Microsoft Advertising for medical practices

Microsoft Advertising places search ads on Bing and on the other sites in Microsoft’s ad network. For an independent practice already running Google Ads, it looks like a quick win: import the campaigns, set a budget, done. The catch is that Microsoft has its own healthcare policy, its own rules for its conversion tag, and its own statement about what it will and will not do with health data. Those rules do not match Google’s line for line, and an imported campaign brings Google settings with it.

This guide covers what is specific to Microsoft Advertising for a US practice. For search campaigns in general, see our guides to Google Ads for dentists, chiropractors and med spas; for bidding on another practice’s name, our guide to bidding on competitor names; for tags and pixels on your site, our guide to tracking pixels on practice websites; and for ads that get rejected, our guide to disapproved healthcare ads.

This is general information, not legal advice. Sources cited were checked on November 1, 2026: the Microsoft Advertising Healthcare and Pharmaceutical policy (last updated October 5, 2026), the Microsoft Advertising Privacy and Personalization policy (no date shown), the Microsoft Advertising help page on UET technical safeguards for sensitive data (no date shown), the Microsoft Advertising Import tools page (no date shown), the HHS OCR bulletin on online tracking technologies (content last reviewed June 26, 2024, with its note on American Hospital Association v. Becerra), 45 CFR 160.103, 164.502 and 164.508, and 16 CFR 255.1 and 255.5. Microsoft changes its policies, so check the current versions before you launch. We found no federal rule or agency guidance written for Microsoft Advertising campaigns by practices as such. State rules differ, so have a health care attorney review your ads, landing pages and tracking setup before you launch.

The short version

Microsoft’s Healthcare and Pharmaceutical policy (last updated October 5, 2026) applies to all ad types and says health advertising must target users aged 18 or older.
The same policy bars targeting consumers based on sensitive health information, requires health claims to be supported by credible scientific evidence, and bans exaggerated or unrealistic before-and-after images in ads and on landing pages.
Imagery or audio that implies endorsement by healthcare professionals is not allowed unless the endorsement is genuine and properly disclosed, and affiliations with providers must be transparent and verifiable.
Microsoft’s UET help page says to keep its conversion tag off pages subject to HIPAA, says Microsoft does not offer a business associate agreement for UET, and says remarketing and audience features turn off when an advertiser picks the Healthcare/Pharma vertical.
Imported Google campaigns can be reviewed and edited before they run. Check each one against Microsoft’s rules, not Google’s.

What Microsoft’s healthcare policy says

Microsoft publishes one Healthcare and Pharmaceutical policy for all ad types, with market-specific rules underneath. The version we checked was last updated October 5, 2026. Its general requirements say advertisers promoting health care services must follow the laws in each region where ads show, keep current certifications or licenses for each market, not target consumers based on sensitive health information, and target users aged 18 or older. Microsoft also notes that it enforces the English version of its policies, and that translations are a courtesy.

The policy lists products and services it does not accept at all. For a practice, the item to notice is “clinical trials, experimental treatments, or medical research solicitations”. If your practice recruits for studies, those ads are out. Other items on the list are the sale of human organs or tissues, a linked list of health products and supplements, and herbal supplements that mimic illegal substances.

Certain categories need preapproval or certification. Online pharmacies, telemedicine providers that sell prescription drugs, and drug manufacturers must be preapproved before their ads can run. In the United States, online pharmacies that advertise prescription drugs must be accredited by NABP or LegitScript, and Microsoft says ads for brick and mortar pharmacies are not subject to the same restrictions. Drug and alcohol addiction recovery ads are allowed only in the United States, need LegitScript certification for the ad and landing pages, and cannot be lead generation ads.

Claims, results and endorsements

The claims section deserves a close read. The policy says health claims must be supported by credible scientific evidence, with the source and date of the study where that applies, and that advertisers must avoid exaggerated or unsupported claims that create unrealistic expectations. Comparative or superlative statements, such as “more effective than” or “#1 Doctor Recommended”, must be factually substantiated and backed by a trusted third-party study, with the study name and date referenced in the ad or on the landing page.

Ads and landing pages must not misrepresent regulatory approval of a product, and must not include before-and-after images that are exaggerated or unrealistic. Weight loss advertising has its own list: no claims that results are certain, universal or permanent, no specific amounts or rates of weight loss in a timeframe, no manipulated before-and-after imagery, an 18 or older audience, and a prompt to consult a healthcare professional before beginning an intensive program. For US compounded weight loss drugs, the policy requires the label “This is a compounded drug” or an equivalent, with no suggestion of FDA review or approval.

On endorsements, Microsoft does not allow imagery or audio that implies endorsement by healthcare professionals unless the endorsement is genuine and properly disclosed. Federal law points the same way. Under 16 CFR 255.1(d), advertisers are liable for misleading or unsubstantiated statements made through endorsements, and under 16 CFR 255.5(a), a connection between the endorser and the seller that the audience would not expect must be disclosed clearly and conspicuously. Our guide to patient testimonials and before-and-after photos covers that in more depth.

Conversion tracking, remarketing and HIPAA

Microsoft’s conversion tag is called UET (Universal Event Tracking). Its help page on technical safeguards for sensitive data is unusually direct. It says Microsoft uses a classifier to identify healthcare and pharmaceutical domains and excludes their events from personalization, and that if an advertiser selects the Healthcare/Pharma vertical during setup, remarketing and audience features are automatically turned off. The same page tells advertisers not to put personal or health information in custom parameters and not to place UET tags on pages subject to HIPAA regulations.

It also says Microsoft does not offer business associate agreements for UET and does not represent that UET meets HIPAA requirements, and that advertisers subject to HIPAA must not use UET in ways that could expose Microsoft to protected health information. Under 45 CFR 160.103, a vendor that receives protected health information on behalf of a covered entity is a business associate, and 45 CFR 164.502(a) limits disclosures to those the Privacy Rule permits. Disclosing patient information to an ad platform for marketing would need the patient’s authorization under 45 CFR 164.508(a)(3).

The HHS Office for Civil Rights bulletin on online tracking technologies is still posted, with a note. On June 20, 2024, in American Hospital Association v. Becerra, the US District Court for the Northern District of Texas vacated the bulletin to the extent it said HIPAA obligations are triggered when a technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. The AHA reported on August 29, 2024 that HHS would not appeal. The rest of the bulletin stands, including its statement that tracking technologies on user-authenticated pages, such as a patient portal, generally have access to protected health information.

Microsoft’s Privacy and Personalization policy adds its own requirements. Personal data must be collected over HTTPS and limited to what is strictly necessary. Advertisers must not use Microsoft Advertising to process sensitive personal data in violation of data protection laws, including to personalize ads. Landing pages need a prominent privacy policy link, and advertisers using UET must disclose in that policy that Microsoft collects or receives personal data and link to the Microsoft Privacy Statement. No federal rule we found says where a practice may place an ad platform’s tag. We recommend keeping UET to pages with no patient information at all, and measuring bookings through a method that does not send patient details to Microsoft.

Importing from Google Ads

Microsoft’s Import tools page says campaigns can be brought over from Google Ads, Meta Ads and Pinterest Ads, that imported campaigns can be reviewed and changed before they go live, and that recurring imports can keep campaigns in sync with the original platform. That is convenient, and it is also how a Google setting that does not belong on Microsoft ends up there.

Before an imported campaign runs, check each of these against Microsoft’s policy: the age target (18 or older for health ads), any audience or remarketing list that came across, the ad text for comparative or superlative claims without a named, dated study, the landing pages for before-and-after images and the privacy link, and whether the account has the Healthcare/Pharma vertical set. If you schedule recurring imports, recheck after each sync, since the sync can carry new Google changes across.

Questions to ask before you launch

Does each ad and landing page make only claims we can support with a named source?
Is each campaign set to an audience of 18 or older?
Did any audience, remarketing or customer list come across from Google, and should it be there?
Is the UET tag only on pages with no patient information, and not on the portal, intake forms or booking confirmation pages?
Does our privacy policy say Microsoft collects or receives data through UET and link to the Microsoft Privacy Statement?
Do any ads show a clinician, a badge or an award, and is that endorsement genuine and disclosed?
Has a health care attorney reviewed the ads under our state board’s advertising rules?

Use and avoid

Use: plain service descriptions, the practice location and how to book.
Use: an 18 or older audience on each health campaign.
Use: landing pages that match the ad, with a visible privacy policy link.
Avoid: “best”, “#1” or “more effective than” without a named, dated third-party study.
Avoid: before-and-after images that are retouched or show results the practice cannot support.
Avoid: UET or any other ad tag on pages where patients enter or view their own health information.
Avoid: ads that recruit for clinical trials or research.

An illustration

This example is invented. [Practice name], a family dental practice, runs Google search ads and decides to try Microsoft Advertising. The office manager imports the Google account. Before turning the campaigns on, they open each one. The age setting came across as all ages, so they change it to 18 or older. A headline reads “Top rated dentist in [city]”, with no source, so they replace it with the services and the booking link. A remarketing list of past site visitors came across too, and since the account has the Healthcare/Pharma vertical set, they remove it rather than rely on Microsoft turning it off.

Their web developer had placed the UET tag in the site template, which means it loads on the new patient form. They move it so it loads only on public pages, and they count booked appointments from the scheduling system as a number, with no names attached. The privacy policy gets a sentence about Microsoft and a link to its privacy statement. The practice’s attorney reviews the final ads before launch.

Checklist

Read the current Microsoft Healthcare and Pharmaceutical policy and note its last updated date.
Set each health campaign to an audience of 18 or older.
Remove imported audience and remarketing lists that target based on health.
Rewrite or source each comparative or superlative claim.
Check landing pages for before-and-after images and a prominent privacy policy link.
Keep UET off portal, form and confirmation pages, and put no patient details in custom parameters.
Update the privacy policy for UET and link the Microsoft Privacy Statement.
Recheck campaigns after each scheduled Google import.
Have a health care attorney review ads and tracking before launch.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For Microsoft Advertising, that means a policy review of imported campaigns, landing pages that match each ad, and a tag setup that keeps ad tracking away from pages where patients share health details. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Can a medical practice advertise on Microsoft Advertising?

Yes, in the United States, subject to Microsoft’s Healthcare and Pharmaceutical policy (last updated October 5, 2026). Health ads must target users aged 18 or older, follow local laws, avoid targeting based on sensitive health information, and make only claims supported by credible evidence. Certain categories, such as online pharmacies, telemedicine providers that sell prescription drugs, and addiction recovery services, need preapproval or certification first.

Can we use remarketing for a healthcare practice on Microsoft?

Microsoft’s help page on UET safeguards says that if an advertiser selects the Healthcare/Pharma vertical during setup, remarketing and audience features are automatically turned off, and that events from domains its classifier identifies as healthcare are excluded from personalization. Its healthcare policy also bars targeting based on sensitive health information.

Does Microsoft sign a business associate agreement for its UET tag?

No. Microsoft’s UET help page says it does not offer business associate agreements for UET, does not represent that UET meets HIPAA requirements, and tells advertisers not to place UET tags on pages subject to HIPAA regulations.

Can we import our Google Ads campaigns into Microsoft Advertising?

Yes. Microsoft’s Import tools page says Google Ads campaigns can be imported, reviewed and edited before they go live, and kept in sync through recurring imports. Check each imported campaign against Microsoft’s own healthcare policy, including the 18 or older audience and any audience lists that came across.

Can our ads say we are the best or top rated practice?

Microsoft’s policy says comparative or superlative statements must be factually substantiated and supported by a trusted third-party study, with the study name and date referenced in the ad or on the landing page. State board advertising rules may add their own limits, so have a health care attorney review the wording.

Microsoft Advertising for medical practices: healthcare ad policy and setup