Google & Bing Search Ads
Campaigns built around real patient intent, “Mohs surgeon near me,” “same-day ortho consult [city],” payer-specific queries. Ad copy reviewed against LegitScript and FTC health-advertising guidance.
Most agencies run healthcare ads with the same tracking stack they use for e-commerce. That’s how BetterHelp and GoodRx ended up on the FTC’s front page. We run paid search with Restricted Data Processing, server-side GA4, Consent Mode v2, and BAA-covered call tracking, built for practices that can’t afford to be the next case study.
Since the December 2022 HHS bulletin on tracking technologies, most healthcare paid-search setups have been quietly out of compliance. The Meta Pixel on the “Book An Appointment” page. The client-side GA4 tag pulling URL paths that reference procedures. The call-tracking provider with no BAA.
These are not theoretical concerns. FTC fines against BetterHelp ($7.8M), GoodRx ($1.5M), and Premom ($100K) all centered on the same pattern: patient data leaving the practice via ad pixels and analytics tools the practice never realized were PHI-exposed.
Google still gets enough signal to optimize your campaigns, because we send hashed, server-derived conversion data off the authenticated session. Your patient data never touches an ad network's servers.
Campaigns built around real patient intent, “Mohs surgeon near me,” “same-day ortho consult [city],” payer-specific queries. Ad copy reviewed against LegitScript and FTC health-advertising guidance.
Targeting tuned to drive-time isochrones, not arbitrary mile radii. Overlay payer-mix data so you don’t spend on ZIPs whose insurance your practice doesn’t accept.
Fast, accessible, WCAG 2.2 AA. Forms collect contact info only, clinical intake stays inside your patient portal or EHR. Zero third-party tags firing on the confirmation page.
Bid modifiers weighted to long-term patient value, not just first-visit revenue. A recurring dermatology patient is worth eight times a one-visit consult. Your bids reflect that.
CallRail or CallTrackingMetrics under a signed BAA. Recordings encrypted at rest, redacted as needed, retained per your practice’s policy, not the vendor’s default.
Conversions reconciled to actual scheduled appointments in your practice management system via a BAA-covered pipe. Google Ads learns from appointments, not form fills.
A first-party sGTM container on your subdomain. Client-side tags send to us, we decide what, if anything, gets forwarded to ad networks. PHI is stripped before anything leaves your perimeter.
Default-denied consent state on any page a patient might reach. Ad-storage and analytics-storage only flip to granted after an explicit interaction. Enhanced conversions run in ad_user_data: denied by default.
Google Ads account flag enabling limited data processing for California users (and now voluntarily applied across the account) to reduce the surface area Google can use your conversion data for.
Conversions fire from the server with SHA-256-hashed email and phone computed off the authenticated session. Google gets a hashed identifier for matching. Your patient record never leaves the practice.
Paid search for a HIPAA-covered practice requires a strategist, a compliance-aware analyst, and an editor who can read FTC guidance. You get all three.
A paid-search strategist with healthcare vertical experience. They read the OCR bulletins so you don’t.
Questions get a business-day answer. Compliance escalations get a same-hour answer. Not via a ticket queue.
Every tool we introduce carries a BAA, signed before it goes live. Your counsel sees the stack before we do.
Month-to-month. If we can’t demonstrate compliant growth, you leave. That keeps us honest.
Tag inventory across your marketing site and patient portal. Risk-ranked remediation plan delivered in writing.
Server-side GTM container, BAA-covered call tracking, and RDP enabled before any campaign launches.
Specialty-specific campaign structure, PMS-tied conversion goals, and landing pages reviewed by your clinical lead.
Daily bid management, weekly reporting against PMS appointments, monthly strategy call with the full account team.
Yes. Paid search on Google and Bing runs with Restricted Data Processing and BAA-covered call tracking. Catchment bidding skips ZIPs the payer mix will not cover.
Consent Mode v2 and server-side GA4, through a first-party server-side container. Hashed enhanced conversions are computed off the authenticated session. Consent is default-denied on any page a patient might reach. Ad storage and analytics storage flip to granted only after an explicit interaction.
Per HHS's December 2022 and March 2024 OCR bulletins, Meta Pixel and client-side GA never load behind the patient-portal login. The paid-search page lists a Meta Pixel on intake and appointment-confirmation pages, and client-side GA4 collecting URL paths that reference procedures, among the setups most practices still have.
Yes. Call tracking is under a signed BAA. On paid search, that is CallRail or CallTrackingMetrics. Recordings are encrypted at rest, redacted as needed, and retained per the practice’s policy rather than the vendor’s default.
Call tracking, CRM, hosting, email, and the analytics forwarder are tools that could touch PHI. Each one executes a BAA before we turn it on. Counsel gets the stack on day one.
We work with HIPAA-covered practices doing $1M+ in annual revenue. One practice per specialty per metro. If we work with your competitor, we won't work with you, and the reverse is true. The engagement is month-to-month. We earn the work every 30 days.
We’ll inventory every tag on your site and portal, map each one to current OCR guidance, and deliver a written risk assessment, whether you hire us or not. Written report. No sales call required to receive it.
Request a compliance audit