Lead ads and instant forms for healthcare: Google, Meta and LinkedIn rules

A lead form ad lets a person ask for a call back without leaving the app they are scrolling. They tap the ad, a form opens with their name and email already filled in, and they submit. For a practice or a health company, that convenience has a cost in rules. Each platform sets its own limits on who may run these forms and what the form may ask, the answers sit on the platform’s servers before they reach you, and federal privacy and advertising law follows the data from there.

This guide reads the current rules from Google Ads, Meta and LinkedIn as a healthcare advertiser needs them, then covers the HIPAA and FTC rules that apply once a lead lands in your inbox or CRM. For related topics, see our guides to Facebook and Instagram ads for medical practices, LinkedIn marketing for healthcare companies, HIPAA and website contact forms and tracking pixels on practice websites. If a vendor offers to sell you calls instead of leads, see our guide to pay-per-call in healthcare. Downloadable guides, checklists and webinars offered in exchange for contact details are covered in our guide to lead magnets and gated content.

The short version

• Google Ads lead form assets are closed to healthcare content. The Lead form requirements page says advertisements for healthcare-related content are not allowed for lead forms, and that affiliate networks and lead generation businesses will not be allowed.
• Meta’s Advertising Standards say ads must not ask for personal attributes of a user, a list that includes physical or mental health and medical conditions. Meta’s help page says custom questions on instant forms must also follow its advertising policies.
• The LinkedIn Ads Agreement, section 13.2, says custom questions on a Lead Gen Form may not request Sensitive Data, including data concerning health, and that each form must link to your privacy policy.
• Answers sit on the platform before they reach you. Google says it stores leads for 60 days and its CSV download covers the last 30 days. LinkedIn says Form Data is available for one year.
• For a covered entity, what you send back to an ad platform about a lead who became a patient comes from your records, and 45 CFR 164.502(a) and the marketing rules at 164.501 and 164.508(a)(3) apply.
• A business outside HIPAA still answers to the FTC Act for what its ad and form say, and may fall under the FTC Health Breach Notification Rule.

Google Ads: lead form assets and healthcare

Google’s Advertising Policies Help page Lead form requirements lists the conditions for using a lead form asset: a good history of policy compliance, an account in an eligible vertical or sub-vertical, and a privacy policy linked in the form, which appears at the end of the form. Video and Display placements, and Search ads whose headline opens straight into a form, carry extra spend and verification conditions on the same page.

The same page then lists policies tied to lead forms. Under Healthcare and medicines it says advertisements for healthcare-related content are not allowed for lead forms, with a pointer to the Google Ads Healthcare and medicines policy. Under Affiliate network / lead aggregator it says only first-party advertisers, or third-party agencies with a well-established, direct relationship with the products or services offered, can use lead form ads, and that affiliate networks or lead generation businesses will not be allowed at Google’s sole discretion. The page also points to the Data collection and use policy, which bars using personal information in ways users have not consented to.

For a practice, the practical reading is plain. A Google Search or Performance Max campaign for a medical, dental or wellness service should send people to a page on your own site, not to a lead form asset. That puts the form, its privacy notice and any tracking code under your control, which is where our guides to healthcare landing pages and website contact forms pick up. If an account manager or an automated suggestion offers to add a lead form to a healthcare campaign, check the policy page first.

Meta: instant forms and questions about health

Meta calls its format lead ads with instant forms. Its help page About Lead Ads Terms and Security says you must review and accept the Lead Ads Terms to run lead ads, for each Facebook Page you use, and that if you use custom questions you must also follow Meta’s advertising policies. Those policies include the Advertising Standards page Privacy Violations and Personal Attributes. It says ads must not contain content that shares or asks for private information about users, and lists what ads can’t do, starting with sharing or asking for personal attributes of a user or the user’s family. The personal attributes it names include physical or mental health, including medical conditions, and disability. It also says ads can’t imply knowledge of medical information about a user or the user’s family.

Read that way, it rules out form questions such as “Which condition are you being treated for?”, “Do you have diabetes?” or “What medications do you take?”. The same page shows the difference in ad copy: “Depression counseling” is listed as acceptable, while “Depression getting you down? Get help now.” is not. A question about the service the person wants, such as a choice between a new patient visit and a consultation, describes your business rather than the person. Meta’s custom question tool also offers an appointment request question type and a store locator, which let you ask for a preferred time or location without asking about health.

Meta’s Recommendations and requirements page lists a link to your privacy policy as optional but recommended, says your privacy policy and terms are where you address the collection and use of data and capture consent, and recommends a reasonably prominent notice telling people why you collect their contact information and how you will use or share it. It also says to message people only about the purpose for which you collected their information. A practice should treat all three as required for its own protection, since the person never sees your website before they submit.

LinkedIn: no health data in custom questions

LinkedIn puts its rules for Lead Gen Forms in the LinkedIn Ads Agreement, last updated November 3, 2025. Section 13.2 says you are responsible for giving the notice and choice, and obtaining the consent, that applicable law requires for the collection, disclosure, use and security of Form Data, and that each Lead Gen Form must include a link to your privacy policy. It says custom questions may not request Sensitive Data, including data concerning health, government-issued ID numbers, financial information and information about children under 18, and that LinkedIn may refuse any custom question. It also says you may not sell Form Data, may share it only with someone acting on your behalf such as a service provider, and must honor opt-out and deletion requests promptly.

LinkedIn’s help pages add the form mechanics. A form may hold up to 12 fields, including up to three custom questions, which are required fields. A privacy policy URL is required, and disclosure checkboxes, up to five per form, let you collect specific consent for each additional use you describe. For a health company selling to employers, clinics or other businesses, a form that asks about company size, role and the product of interest fits these terms. A form that asks a person about their own health does not.

Where the answers go after someone taps Submit

Lead form data does not arrive at your office directly. Google’s About lead form assets page says Google Ads stores leads for 60 days, that the CSV download covers leads from the last 30 days, and that leads can also be delivered by email notification, the Google Ads API, a webhook to your CRM or a Zapier connection. LinkedIn says Form Data is available for one year and that you are responsible for promptly obtaining and storing a copy. Meta’s security page says lead ad data is stored on Meta’s servers, is provided only to you, and that Meta may use it as permitted by its Data Policy, including to prefill future instant forms.

So each lead passes through at least three places: the platform, the connector that moves it, and the inbox or CRM where your staff work it. Map those three before launch. Know who can see the leads in the platform, which connector account holds them, whether email notifications carry the full answers, and who in your office can export them. Our guide to CRM and marketing automation with patient data covers the receiving end.

HIPAA: when lead data meets patient records

HIPAA applies to covered entities and their business associates, and a person who fills in an ad form is not yet your patient. The rule texts we read do not address ad platform lead forms directly, and the HHS tracking bulletin does not discuss them. Three parts of the Privacy Rule still shape how a practice runs these campaigns.

First, what flows back to the platform. Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits. The HHS Office for Civil Rights bulletin on online tracking technologies says that when a person makes an appointment through a covered clinic’s website that uses third-party tracking, the information sent to the tracking vendor about the appointment and the person’s IP address makes the vendor a business associate, and a BAA is required. It also says disclosures of PHI to tracking technology vendors for marketing purposes, without HIPAA authorizations, would be impermissible. Meta’s help center includes a page on setting up your CRM for conversion leads. If your setup sends a platform any status that reflects a visit, a booking or a treatment, treat it as a disclosure from your records and check it against the Privacy Rule.

The bulletin carries a note. On June 20, 2024, in American Hospital Association v. Becerra, the US District Court for the Northern District of Texas vacated the bulletin to the extent it said HIPAA obligations are triggered when a technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS says it is evaluating next steps. The rest of the bulletin, including the appointment example above, stands.

Second, customer lists. Under 45 CFR 164.501, marketing means a communication about a product or service that encourages the recipient to purchase or use it, with exclusions for treatment communications and for describing the covered entity’s own health-related services unless it is paid to make the communication. 45 CFR 164.508(a)(3) requires written authorization for marketing uses of protected health information. Uploading a patient list to build an audience or to exclude current patients from a lead campaign is a use of patient information that needs that review.

Third, de-identification. Under 45 CFR 164.514(b)(2), the safe harbor method requires removal of a list of identifiers that includes names, telephone numbers, email addresses, IP addresses and device identifiers. A file that still holds email addresses or phone numbers is not de-identified under that method, whatever else has been stripped from it.

Health businesses outside HIPAA

A wellness company, a supplement brand or a health app that is not a covered entity or business associate is not under the Privacy Rule, but the FTC Act still reaches its ads and its forms. 15 USC 45(a)(1) declares unfair or deceptive acts or practices in or affecting commerce unlawful, and 15 USC 52 makes it unlawful to disseminate a false advertisement likely to induce the purchase of food, drugs, devices, services or cosmetics. A form that says answers are used only to call you back, while the business also shares them for advertising, is the kind of gap between notice and practice to close before launch.

The FTC Health Breach Notification Rule, 16 CFR part 318, applies to vendors of personal health records and PHR related entities that are not covered entities or business associates. Under 16 CFR 318.2, health care services or supplies include any online service such as a website, mobile application or internet-connected device that tracks conditions, symptoms, medications, fitness, sleep, diet and similar matters, and a breach of security includes an unauthorized disclosure. Under 16 CFR 318.3, a vendor or PHR related entity must notify affected individuals and the FTC after discovering a breach, and prominent media outlets when 500 or more residents of a State or jurisdiction are involved. See our guide to the FTC Health Breach Notification Rule.

Questions to ask before you launch a lead form

• Does the platform allow lead forms for this kind of ad at all? For Google healthcare ads, the policy page says no.
• Does each custom question ask about our service, or about the person’s health? Rewrite any question that does the second.
• Does the form link to a privacy policy that describes what we do with ad form leads, and does the notice on the form match it?
• Which connector moves leads from the platform to us, and who at our office and at the vendor can see them?
• Do email notifications carry the full answers, and do they land in a shared inbox?
• Are we sending any lead status, patient list or offline conversion back to the platform? Has a health care attorney reviewed it?
• How do we honor an opt-out or deletion request that arrives through the platform or by phone?

Use and avoid

• Use: questions about the service, the location and the preferred time, such as “Which location is closest to you?”
• Avoid: questions about diagnoses, symptoms, medications, disabilities or insurance details.
• Use: a plain notice on the form, such as “We will use your details to call you back about booking a consultation.”
• Avoid: ad copy or form text that implies you know the person’s condition, such as “Still struggling with your back pain?”
• Use: a landing page on your own site for Google healthcare campaigns.
• Avoid: sending visit, booking or treatment status back to an ad platform without a Privacy Rule review.

An illustration

This example is invented. [Practice name], a physical therapy clinic in [city], plans a Facebook and Instagram campaign for a new pelvic health program. The first draft of the instant form asks “Have you been diagnosed with pelvic floor dysfunction?” and “Are you pregnant or postpartum?”. The office manager compares it with Meta’s personal attributes policy and rewrites it: the form now asks which location the person prefers, whether they want a phone call or a text, and a preferred time, with a notice that says the clinic will use the details only to arrange a free phone consultation and links to the clinic’s privacy policy. The ad copy says “Pelvic health physical therapy now offered in [city]” instead of addressing the reader’s symptoms.

For leads, the clinic connects the form to its scheduling inbox, turns off email notifications that copy full answers to a shared address, and assigns one staff member to download and file leads each weekday. Its marketing contractor suggests sending booked appointments back to Meta to improve targeting. The clinic’s owner asks their health care attorney first, and they decide to report nothing about visits until the review is done.

Checklist

• Confirm the platform allows lead forms for your ad category before you build one.
• Remove custom questions about health, medications, disabilities and insurance.
• Link a privacy policy that covers ad form leads, and add a short notice on the form.
• Use consent checkboxes for each extra use, such as a newsletter.
• Write ad copy about your service, not about the reader’s condition.
• Map the platform, the connector and the inbox or CRM, and limit who can see leads.
• Download and store leads before the platform’s retention window ends.
• Review any data you send back to the platform, including lead status and customer lists.
• Set a process for opt-out and deletion requests.
• Have a health care attorney review the forms, the privacy policy and the CRM setup.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For lead form campaigns, that means checking each platform’s current rules before we build a form, writing questions about your services rather than about patients, and sending paid search traffic to landing pages on your own site where the form and its notice are under your control. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. Read our guide to healthcare marketing rules for the wider picture.

Sources

• Google Advertising Policies Help: Lead form requirements
• Google Ads Help: About lead form assets
• Meta Advertising Standards: Privacy Violations and Personal Attributes
• Meta Business Help Center: Recommendations and requirements for lead ads
• Meta Business Help Center: About Lead Ads Terms and Security
• Meta Business Help Center: Add custom questions to your lead ads with instant form
• LinkedIn Ads Agreement (last updated November 3, 2025), section 13.2
• LinkedIn Help: Lead Gen Forms Privacy Policy
• LinkedIn Help: Lead Gen Form fields
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• 45 CFR 164.508: Uses and disclosures for which an authorization is required (paragraph (a)(3), marketing)
• 45 CFR 164.514: Other requirements (paragraph (b), de-identification)
• 16 CFR 318.2: Definitions
• 16 CFR 318.3: Breach notification requirement
• 15 USC 45: Unfair methods of competition unlawful
• 15 USC 52: Dissemination of false advertisements

More in Healthcare advertising guides