Patient advocate marketing: savings claims, debt relief rules, records requests and billing disputes

Patient advocates and medical bill help businesses work for the patient. They review bills, ask providers and plans for corrections, request records, help with disputes and, where they offer it, negotiate what the patient owes. The headline promise in this kind of marketing is money saved, and that promise sits under federal rules that reach further than the FTC Act alone.

Several related topics have their own guides and are not repeated here. Billing companies that sell to practices, and the OIG guidance written for them, are covered in medical billing company marketing. What a provider owes a self-pay patient before care, and how estimates work, is covered in good faith estimates for self-pay patients. The surprise billing notice providers post is covered in No Surprises Act website disclosure. This guide is about the business that sells its help to patients and families.

Who this guide is for

This guide is for businesses that patients or their families hire: independent patient advocates, medical bill review services, bill negotiation services and records retrieval help. If your client is a practice, a hospital or a health plan, you are on the other side of the table, and the billing company guide linked above fits you better.

The difference matters for more than tone. A business hired by the patient makes promises to consumers, so the FTC Act governs those promises directly. If any part of your service is presented as reducing or settling what a patient owes, a specific FTC rule on debt relief may also apply. And because you are not working for the provider, the records you need come through the patient’s own HIPAA rights, not through a contract with the practice.

Savings claims: what you may say and what you must be able to prove

Section 5 of the FTC Act, 15 U.S.C. 45, prohibits unfair or deceptive acts or practices in commerce. The FTC Policy Statement on Deception looks at the net impression an ad leaves on a reasonable consumer, so a headline promise is judged as a whole, together with what the fine print fails to fix.

Under the FTC Policy Statement Regarding Advertising Substantiation, objective claims need a reasonable basis before you make them. A savings figure is an objective claim. Lower your bill by a stated percentage, average savings of a stated dollar amount, or we find errors on a stated share of bills are each a claim about measurable results, and each needs records behind it that measure the same thing the ad says.

Three practical consequences follow. First, define the number. Savings measured against the first bill a provider sent are not the same as savings against what the patient would have paid after insurance adjustments that were coming anyway. Say which you mean. Second, count every case, including the ones where you found nothing. An average built only from successful files is not an average of what clients get. Third, keep the records. If you cannot produce the files that support a figure, do not publish the figure.

Client stories carry the same weight. Under 16 CFR 255.2(b), an endorsement about a key attribute of the product will likely be read as representing what consumers will generally achieve. If you do not have substantiation that the client’s result is representative, the ad should clearly and conspicuously disclose the generally expected performance, and you must be able to support that disclosure too. A story about a large bill reduced to a small one, with a line saying results vary, does not meet that standard. The testimonials guide covers consent and review rules for stories in more detail.

If you negotiate balances, read the debt relief rule first

The Telemarketing Sales Rule, 16 CFR part 310, has a section written for debt relief services. Section 310.2(o) defines a debt relief service as any program or service represented, directly or by implication, to renegotiate, settle, or in any way alter the terms of payment or other terms of the debt between a person and one or more unsecured creditors or debt collectors, including a reduction in the balance. The FTC’s business guide on the rule answers the question directly: the definition covers all types of unsecured debts, and it names medical debts as an example.

The rule applies to telemarketing, which part 310 defines as a plan, program or campaign to induce the purchase of goods or services by telephone that involves more than one interstate telephone call. A business that sells by phone to clients in other states should assume the question is live. Section 310.6(b)(5) exempts calls a customer makes in response to an advertisement, but that exemption expressly does not apply to calls responding to ads for debt relief services. The FTC guide says the same thing in plain words: inbound calls from consumers responding to TV, radio, print or online ads are covered.

If your service fits, three parts of the rule shape your marketing and your price page.

• No fee before results. Under 310.4(a)(5)(i), you may not request or receive a fee for a debt relief service until you have settled or otherwise altered the terms of at least one debt under an agreement the customer signed, and the customer has made at least one payment under it. A flat sign-up fee for negotiation work runs straight into this.
• How a fee may be figured. Where debts are settled one at a time, the fee must either be proportional to the share of the total enrolled debt that each settled debt represents, or be a percentage of the amount saved. The percentage cannot change from one debt to another, and the amount saved is the difference between what was owed when the debt was enrolled and what was actually paid.
• Disclosures before enrollment. Section 310.3(a)(1)(viii) lists what must be disclosed, and for debt relief the rule says the disclosures come before the consumer enrolls. They include the time needed to achieve the represented results, and where the service relies on the customer not paying creditors, that this will likely hurt their creditworthiness, may lead to collections or lawsuits, and may increase what they owe.

Section 310.3(a)(2)(x) also makes it a violation to misrepresent any material aspect of a debt relief service, and it names the amount or percentage a customer may save, the time needed, the effect on credit, and the percentage or number of customers who attain the represented results. That is a direct federal hook for every savings number on your site.

Not every advocate negotiates balances. Bill review that finds coding or posting errors and asks the provider to correct them, records retrieval, appeal help and dispute filing are different services. If you offer both, keep them as separate services with separate pricing on the site, so it is clear which work carries which fee. Whether a given service is debt relief turns on what you represent, directly or by implication, so read your own ad copy against the definition.

Getting records: the patient’s right of access

Your clients have a federal right to their own records. Under 45 CFR 164.524, a covered entity must let an individual inspect or get a copy of the protected health information about them in a designated record set. It may require requests in writing, as long as it tells individuals that. It must act no later than 30 days after receiving the request, and it may take one extension of no more than 30 days if it gives the individual a written statement of the reasons and the date it will finish.

Where the records are kept electronically and the individual asks for an electronic copy, the covered entity must provide it in the form and format requested if it is readily producible that way, or in a readable electronic form both sides agree on. For copies, the covered entity may charge a reasonable, cost-based fee limited to labor for copying, supplies, postage and, if the individual agreed to one, preparing a summary.

That shapes what you can honestly advertise. You can say you help clients request their records and follow up on the request. You should not promise records in a set number of days, because the provider controls the timing within the limits above. You should not say records are free, because the rule allows a cost-based fee. And you should not suggest you have special access to records; the right belongs to the patient.

Acting for the client: authorizations

When you need a provider or plan to send records or talk to you directly, the usual tool is a HIPAA authorization signed by the patient. Under 45 CFR 164.508(c), a valid authorization must contain, among other elements, a specific and meaningful description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the individual’s signature and date. When the patient starts the request, the statement at the request of the individual is enough to describe the purpose. If a personal representative signs, the authorization must describe that person’s authority to act.

Section 164.508(b)(5) lets the individual revoke an authorization in writing at any time, except to the extent the covered entity has already acted on it. Your intake page should say so in plain words, and should not describe your form as a permanent or unlimited release.

Build the authorization step into your intake flow as its own page, with the form or a clear description of it, so a prospective client knows before they sign up what they will be asked to sign and why. A provider’s office may also use its own authorization form. Say that you will complete whatever form the provider requires.

What HIPAA means for your own business

HIPAA’s privacy rules apply to covered entities and their business associates. Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a regulated function or activity. A business hired by the patient is acting for the patient, so read that definition against your own contracts before you describe your HIPAA status on your site. If you also do work for providers or plans, that work may fall under it.

Whatever the answer, describe your privacy practices as they are: what you collect, where it is stored, who can see it and how long you keep it. A claim about security or privacy is a claim under 15 U.S.C. 45 like any other. Do not borrow wording that implies a certification or a government status you do not have.

Billing disputes under the No Surprises Act

One dispute route exists only for uninsured and self-pay patients. Under 45 CFR 149.620, if a provider or facility bills substantially in excess of the good faith estimate, which the rule defines as at least 400 dollars more than the expected charges listed for that provider or facility, the patient may start the patient-provider dispute resolution process. The initiation notice must be postmarked within 120 calendar days of receiving the initial bill with the charges at issue.

The rule lets an authorized representative start the process for the patient, but it excludes the providers in the estimate, providers associated with them, their non-clinical staff, and people employed by or associated with a facility in the estimate. If you represent clients in these disputes, make sure none of those exclusions fit you.

CMS tells patients on its Dispute a medical bill page that the process requires a 25 dollar non-refundable administrative fee, that their costs will not increase if they dispute, and that an independent third party reviews the bill. Two points follow for your marketing. First, patients can file this themselves through CMS, so your page should present your help as help with the process, not as the only way in. Second, the outcome depends on the reviewer: CMS says the reviewer may find the charges appropriate and leave the bill as it is. Do not promise a reduction.

Titles, licenses and who you are

Licensing for patient advocates, debt settlement, debt management, collection-related work and insurance-related representation is set state by state. Your state may require a license or registration for one of these services and not for another. Check before you advertise a service, and list the license on the page that sells the service it covers.

If you hold a private credential, name the body that issued it and what it certifies. Do not use wording that suggests a government license, an affiliation with a hospital, insurer or agency, or a role in the dispute process that you do not have. Under the Deception Policy Statement, an implied claim counts as much as an express one.

Illustration: rewriting a bill help homepage

Illustration: a two-person bill help business has a homepage headline promising to cut medical bills by a set percentage, a pay-now sign-up fee, and a client story about a large hospital bill reduced to a fraction. Their records cover the last year of cases but they never counted the files where nothing changed. They also negotiate balances by phone with clients in more than one state. The rewrite drops the percentage until they can measure it across every case, splits the service into bill review with a flat review fee and negotiation with a percentage of the amount saved charged only after a settlement is agreed and a payment made, adds the debt relief disclosures to the enrollment page before payment, and either removes the client story or adds what clients generally achieve, backed by the full case count.

Illustration: an independent advocate who helps families gather records before a second opinion wants a page that says records in 7 days, free. The rewrite says the advocate helps the family send a written request, explains that the provider has 30 days to respond and may take one 30-day extension, notes that the provider may charge a reasonable, cost-based fee for copies, and links to an intake page that shows the authorization form the advocate uses when a provider needs to talk to them directly.

Checklist

• Every savings figure on the site is defined, measured across all cases, and supported by records you can produce.
• Client stories either reflect what clients generally achieve or carry a clear disclosure of the generally expected result.
• You have read the debt relief definition in 16 CFR 310.2(o) against your own ad copy and phone sales.
• If negotiation is debt relief for you: no fee before a settlement and a first payment, a fee formula the rule allows, and the 310.3(a)(1)(viii) disclosures before enrollment.
• Records pages describe the patient’s right, the 30-day timing and the possible cost-based fee, with no promise of days or free copies.
• Your authorization form has the 164.508(c) elements, and your intake page explains revocation.
• Dispute pages say patients can file on their own, mention the CMS fee, and promise no outcome.
• State licensing is checked for each service you sell, and any license is listed with the service it covers.
• Privacy wording describes what you actually do, with no implied certification or government role.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices and health businesses. For patient advocates and bill help businesses, we write service and pricing pages that separate review, negotiation and dispute help, build intake pages that show the authorization step before sign-up, and set up inquiry and lead flows that ask only for what the first conversation needs. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not sell lead lists and we do not pay for referrals. For the wider rules, see our healthcare marketing rules hub.

Sources

• 15 U.S.C. 45: Unfair methods of competition and unfair or deceptive acts or practices
• FTC Policy Statement on Deception
• FTC Policy Statement Regarding Advertising Substantiation
• 16 CFR 255.2: Consumer endorsements
• 16 CFR part 310: Telemarketing Sales Rule (sections 310.2(o), 310.3(a), 310.4(a)(5), 310.6(b)(5))
• FTC: Debt Relief Services and the Telemarketing Sales Rule, a Guide for Business (published July 2010)
• 45 CFR 164.524: Access of individuals to protected health information
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 160.103: Definitions (business associate)
• 45 CFR 149.620: Requirements for the patient-provider dispute resolution process
• CMS: Dispute a medical bill (page last modified October 2, 2026)

More in Health companies, vendors and employers