Whether you run a primary care practice, physical therapy clinic, dermatology office, chiropractic clinic or med spa, patients increasingly find and choose providers online. They search Google, read reviews, check insurance information and book appointments from their phones.
Healthcare marketing in the US carries extra responsibilities. The Health Insurance Portability and Accountability Act (HIPAA) protects patient information, regulators have warned about tracking technologies on healthcare websites, and the FTC polices misleading health claims. This guide explains how to grow responsibly.
This article is general information, not legal or compliance advice. Work with your compliance officer or a healthcare attorney.
Understand how patients choose
Patients usually consider:
- Location and convenience
- Insurance accepted
- Availability, including same-week and evening appointments
- Provider credentials and specialties
- Reviews and reputation
- Ease of booking
Your marketing should make each of these easy to find.
Google Business Profile
For local searches such as "urgent care near me" or "physical therapist Brooklyn", Google's local results dominate.
- Use the most specific primary category
- Add every location with accurate hours, phone number and website link
- Include services, insurance information on your website and a booking link
- Add real photos of your facility and team
- For multi-provider practices, follow Google's guidelines on individual practitioner listings
Your website
A clinic website should be fast, mobile-friendly, accessible and clear:
- Service pages for each condition or treatment you offer, written in plain language and reviewed by clinicians
- Provider bios with credentials and board certifications
- Insurance and payment information
- Online booking or appointment request forms that are secure
- Location pages for each clinic
- Accessibility built to WCAG 2.1 or 2.2 Level AA where possible
HIPAA and your marketing
Protected health information
HIPAA applies to covered entities, such as healthcare providers that bill insurance electronically, and their business associates. Protected health information (PHI) includes information linking a person to their health condition, care or payment. In general, you need a patient's written authorisation to use their PHI for most marketing purposes.
Testimonials and case stories
Do not share patient details, photos or stories without written HIPAA authorisation. Never confirm that someone is a patient when responding to online reviews, even if they identify themselves. Respond generally and invite them to contact the office.
Tracking technologies
The HHS Office for Civil Rights has issued guidance on the use of online tracking technologies, such as pixels and analytics, by HIPAA-regulated entities, and the FTC has taken action against health companies for sharing health data with advertising platforms. Parts of the OCR guidance were challenged in court, but the safest approach is to avoid placing advertising pixels on pages where patients log in, book appointments or enter health information, and to review all tracking with your compliance team.
Business associate agreements
Vendors that create, receive, maintain or transmit PHI on your behalf, such as booking platforms, patient messaging tools and some agencies, generally need a business associate agreement (BAA). Ask before you share any data.
Paid advertising
Google Ads and Meta both have healthcare advertising policies, and some treatments, such as prescription medicines and addiction services, require certification or are restricted. Avoid targeting based on sensitive health conditions, and use landing pages that are compliant and free of advertising pixels where patients enter health information.
Health claims and the FTC
The FTC requires health claims to be truthful and supported by competent and reliable scientific evidence. Avoid promises of cures, guaranteed results or misleading before-and-after images. State medical boards may also have advertising rules for licensed professionals.
Patient texting
Appointment reminders, confirmations and recall messages reduce no-shows and improve care. Under TCPA rules, healthcare messages may be treated differently from marketing, but conditions apply, so obtain consent at registration, include opt-out instructions and keep messages free of sensitive details. Instead of "Your HIV test results are ready", send "You have a new message in your patient portal". Make sure your texting vendor will sign a BAA where needed.
Reputation management
- Ask patients for reviews in a compliant way, without incentives
- Respond to reviews without confirming patient relationships or sharing details
- Monitor review sites relevant to healthcare
- Use feedback to improve the patient experience
SEO content that builds trust
Write helpful content that answers patient questions: what to expect at a first visit, how a treatment works, recovery tips and when to seek urgent care. Have clinicians review content and show reviewer credentials. Avoid copying content from other sites.
Measuring results without exposing PHI
Track calls, form submissions and bookings at an aggregate level. Use HIPAA-conscious call tracking and analytics configurations, and avoid sending identifiable information to advertising platforms.
Pricing
| Service | DND Teams (starting from) | Includes |
|---|---|---|
| Clinic marketing audit | custom quote | Google profile, website, tracking and reputation review with an action plan |
| Local SEO for clinics | typically US$350–US$700 per month (3-month minimum) | Google profiles, service pages, content, reporting |
| Google Ads management | typically US$300–US$600 per month | Campaigns compliant with healthcare policies (ad spend billed separately) |
| Clinic website | typically US$1,800–US$4,000 | Service and provider pages, booking integration, accessibility checks |
Prices are in US dollars and follow our current price list. SEO plans have a 3-month minimum. Ad spend is billed separately. These prices are positioned below typical US healthcare marketing agency rates. Contact us for an exact quote. We do not access PHI unless a business associate agreement and appropriate safeguards are in place.
Common mistakes
- Advertising pixels on appointment booking or patient portal pages
- Responding to reviews in a way that confirms someone is a patient
- Using patient photos or stories without authorisation
- Making unsupported health claims
- Neglecting Google Business Profile for each location
Telehealth and multi-state practices
If you offer telehealth, make clear on your website which states your providers are licensed in, because patients generally need to be located in a state where the provider holds a licence at the time of the visit. Create separate pages explaining telehealth services, technology requirements and how to book. Multi-location practices should give each clinic its own page with accurate details and its own Google Business Profile.
Improving the patient journey
Marketing works best when the experience after the click is smooth. Answer calls quickly, offer online booking where possible, confirm appointments by text, send clear pre-visit instructions and follow up after the visit with a short, compliant feedback request. Small improvements, such as fewer form fields or clearer insurance information, often increase bookings more than extra advertising spend.
Email newsletters for patients
Email remains a useful channel for health education, seasonal reminders such as flu shots, new service announcements and practice news. Under the CAN-SPAM Act, commercial emails must include accurate sender information, a non-deceptive subject line, a physical postal address and a working unsubscribe option that is honoured promptly. Keep health newsletters general rather than targeted at specific conditions unless you have the right authorisations, and choose an email platform that will sign a business associate agreement if any PHI is involved. Segment by broad interests that patients chose themselves, such as "family health tips" or "sports injury advice", rather than by diagnoses.
Choosing the right agency partner
Ask any marketing partner how they handle privacy before you sign. Good questions include: Will you need access to PHI? Will you sign a BAA if you do? Which tracking tools will you install, and on which pages? Who reviews health content for accuracy? How do you handle review responses? An agency that cannot answer clearly may create risk for your practice.
A 90-day plan
- Month 1: Audit tracking and remove risky pixels; fix Google Business Profiles.
- Month 2: Improve service and provider pages; set up patient reminders.
- Month 3: Launch compliant search ads and a review request process.
How DND Teams helps
We support clinics and practices, including dental practices, with digital marketing, SEO and websites, designed with privacy in mind. Request a free patient acquisition audit.
Prices shown are indicative ranges in US dollars and exclude taxes and third-party charges (such as Meta or carrier fees, billed at cost) unless stated. Your price depends on your requirements; get a custom quote for an exact figure. This article is general information, not legal advice, and reflects our understanding as of October 2026.