraint on one-star reviews: acknowledge, offer a phone number, take it offline.
Wellness brands answer to the FTC instead. Endorsements must reflect results a typical customer can expect, or clearly disclose what typical results look like. Burying “results not typical” in fine print stopped satisfying regulators years ago, and before-and-after photos meet the same standard.
How do you grow when pixels and retargeting are off the table?
With the channels that never needed personal data: education content, local search, reviews, and opted-in email. They compound over time, they build the trust that healthcare decisions run on, and none of them require knowing who visited your website.
- Education content. Patients search their questions long before they call. Write plain answers to the ones you hear in the exam room every week: what a first visit involves, when to see a specialist, what recovery actually looks like. Those pages earn search rankings, and AI assistants quote them when people ask the same questions in ChatGPT.
- Local search. Care is local, so the map pack matters more than almost anything else. Complete your Google Business Profile: correct categories, every service listed, real photos, current hours. Our 30-minute Google Business Profile checklist covers the whole pass.
- Reviews at volume. Ask every patient, through the same workflow, at the same point after their visit. A steady stream of honest reviews beats a curated handful, and asking everyone keeps you clear of selective-solicitation trouble.
- Email people asked for. A monthly education newsletter to an opted-in list is low risk and high trust. Skip condition-based segments; send everyone the same useful thing.
The local angle matters more in Tampa Bay than most owners realize. The region is dense with practices and wellness brands, from med spas near Water Street to family clinics in Brandon, and most market the same way: a thin website, a half-finished profile, a handful of old reviews. When the field looks uniform, the practice that shows up complete and answers questions plainly reads as the authority. We build websites and marketing systems for healthcare and wellness businesses with these constraints designed in from the start, rather than patched on after a scare. One more reason to get the website itself right: healthcare sites carry ADA exposure too, and an accessible site protects you on a second front.
Questions we hear from healthcare practices
Does HIPAA apply to my gym, med spa, or supplement brand?
Often not directly, but the FTC’s health data rules probably do, and some med spa services fall under HIPAA when a licensed provider is involved. If you collect information about people’s health, handle it carefully regardless of which law applies.
Is Google Analytics allowed on a medical practice website?
Standard analytics on booking pages and portals has drawn regulatory objections, because it can transmit identifiers alongside care-related activity. The conservative setup keeps analytics off those pages entirely or uses a privacy-first tool that stores no personal identifiers. Confirm your configuration with counsel.
Can a healthcare practice run paid ads at all?
Yes. Target geography and the services people search for, never health conditions or past visitors to your site. A search ad on “sports physical Tampa” needs no retargeting to work.
What should I fix first?
The script inventory. List everything loading on your site, remove what you cannot justify, and document the decision. Then finish your Google Business Profile. Both cost time, both cut risk, and both start paying back immediately.