Facebook and Instagram ads for medical practices: Meta health ad rules, pixels and patient lists

Facebook and Instagram ads can put a practice in front of local people who are not searching yet: new residents, people who follow local news and community pages, and people who will need a dentist, a physical therapist or a dermatologist sometime this year. They are also the ad channel where practices most often get into trouble, because Meta’s ad system was built around personal data and targeting, and health is the area where both Meta and the law limit what you can do with personal data.

This guide covers what a practice needs to know before running ads on Meta: the Meta ad rules that apply to health, the data rules in Meta’s Business Tools Terms, why patient lists and pixels on patient pages are the main risk, and how to build campaigns that work without patient data. For Google Ads rules, see our healthcare ad policy basics. For captions and alt text on social posts and ads, see our guide to accessible social media posts and video ads. Meta campaigns can also place ads in the Threads feed, which our guide to Threads and Bluesky for medical practices covers. For Meta instant forms and the questions to leave off them, see our guide to lead form ads in healthcare. Retargeting on Meta and Google is covered in our guide to healthcare remarketing ads. Pinterest has its own health ad rules; see Pinterest for medical practices.

Meta ad rules that apply to health

Meta’s Advertising Standards include a Health and Wellness policy, which Meta’s change log shows was last updated on July 22, 2026. The parts that matter most for practices:

• Age targeting. Ads promoting dietary, health, or weight loss or weight gain products and services, and ads for cosmetic products, procedures or surgeries, must be targeted to people at least 18 years old.
• No attacks on appearance. Ads for weight loss or weight gain products and services, or cosmetic products or procedures, cannot contain statements of inferiority about physical appearance: negative terms, descriptions or questions that attack someone’s appearance, body parts or hygiene.
• No cure claims for listed diseases. Meta bars claims, including from health professionals, to cure, heal or eliminate a listed set of incurable or terminal conditions, including diabetes, cancer, Alzheimer’s and HIV. Claims about treating or managing symptoms are not covered by that ban, but they still need to be true and supported.
• No clickbait. Meta bars sensational language with exaggerated or extreme claims in a health context, and promises of specific outcomes within a set timeframe without disclaimers or qualifiers.

Prescription drug ads, telehealth prescribing and addiction treatment follow separate Meta policies with their own certification requirements. Our guides to weight loss clinic marketing and addiction treatment marketing cover those.

The personal attributes rule: do not tell people what they have

The Meta rule practices break most often is not in the health policy at all. Meta’s personal attributes policy says ads must not assert or imply personal attributes, including physical or mental health and medical conditions. Meta’s examples of what ads cannot do include implying that the advertiser knows someone’s personal attributes or medical information, or that of their family. Meta’s explanation is that ads that make assumptions about people could be perceived as intrusive, unsettling or inaccurate, and that ads should focus on the benefits of the product or service.

In practice, the difference is often one word. Illustrations:

• Not allowed: “Struggling with your back pain?” or “Is your diabetes under control?” Both imply the reader has the condition.
• Usually fine: “Physical therapy for back pain, same week appointments” or “Diabetes education classes this spring.” These describe the service without saying anything about the reader.
• Usually fine: General statements and public service style messages, which Meta allows as long as they do not assert that someone or their family has a health condition.

The same thinking works for HIPAA and for patients. An ad that sounds like it knows something about the reader is unsettling even when it is a guess.

Meta’s data rules: no health information through Business Tools

Meta’s Business Tools Terms govern the Meta pixel, the Conversions API, app tools and custom audiences. In the version effective November 3, 2025, the advertiser represents and warrants that it will not share Business Tool Data with Meta that includes or is based on, directly or otherwise, health information, financial information, consumer report information or other categories of sensitive information. The same terms say that the names and criteria you choose for your events, conversions and custom audiences must not reflect, imply or be based on any of those categories.

That is a contract with Meta, and it applies whether or not HIPAA applies to you. It rules out the setups that health advertisers used to rely on:

• Conversion events named after a condition or treatment, such as a custom event for a consultation about a specific procedure.
• Audiences built from visits to condition pages, then used to retarget those visitors.
• Sending form contents, appointment types or URLs that reveal a condition to Meta through the pixel or the Conversions API.

Meta also applies its own automated limits to what some health and wellness advertisers can share and optimize for, and announces them in the advertiser’s Events Manager and Business Help Center. Those pages require a login, so we do not quote them here. Check what Meta shows for your account before planning conversion tracking.

Patient lists and custom audiences

Uploading a list of your patients to Meta to target them, or to build lookalike audiences from them, is the step that carries the most risk for a practice that is a HIPAA covered entity. Under 45 CFR 160.103, individually identifiable health information includes demographic information that relates to the provision of health care to an individual and identifies them. A list of your patients’ names, emails or phone numbers tells Meta that those people received care from you.

Uploading that list is a disclosure of protected health information. A covered entity may disclose it only as the Privacy Rule permits (45 CFR 164.502(a)), and without a business associate agreement with the platform, that means a signed authorization from each patient (45 CFR 164.508(a)(1)). If the ads promote a third party’s product or a third party pays you, the marketing authorization rules in 164.508(a)(3) apply as well. Meta’s Business Tools Terms separately bar sharing data based on health information. Our recommendation is not to upload patient lists to ad platforms at all, and our guide to patient list uploads and customer match explains why hashing does not change that. To reach existing patients, use your own channels: email and text messages that patients agreed to receive, covered in our guides to healthcare email marketing and text message reminders.

Pixels on practice websites

The Meta pixel is the most common source of patient data reaching Meta by accident. The HHS Office for Civil Rights has published a bulletin on online tracking technologies used by HIPAA covered entities. On June 20, 2024, a federal court in Texas vacated the part of it that treated certain visits to public pages as protected health information, and HHS chose not to appeal. The rest of the bulletin, including the sections on logged-in pages such as patient portals, appointment and symptom forms, and mobile apps, still stands. Meta’s own terms bar health information in any case.

Our guide to tracking pixels on practice websites explains the court decision and a practical setup in detail. The short version for Meta ads: keep the pixel off appointment, intake, portal and condition pages, measure what you can on general pages, and count booked appointments in your own systems rather than sending them back to Meta.

Lead forms, landing pages and claims

Meta’s instant forms collect information inside Facebook and Instagram. If you use them, keep the questions to what you need to call someone back: a name, a phone number or email, and a preferred time. Do not ask about symptoms, conditions or insurance in the form, and make clear what happens after someone submits it. If you send people to your website instead, the same applies to your landing page; our guide to healthcare landing pages covers what to include.

The FTC rules on health claims apply to social ads like any other advertising. The FTC Health Products Compliance Guidance says claims about health benefits or safety need competent and reliable scientific evidence, and that anecdotal evidence about individual experiences is never enough to support claims about effects. Patient testimonials and before and after photos in ads need a signed HIPAA authorization if you are a covered entity, and under 16 CFR 255.2(b) a testimonial about a key result will be read as typical. Our guide to patient testimonials and before and after photos covers both. If you pay creators or patients to post about your practice, see our guide to healthcare influencer marketing.

What tends to work, inside the rules

Meta ads that work for practices are usually simple. They target a geographic area and an adult age range, and let the ad itself describe the service. Some approaches that fit the rules:

1. Announce something real. A new location, a new clinician, extended hours, same week appointments or a new service. These are useful to local people and make no claims about them.
2. Show the practice, not the patient. Short videos of the team, the office and what a first visit looks like. Our healthcare video marketing guide has ideas.
3. Use broad audiences. Location and age, without condition interests or patient lists. Let the ad copy and creative do the selecting.
4. Measure in your own systems. Ask new patients how they found you, and count calls and bookings in your practice software, rather than sending appointment data back to Meta.
5. Check the policy pages before each campaign. Meta updates its Advertising Standards often. A rule that applied last quarter may have changed.

None of this guarantees results, and Meta ads are not the right channel for every practice. For people actively searching for care, search ads and local SEO usually come first.

How we help

We plan and run patient acquisition campaigns for independent practices with these rules in mind: broad targeting, no patient lists uploaded to ad platforms, no pixels on patient pages, and ad copy that describes the service rather than the reader. We build with HIPAA in mind, and we confirm in writing what a BAA covers before any patient information flows through a tool; if it is not covered, we do not route patient information through it. We do not sell lead lists and we do not promise leads, bookings or results.

Frequently asked questions

Sources

• Meta Advertising Standards: Health and Wellness (change log through July 22, 2026)
• Meta Advertising Standards: Privacy violations and personal attributes
• Meta Business Tools Terms (effective November 3, 2025)
• eCFR: 45 CFR 160.103, definitions (individually identifiable health information)
• eCFR: 45 CFR 164.501, definitions (marketing)
• eCFR: 45 CFR 164.508(a)(3), authorization required for marketing
• HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (with the note on the June 20, 2024 court order)
• eCFR: 16 CFR Part 255, Guides Concerning the Use of Endorsements and Testimonials in Advertising (255.2)
• FTC: Health Products Compliance Guidance (December 2022)

More in Healthcare advertising guides