Buying patient leads: kickback and privacy risks

Sooner or later every practice gets the pitch: pay only for results, a set price per lead, per phone call or per booked appointment. For an owner tired of paying for ads that may or may not work, it sounds fair. The trouble is that a price tied to each patient sent your way looks a lot like the thing federal health care law calls a kickback, and the lead itself often arrives with consent and privacy questions nobody at the practice has checked.

This guide covers how the federal Anti-Kickback Statute applies to paying for leads, what two published HHS Office of Inspector General (OIG) advisory opinions say about per-call, per-click and per-booking fees, how the telemarketing consent rules apply once you start calling or texting purchased leads, including the FCC one-to-one consent rule that a court threw out in 2025, and what to ask a seller before you sign. If you pay people or businesses for referrals more broadly, read our guide to patient and physician referrals as well. Per-booking fees charged by appointment marketplaces are covered in listing a practice on price comparison and booking marketplaces. For inbound calls bought per call, including EKRA and state patient brokering law, see our guide to pay-per-call in healthcare. Referral payments in recovery housing are covered in sober living marketing.

This is general information, not legal advice. Sources cited were checked on October 29, 2026: 42 U.S.C. 1320a-7b(b), 1320a-7a(a)(5) and 42 CFR 1001.952(f); OIG Advisory Opinions 08-19 (issued October 29, 2008) and 19-04 (issued September 5, 2019); 47 U.S.C. 227(b)(3); 47 CFR 64.1200 as currently codified; the Eleventh Circuit opinion in Insurance Marketing Coalition Limited v. FCC (January 24, 2025); FCC Order DA 25-621 (July 14, 2025); the FCC revocation rule published at 91 FR 67214 (October 26, 2026, effective November 25, 2026); 45 CFR 164.502(a)(5)(ii); and the FTC staff perspective Follow the Lead (September 2016). Advisory opinions bind only the parties that asked for them, and state laws on fee splitting, kickbacks and telemarketing vary. Ask a healthcare attorney about any arrangement before you pay for it.

What “buying leads” usually means

The phrase covers very different things, and the legal risk changes with the details. The common versions:

Per-lead fees. You pay a set amount for each form submission or contact record a seller passes to you.
Per-call fees. You pay for each phone call routed to you, often only calls longer than a set number of seconds.
Per-booking or per-patient fees. You pay when someone books an appointment, shows up or becomes a patient.
Lead lists. You buy a batch of names and numbers of people said to be interested in a service, then contact them yourself.
Pay-per-click advertising. You pay an ad platform for each click on your ad. This is advertising you run, not a lead someone else collected, though the fee structure question below still applies.

The closer the fee gets to “we get paid when a patient walks in”, and the more the seller decides who gets sent to you, the more it resembles paying for a referral. That is the question the Anti-Kickback Statute asks.

The Anti-Kickback Statute and per-lead fees

The federal Anti-Kickback Statute, 42 U.S.C. 1320a-7b(b), makes it a felony to knowingly and willfully offer or pay any remuneration, directly or indirectly, in cash or in kind, to induce a person to refer an individual for any item or service payable in whole or in part by a Federal health care program, such as Medicare or Medicaid. The same section covers soliciting or receiving that remuneration. The statute sets a fine of up to $100,000, imprisonment of up to 10 years, or both. It applies to the practice that pays as well as to the seller that is paid.

Two points follow for anyone buying leads. First, the statute is about intent, so the same fee can be lawful in one setup and a problem in another; the details of the arrangement decide it. Second, if none of your patients are covered by a Federal health care program, this particular statute may not reach you, but state anti-kickback and fee-splitting laws can that apply to all payers, and professional licensing boards have their own rules on paying for referrals. Do not assume a cash-pay practice is outside every rule.

The regulations include safe harbors, sets of conditions that protect an arrangement if all of them are met. The referral services safe harbor at 42 CFR 1001.952(f) is the one most lead sellers would point to, and its conditions are strict: the service may not exclude any qualified participant, every participant must pay the same and only based on the cost of operating the service, payments may not be based on the volume or value of referrals, and the service must make specific written disclosures to each person seeking a referral. A typical per-lead or per-patient price does not meet the cost-based condition. OIG said exactly that in the 2008 opinion below.

What OIG advisory opinions say about per-call, per-click and per-booking fees

OIG issues advisory opinions on specific arrangements at the request of the parties. Each one is limited to its facts and can be relied on only by the party that asked for it. Still, two of them show how OIG thinks about paying for leads, and the factors it weighed are a useful checklist.

Advisory Opinion 08-19 (issued October 29, 2008). An internet advertiser that ran pay-per-call and pay-per-lead sites in other industries wanted to offer the same model to chiropractors. OIG said per patient, per unit of service and similar variable compensation structures are particularly problematic under the statute, because they relate to the volume or value of business. It found the proposal did not fit the personal services safe harbor or the referral services safe harbor. It still concluded it would not impose sanctions, for a combination of reasons drawn from the facts the requestor certified:

The advertiser was not a health care provider or supplier and was not affiliated with one.
The site collected only a zip code. It did not collect payer information, medical history or diagnosis, and it did not target Federal health care program beneficiaries.
The fee did not depend on whether the caller became a patient or on which services they used, and every chiropractor paid the same rate. OIG contrasted this with problematic success fees.
The site did not steer callers. It listed every subscribing chiropractor in the caller’s immediate area, based only on zip code, with a notice that chiropractors pay to be listed.
Callers paid nothing and received nothing, such as discount coupons, for using the site.

Advisory Opinion 19-04 (issued September 5, 2019). A technology company ran an online directory where providers paid per new-patient booking, would pay per click, and paid for sponsored ads. OIG concluded the arrangement presented a low risk of fraud and abuse and would not impose sanctions. Among its reasons: fees were set in advance and did not exceed fair market value; fees did not depend on the user’s insurance status; paying more did not buy more frequent or more favorable placement in the directory results, which depended only on the user’s own search criteria; the company was not a provider; its advertising was passive, reached beneficiaries only if they visited, and sponsored results were clearly marked as paid.

Notice what both opinions have in common. The seller was not a health care provider, the fee did not depend on the patient’s insurance or on whether they became a patient, nobody was steered to a particular practice because of what it paid, and patients got nothing of value for responding. Both opinions also say OIG does not decide whether a fee is fair market value. If a lead offer you are looking at differs on any of these points, it is outside what these opinions describe, and that is a conversation for your attorney before you sign.

Consent rules once you start calling or texting leads

A purchased lead is usually a phone number, and the practice’s next step is a call or a text. That brings in the Telephone Consumer Protection Act (TCPA) and the FCC rules at 47 CFR 64.1200, which treat a text as a call for this purpose. Our guide to text message appointment reminders covers the rules for messages to existing patients. Leads raise different questions, because these people are not your patients yet and the consent, if any, was collected by someone else.

Marketing calls and texts need written consent. Under 64.1200(a)(2), a call or text that includes an advertisement or constitutes telemarketing, made with an automatic telephone dialing system or an artificial or prerecorded voice to a wireless number, needs the called party’s prior express written consent. The exclusion for health care messages from a HIPAA covered entity does not turn a sales pitch to a stranger into a health care message.
What written consent means. Section 64.1200(f)(9) defines it as a signed written agreement, electronic signatures included, that clearly authorizes the seller to deliver advertisements or telemarketing messages by those means to a specific telephone number, with a clear and conspicuous disclosure that the person is not required to agree as a condition of buying anything. The consent has to authorize the seller, meaning the business the calls are made for.
The Do Not Call registry. Under 64.1200(c)(2), telephone solicitations to a residential subscriber on the national do-not-call registry are prohibited unless an exception applies. One exception is the subscriber’s prior express invitation or permission, which the rule says must be evidenced by a signed, written agreement between the consumer and seller stating that the consumer agrees to be contacted by this seller and including the telephone number to be called. Section 64.1200(c)(1) also bars telephone solicitations before 8 a.m. or after 9 p.m. local time.
Private lawsuits. Under 47 U.S.C. 227(b)(3), a person can sue for actual losses or $500 for each violation, whichever is greater, and a court may increase the award up to three times if the violation was willful or knowing. Liability is counted per call or text, not per campaign.

What happened to the FCC one-to-one consent rule

In 2023 the FCC adopted a rule that would have limited prior express written consent to one seller at a time, so that one form submission could not authorize marketing calls from many businesses. It never took effect. On January 24, 2025, the FCC postponed its effective date, and the same day the U.S. Court of Appeals for the Eleventh Circuit vacated it in Insurance Marketing Coalition Limited v. FCC. The court’s mandate issued on April 30, 2025, and on July 14, 2025 the FCC adopted Order DA 25-621, which repealed the one-to-one version and restored the earlier text of 64.1200(f)(9) in the codified rules.

So a lead sold with consent language naming many “marketing partners” is not barred by a one-to-one rule today. That does not make it safe. The definition that remains still requires a signed agreement authorizing the seller, and if you are ever sued, you are the one who has to show the consent covered your practice and the number you called. Ask for the exact form wording, the date and time it was signed, and the page it was signed on, before the first call, not after a complaint.

The FCC is also changing how people can withdraw consent. A rule published on October 26, 2026 and effective November 25, 2026 lets callers designate an exclusive method for revoking consent, such as replying with a standard word like “stop”, if they disclose it clearly in each call or text. Under the amended rule, a revocation in response to a call or text that contains advertising or telemarketing revokes consent to all future marketing calls and texts from that caller, and revocations must be honored within a reasonable time not to exceed ten business days. If a lead says stop, that is the end of marketing contact from your practice.

Privacy: what a lead form collects and where it goes

FTC staff described how online lead generation works in its September 2016 report Follow the Lead. Information a person types into a web form can be sold and resold through several intermediaries, sometimes in an automated auction, and the report says consumers may not know their information can be sold multiple times, that they may be contacted by many unfamiliar marketers, or that the details they entered may be verified or supplemented with information they did not provide. FTC staff said lead buyers should monitor their lead sources for deceptive claims and complaints, and warned that companies who ignore warning signs and look the other way may be at risk of violating the law themselves.

For a practice, that means the promise a lead form made to the person filling it in becomes your problem. If the form implied the person was contacting your practice, or a free service, or a specific treatment outcome, the call they get from you starts with a misunderstanding at best. Look at the actual pages that collect your leads, not a sample.

Privacy also runs the other way. Once a lead becomes a patient, their information is protected health information in your hands. Under 45 CFR 164.502(a)(5)(ii), a HIPAA covered entity may not sell protected health information, meaning disclose it in exchange for remuneration, without the patient’s authorization that meets 164.508(a)(4). If a lead seller asks you to report back which leads became patients, or proposes a discount in exchange for your patient data, stop and ask counsel. For the tracking side of the same question, see our guide to tracking pixels on practice websites. If the offer is a mailing list rather than leads, see our guide to buying or renting mailing lists.

Questions to ask a lead seller before you sign

How is the price set? Is it per lead, per call, per booking or per patient? Is it the same for every practice? Does it change with the patient’s insurance or with whether they become a patient?
Who decides which practice gets each lead? Is every participating practice in the area shown, or does a higher payment buy more or better leads?
Is the seller a health care provider or affiliated with one? OIG treated this as a significant factor in both opinions above.
Does the form ask about insurance, Medicare, Medicaid or a diagnosis? Targeting by payer or collecting health information changes the analysis.
Are people offered anything to respond? Gift cards, free services or discounts to the person filling in the form raise their own issues under the beneficiary inducement law and state rules.
Can we see the exact consent language and the signed record for each lead? Including the date, time, page and phone number.
Was any lead scrubbed against the national do-not-call registry? And how does the seller handle stop requests it receives?
Are the leads exclusive, or sold to several buyers? The FTC report describes leads being resold through multiple layers.
What happens to our data? Will the seller ask for outcomes, patient names or appointment data back from us?

Write the answers down and give them to your attorney with the contract. If a seller will not answer these questions in writing, that is an answer too.

A safer way to get the same result

Most of what a lead seller offers a practice can be built directly: a search ad you control, a map listing that brings calls straight to your phone, a website form that patients know is yours, and call tracking so you can see where each inquiry came from. You pay for advertising, not for patients, and the consent and privacy questions stay inside your own practice, where you can answer them. Our guides to call tracking for medical practices and patient acquisition cost cover how to measure it.

Illustration: a small physical therapy practice is offered leads at a fixed price per booked evaluation. Instead, it runs search ads that send calls to its own tracked number and a booking page on its own site. It pays the ad platform per click whether or not anyone books, every caller knows they reached the practice, and the front desk can see which ads produced calls. Whether that costs more or less than the lead offer depends on the practice; what changes is who controls the patient’s first contact.

How we handle this

We do not sell lead lists, and we do not charge practices per patient. Our lead generation work is advertising, websites and call handling that the practice owns, measured by source so you can see what each channel produces. Where a form or tool might handle patient information, our work is built with HIPAA in mind, and we confirm in writing what a BAA covers before any patient information flows through a tool; if it is not covered, we do not route patient information through it. See our medical lead generation service for how we approach it.

Is it illegal for a medical practice to buy leads?

Not automatically. The federal Anti-Kickback Statute turns on intent and on the details of the arrangement, and OIG has approved some per-call and per-booking advertising models in advisory opinions limited to their facts. Fees tied to whether someone becomes a patient, to their insurance, or to steering patients to whoever pays more raise the risk. State law may be stricter. Ask a healthcare attorney before you sign.

Does the Anti-Kickback Statute apply if we do not take Medicare or Medicaid?

The federal statute is about items and services payable by Federal health care programs. State anti-kickback and fee-splitting laws can apply to all payers, and licensing boards have their own rules, so a cash-pay practice should still check its state’s statutes and board rules.

Is the FCC one-to-one consent rule in effect?

No. The Eleventh Circuit vacated it on January 24, 2025 before it took effect, and the FCC restored the earlier definition of prior express written consent in July 2025. Marketing calls and texts covered by 64.1200(a)(2) still need prior express written consent that authorizes the seller.

Can we text leads who filled in a form on a lead seller’s site?

Only if you can show consent that covers your practice and that number for the kind of message you send, and the number is not on the do-not-call registry without an exception. Get the consent record before the first text.

Is paying per click on Google Ads the same as buying leads?

No. You pay the ad platform to show your own ad, and the person contacts your practice directly. OIG Advisory Opinion 19-04 also looked at per-click advertising fees and found low risk on the facts presented there. Google’s own healthcare ad policies still apply.

Do you sell patient leads?

No. We do not sell lead lists or charge per patient. We build advertising, websites and call handling that the practice owns.

Buying patient leads: kickback, consent and privacy risks for medical practices