Lead magnets for practices and health companies: guides, checklists, quizzes and webinars

A dental office offers a free “Guide to dental implants” PDF in exchange for an email address. A med spa runs a “Which treatment fits your skin?” quiz that shows the result after the visitor types a phone number. A billing company puts its “Denial management checklist” behind a form that asks for name, practice, title and mobile number. A telehealth startup invites physicians to a webinar. Each of these is a lead magnet: something of value given in return for contact details, so the business can follow up.

The download itself is rarely the problem. What causes trouble is what the form asks, what the business does with the answers, and how it follows up by email, text and phone. This guide reads the federal texts that decide those three things: the CAN-SPAM Act (15 USC 7702 and 7704) and the FTC’s CAN-SPAM Rule (16 CFR Part 316), the FCC’s telemarketing and autodialer rule (47 CFR 64.1200), and the HIPAA definitions and marketing rule (45 CFR 160.103, 164.501 and 164.508). It is written for independent practices and for companies that sell to them. Related guides: lead form ads in healthcare, patient opt-outs for email, text and calls, dark patterns on healthcare websites and health quizzes and symptom checkers.

The short version

• A download does not remove the email rules. Follow-up emails whose primary purpose is promoting your services are commercial under 15 USC 7702(2) and need an opt-out link and a valid postal address (7704(a)(3), (a)(5)), whether or not the person asked for the guide.
• Consent helps with one label only. With prior affirmative consent, a commercial email need not identify itself as an advertisement (7704(a)(5)(B)), but the opt-out and the postal address still apply.
• An opt-out ends the sequence. Stop commercial email within 10 business days of a request (7704(a)(4)), and do not ask for anything beyond the email address and preferences to process it (16 CFR 316.5).
• A phone field is not texting consent. Marketing calls and texts sent with an autodialer or prerecorded voice to a mobile number need prior express written consent (47 CFR 64.1200(a)(2)), with the disclosures listed in 64.1200(f)(9).
• Health questions change the data. When a health care provider receives information from a form that relates to a person’s health and identifies them, it fits the definition of individually identifiable health information in 45 CFR 160.103.
• Ask less. A lead magnet needs an email address. Every extra field, especially a health question, adds a rule to follow.

Which lead magnets this covers

The same rules apply across formats, but the risk differs with what the form collects.

• Guides and ebooks. A PDF about a procedure, a condition or a business problem. Usually needs only a name and email.
• Checklists and templates. A pre-visit checklist for patients, or a compliance or billing template for practices. Same as guides.
• Quizzes, assessments and calculators. These ask questions by design, and for a practice the questions are often about the visitor’s health. Our health quiz guide covers result wording, FDA questions and crisis topics; this guide covers the gate and the follow-up.
• Webinars and events. Registration forms often ask for a phone number for reminders, and co-hosted events share the list between two companies.
• Discount or consultation offers. “Download the guide and get a free consult” turns a content offer into a sales offer. Our guide to free consultation offers covers that part.

The form: ask only what the follow-up needs

Before any rule applies, decide what you will do with each field. If no one will use the job title, the date of birth or the “tell us about your symptoms” box, leave it out. This is the simplest way to stay out of the harder questions below.

For a practice, the line to watch is health information. 45 CFR 160.103 defines health information as information created or received by a health care provider (among others) that relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or payment for it. Individually identifiable health information is the subset, including demographic information collected from the individual, that identifies the person or gives a reasonable basis to believe it could. Protected health information is individually identifiable health information transmitted or maintained in any form or medium, with exceptions in the definition.

Read against a lead form, that means: a practice that receives a name and email together with “I have had knee pain for six months” or “I am pregnant” is receiving information the definition describes. A name and email with no health content is a different case. Where the line falls for a download choice alone, such as which condition guide someone picked, is not settled by the definition text, and we do not answer it here. Practical choices that avoid the question:

• Ask for name and email only. Put the guide’s topic in the page, not in a form field the visitor fills in about themselves.
• Do not add free-text boxes to a download form. People type their histories into them.
• If a quiz needs health answers to work, show the result on screen without collecting contact details, and offer the download or booking as a separate, optional step.
• Send form data only to systems your practice has assessed for health information, as our guide to HIPAA and website contact forms explains.

Health companies that are not covered entities or business associates are outside these HIPAA definitions, but not outside the FTC Act or state consumer health data laws. If you sell to practices, a B2B form asking for name, practice and role raises none of the health information questions, and a form asking a physician about their own patients does.

Email follow-up: what CAN-SPAM requires

A lead magnet is usually followed by a sequence: the delivery email, then a few emails that invite the reader to book, buy or take a demo. CAN-SPAM sorts these by primary purpose.

• Commercial. An email whose primary purpose is the commercial advertisement or promotion of a commercial product or service, including content on a commercial website (15 USC 7702(2)(A)). The FTC’s rule sets out how to judge primary purpose when an email mixes content, looking at the subject line and the body (16 CFR 316.3(a)).
• Transactional or relationship. An email whose primary purpose is, among other things, to deliver goods or services the recipient is entitled to receive under a transaction the recipient previously agreed to enter into with the sender (7702(17)(A)(v); 316.3(c)(5)). Whether a free download is such a transaction is not stated in the text. Keeping the delivery email to the link and a short note avoids the question; adding a promotion to it can make it commercial under 316.3(a)(2).

Every commercial email in the sequence must:

• Have accurate header information and a subject line that does not mislead about the contents (7704(a)(1), (2)).
• Include a working return email address or other internet-based mechanism to opt out, which keeps working for at least 30 days after the email is sent (7704(a)(3)(A)). A menu of email types is allowed if it includes an option to stop all commercial email from the sender (7704(a)(3)(B)).
• Include clear and conspicuous notice of the opportunity to opt out, and a valid physical postal address of the sender (7704(a)(5)(A)(ii), (iii)). The rule defines that address as a current street address, a registered post office box or a registered private mailbox (16 CFR 316.2(p)).
• Identify itself clearly and conspicuously as an advertisement or solicitation, unless the recipient gave prior affirmative consent (7704(a)(5)(A)(i), (B)).

CAN-SPAM’s definition of a commercial email does not distinguish between personal and business addresses, so a vendor’s nurture sequence to practice managers is covered the same way. Our guide to email marketing for practices covers the HIPAA side of a practice’s emails, including when a newsletter is marketing.

What affirmative consent means here

Under 15 USC 7702(1), affirmative consent means the recipient expressly consented to receive the message, either in response to a clear and conspicuous request for that consent or at their own initiative. If the message comes from a party other than the one the person gave consent to, the person must have been given clear and conspicuous notice at the time that their address could be transferred to that other party for commercial email.

Two practical points follow. First, a form that says “Get the guide” and nothing more asks for the guide, not for marketing email. If you want consent for the sequence, say so next to the button, for example “We will email you the guide and up to four more emails about our services. You can unsubscribe at any time.” Second, consent does not replace the opt-out link or the postal address; it removes only the advertisement label (7704(a)(5)(B)). A pre-checked box is a weak basis for “expressly consented”, and our dark patterns guide covers what the FTC staff report says about pre-checked boxes and designs that steer privacy choices.

Co-hosted webinars and shared lists

Webinars are often co-hosted: a vendor and a practice group, two vendors, or a vendor and an association. Registrants may then receive email from each host. Three rules apply.

• Transfer notice. For consent to cover email from the other host, the registration page must clearly and conspicuously say the address may be passed to that party for commercial email (7702(1)(B)).
• Who is the sender. When one email promotes more than one company, each one meeting the definition is a sender, unless one company is named alone in the from line and meets the listed requirements, in which case it alone is treated as the sender (16 CFR 316.2(m)). That decides whose opt-out list the email must honor.
• No passing on opt-outs. After someone opts out, the sender and anyone who knows of the request may not sell, lease, exchange or otherwise transfer that address for any purpose other than compliance with the law (7704(a)(4)(A)(iv)).

For a practice, sharing a registrant list with a vendor co-host also raises the HIPAA question above if the list holds health information. Keep the registration form to name, email and role, and keep any health questions out of a co-hosted event’s sign-up.

Opt-outs from a lead sequence

Once someone uses the opt-out mechanism, the sender may not send commercial email within the scope of the request more than 10 business days after receiving it, and neither may anyone acting on its behalf who knows of the request (15 USC 7704(a)(4)(A)(i), (ii)). The FTC’s rule adds that you may not charge a fee, ask for any information other than the email address and opt-out preferences, or require any step beyond replying to an email or visiting a single web page to opt out (16 CFR 316.5). A login wall or a multi-page preference center in front of the unsubscribe fails that test.

A new download later does not automatically restart email. The prohibition lifts only if the person gives affirmative consent after the opt-out request (7704(a)(4)(B)). If your form adds every downloader to the nurture sequence, check it against the suppression list first. Running email, text and call opt-outs from one list is covered in our guide to patient opt-outs for email, text and calls.

Phone numbers, texts and calls

Lead magnets often ask for a mobile number “so we can send the guide by text” or for webinar reminders. The FCC rule is stricter than CAN-SPAM here.

• Marketing by autodialer or prerecorded voice. A call that includes or introduces an advertisement or constitutes telemarketing, made with an automatic telephone dialing system or an artificial or prerecorded voice to a mobile number (among others listed in 64.1200(a)(1)), needs the called party’s prior express written consent (47 CFR 64.1200(a)(2)). Paragraph 64.1200(a)(9) states that, as used there, the term call includes a text message; we treat marketing texts as calls under (a)(2) for this guide, and your counsel can confirm that for your program.
• Prerecorded marketing to a home line. A prerecorded or artificial voice call to a residential line that includes an advertisement or constitutes telemarketing also needs prior express written consent (64.1200(a)(3)).
• What written consent is. A written agreement bearing the person’s signature that clearly authorizes the seller to send advertisements or telemarketing using an autodialer or prerecorded voice to a named number (64.1200(f)(9)). It must clearly and conspicuously tell the person that they authorize those calls and that they are not required to agree as a condition of buying anything (64.1200(f)(9)(i)). The rule says a signature obtained in compliance with the E-SIGN Act counts (64.1200(f)(9)(ii)).
• The health care message exception does not cover lead nurture. 64.1200(a)(2) and (a)(3)(v) exempt calls that deliver a health care message made by or on behalf of a covered entity or business associate, as HIPAA defines them. A text promoting a cosmetic package or a consultation to someone who downloaded a guide is advertising, and we would not rely on that exception for it.

Whether a particular texting platform is an automatic telephone dialing system under 64.1200(f)(2) is a technical and legal question for your counsel. The safer path is the same either way: if the form collects a mobile number for marketing texts, use a separate, unchecked consent line with the 64.1200(f)(9)(i) disclosures, keep it optional, and deliver the guide by email whether or not it is ticked. Our guides to marketing texts from your practice and telemarketing rules for practice calls cover the do-not-call list and calling hours.

When HIPAA treats the follow-up as marketing

For a practice, the HIPAA question is separate from CAN-SPAM. 45 CFR 164.501 defines marketing as a communication about a product or service that encourages recipients to purchase or use it, and then excludes some communications, including those that describe a health-related product or service provided by the covered entity making the communication, unless the covered entity receives financial remuneration from a third party for making it. 164.508(a)(3) requires a patient’s authorization for any use or disclosure of protected health information for marketing, with narrow exceptions.

So a practice emailing its own lead list about its own services is in a different position from a practice that is paid by a device maker or supplement brand to send its offer to that list. If anyone other than the practice pays for the content, the webinar or the email, read 164.501 and 164.508(a)(3) with counsel before the list is used. Our guide to HIPAA marketing rules walks through the exceptions.

The content itself

A lead magnet is advertising, so its claims follow the same rules as an ad. A guide titled “Reverse your back pain in 30 days” makes a health claim that needs support whether it is in an ad or a PDF; our guide to healthcare marketing rules covers substantiation. A few points specific to gated content: If your lead magnet is a white paper or evidence summary, our guide to healthcare white paper claims covers how to cite studies fairly.

• Make the landing page describe what the download actually contains, its length and format. A gate that promises a “complete guide” and delivers a two-page flyer is a misleading offer.
• If the PDF is meant for patients, make it accessible. Our guide to accessible PDFs for patient documents covers tagging and reading order.
• Date the guide and review it. A compliance checklist for practices that cites a rule should say when it was last checked.
• Keep the form’s privacy notice next to the button and make it match what you do with the data. Our guide to practice website privacy policies covers what that page should say.

An illustration

This is a made-up example, not a client. A med spa launches a “Find your best skin treatment” quiz. The draft asks about skin conditions, current medications and pregnancy, then requires name, email and mobile number to show the result. The submit button says “See my results” and a pre-checked box below it reads “Send me offers by text.” Every submission enters a seven-email and four-text sequence, and the results are copied into a co-hosted promotion with a skincare brand.

The fix: the medication and pregnancy questions are removed, because the result does not use them. The result shows on screen with no contact details required. Below it, an optional form asks for name and email only, with a line saying the spa will send the result and up to three emails about its services. A separate, unchecked text consent line carries the 64.1200(f)(9)(i) disclosures. The brand promotion is dropped from this list, since the spa would be paid to promote a third party’s product. Each email has an unsubscribe link that works on one page and the spa’s street address, and the sequence checks the suppression list before sending.

Checklist

• Each form field has a named use; free-text boxes and health questions removed unless needed.
• Practice forms that must collect health details go only to systems assessed for health information (45 CFR 160.103).
• Consent line for the email sequence is next to the button and not pre-checked (15 USC 7702(1)).
• Every commercial email has an opt-out that works for 30 days and a valid postal address (7704(a)(3), (a)(5); 16 CFR 316.2(p)).
• Opt-outs honored within 10 business days and require only an email reply or one web page (7704(a)(4); 16 CFR 316.5).
• New downloads checked against the suppression list before re-entering a sequence (7704(a)(4)(B)).
• Co-hosted events disclose list sharing at sign-up and name one sender where possible (7702(1)(B); 16 CFR 316.2(m)).
• Marketing texts and prerecorded calls only with signed, optional written consent carrying the required disclosures (47 CFR 64.1200(a)(2), (a)(3), (f)(9)).
• No third-party-paid promotions to a practice’s patient list without reading 45 CFR 164.501 and 164.508(a)(3).

How we help

We build landing pages, forms and follow-up sequences for independent practices and health companies as part of lead generation, practice websites and Google Ads work, and we write the consent lines and opt-out paths against the rules as read on the day. We are not a law firm. Related guides: popups on medical websites, CRM and marketing automation with patient data and buying patient leads.

Sources

• 15 USC 7702: Definitions (CAN-SPAM Act)
• 15 USC 7704: Other protections for users of commercial electronic mail
• 16 CFR Part 316: CAN-SPAM Rule
• 47 CFR 64.1200: Delivery restrictions
• 45 CFR 160.103: Definitions (health information, protected health information)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required

More in Practice websites, privacy and tracking