Book a practice review

Insights

Healthcare marketing rules for medical practices: a sourced guide by topic

Healthcare marketing rules for practices: the federal and Google rules for ads, reviews, websites and phones, with primary sources and detailed guides.

Creahive Health team

Marketing a medical practice means working inside several rulebooks at once. The FTC decides what counts as a deceptive ad or a fake review. HHS writes the HIPAA rules that cover patient information, including what ends up on your website, in your review replies and in your ad tracking. Google sets its own policies for ads and Business Profiles, and it can suspend a listing or disapprove an ad without any regulator being involved. Medicare and Medicaid rules reach discounts, free offers and missed-appointment fees.

This page is a map of those rules, organized by the marketing job you are doing. Each section says in a few lines what applies, links to the primary source, and points to our longer guide on that topic. It is written for owners and managers of independent dental, med spa, chiropractic, integrative and primary care practices.

This is general information based on federal rules, agency guidance and Google policy pages as we read them in October 2026, not legal advice. State law, licensing boards and payer contracts often add rules of their own. Check anything you plan to publish with your compliance lead or a healthcare attorney.

Who writes the rules

  • Federal Trade Commission (FTC). Deceptive advertising in general, health claims, endorsements and testimonials (16 CFR Part 255), and fake or suppressed reviews (16 CFR Part 465).
  • HHS Office for Civil Rights (OCR). HIPAA privacy and security for covered practices, including marketing communications, patient authorizations and online tracking. OCR also enforces nondiscrimination rules such as Section 504 (disability) and Section 1557 (language access) for practices that receive federal financial assistance.
  • Department of Justice. The Americans with Disabilities Act, including its guidance on website accessibility.
  • CMS and the HHS Office of Inspector General. Medicare and Medicaid rules, including the laws on gifts and inducements to beneficiaries, and the No Surprises Act good faith estimate rules.
  • FDA. What a drug or device is approved or cleared for, which limits how you describe treatments.
  • Google. Not a regulator, but its Ads policies and Business Profile guidelines decide whether your ads run and your listing stays up.

Advertising and health claims

The FTC Act prohibits deceptive ads, and for health claims the FTC expects competent and reliable scientific evidence behind what you say, judged by the overall impression an ad leaves rather than its literal wording. The FTC’s Health Products Compliance Guidance sets out how it applies that standard. Patient stories and testimonials must not suggest results most patients will not get.

Google Ads

Google restricts ads for prescription drugs and some treatments, limits how health information can be used for personalized ad targeting, and has separate policies on unreliable claims and dishonest pricing. Many practices first meet these rules as a disapproved ad. Before-and-after imagery, drug names such as botulinum toxin or GLP-1 brand names, and landing page wording are common causes.

Reviews and testimonials

Three sets of rules meet here. The FTC’s Consumer Reviews and Testimonials Rule (16 CFR Part 465) bans fake reviews, buying reviews conditioned on sentiment and misrepresenting that the reviews you show are all or most of what you received when you suppress negative ones. Google’s Maps content policy has its own bans, including on paying or offering incentives for reviews and on selectively asking only happy customers for reviews (review gating). And HIPAA applies to your replies: HHS OCR has settled cases with dental practices that disclosed patient information while answering online reviews.

Google Business Profile and local search

Google’s guidelines for representing your business decide how a practice and its individual providers may be listed, what the business name may contain and when a location is eligible. Breaking them can lead to a suspended profile, which is one of the fastest ways to lose new patient calls. Local ranking itself is based on relevance, distance and prominence, according to Google.

Patient information on your website

A practice that is a HIPAA covered entity has to think about where patient information goes once it leaves a form, a chat box or a tracking tag. HHS expects a business associate agreement with vendors that create, receive, maintain or transmit protected health information for you. On tracking, HHS OCR issued a bulletin on online tracking technologies; in 2024 a federal court in Texas vacated part of it (the part about unauthenticated public pages), and the rest of the bulletin still stands. The FTC also enforces against misuse of health information by businesses outside HIPAA.

Accessibility

The Department of Justice has said the ADA applies to the websites of businesses open to the public, and it points to WCAG as a helpful standard. Practices that receive federal financial assistance from HHS also fall under the 2024 Section 504 rule, which adopts WCAG 2.1 AA for web content. After an HHS interim final rule in May 2026, the compliance dates are May 11, 2027, for recipients with 15 or more employees and May 10, 2028, for smaller ones. The FTC has acted against an accessibility overlay vendor over claims that its tool could make sites compliant.

Offers, discounts and referral rewards

Free exams, discounts, copay waivers and gifts can run into the federal beneficiary inducement law (42 U.S.C. 1320a-7a(a)(5)) and the Anti-Kickback Statute (42 U.S.C. 1320a-7b) when Medicare or Medicaid patients are involved. The FTC’s guide on the word “free” applies to everyone. Rewards for referrals need particular care.

Phones, reminders and front desk

The phone call is part of marketing, and it has rules too. Under 45 CFR 149.610, self-pay and uninsured callers must be told that a good faith estimate is available, and any question about cost counts as a request for one. Covered practices must provide language assistance under Section 1557. HHS allows appointment reminders and voicemail messages with limited detail. CMS sets the conditions for charging Medicare patients for missed appointments.

A pre-publish check for any marketing piece

Before an ad, a landing page, a social post or a patient email goes out, run it through these questions:

  1. Can we prove every health claim?If it says or implies a treatment works, you need competent and reliable evidence for that claim, for the kind of patient it is aimed at.
  2. Are results typical?A patient story or before-and-after photo must not suggest an outcome most patients will not get.
  3. Is any patient identifiable?Photos, stories and review replies that identify a patient generally need a written HIPAA authorization, or they should not be published.
  4. Where does the data go?Check which tags and forms are on the page and which vendors receive what visitors type or click.
  5. Does Google allow it?Drug names, before-and-after images, prices and health targeting each have their own Google policy.
  6. Is there an offer?If it involves something free or discounted, check the inducement rules with your compliance lead when Medicare or Medicaid patients could respond.
  7. Can everyone use it?Check text alternatives for images, captions for video, color contrast and keyboard access.

How we work within these rules

Our services for practices, from websites and local SEO to Google Ads and the AI front desk, are built around the rules above, and we write each guide from the primary sources so you can check our reading yourself. See our specialty pages for dental, med spa, chiropractic and integrative medicine practices. We are a marketing agency, not a law firm; we flag questions for your compliance lead or attorney rather than answer them.

Frequently asked questions

Does HIPAA apply to my practice’s marketing?

If your practice is a covered entity (generally, a provider that sends health information electronically in standard transactions such as insurance claims), HIPAA applies to the patient information you use in marketing, including testimonials, photos, review replies and data sent to ad or analytics vendors. Cash-only practices may fall outside HIPAA, but the FTC can still act on unfair or deceptive use of health information.

Who enforces fake review rules?

The FTC enforces 16 CFR Part 465, and the FTC says the rule allows courts to impose civil penalties for knowing violations. Google separately removes reviews and can restrict profiles that break its content policy.

Is Google Ads policy the same as the law?

No. Google’s policies are its own conditions for running ads, and they can be stricter than the law. An ad can be legal and still disapproved, and an approved ad can still break FTC or state rules.

Do these rules change often?

Yes. In the last few years HHS revised its tracking bulletin after a court ruling, extended the Section 504 web accessibility dates and updated its model privacy notices, and the FTC review rule took effect in October 2024. Each of our guides says when we last checked the sources.

Do state rules matter?

Often a great deal. State medical, dental and chiropractic boards have advertising rules, and state privacy and consumer protection laws add their own duties, which differ by state. This page covers federal rules and Google only.

Primary sources

Want a second pair of eyes on your patient path?

Book a practice review. We look at how patients find you, what they see on your site, what happens when they call, and what you can measure today. You get a plain list of what we would fix first.

Book a practice review