How to advertise your practice without leaking patient information

Most conversations about health care marketing and privacy stall at the same place. A physician reads about an enforcement action, asks whether the practice website is a problem and gets an answer that is either a shrug or a sales pitch.

There is a better answer, and it fits on one page. What follows is the working checklist: what to look at, what to change and what you can safely ignore.

Start with a reassuring fact. Google and Meta do not want your patients’ health information either. Receiving it creates liability for them, so both companies restrict what health care advertisers can collect and how they can target. A large share of doing this correctly is simply following the rules the platforms already published for their own protection.

Find out what your website is actually sending

Every practice site runs third-party code, usually a Google tag, often a Meta pixel, sometimes a chat widget, a scheduling embed, a heatmap tool or a plugin someone installed years ago and forgot.

Each of these can transmit information about what a visitor did. You want a list. Ask whoever maintains your site to tell you every third-party script running on it and what each one sends. If nobody can produce that list, you have found your first problem, and you have found it for free.

This is an afternoon of work, not a procurement decision.

Read your own URLs

This is the most commonly missed item, and the easiest to fix.

When a page loads, the address of that page typically travels to your analytics and advertising tools. So the page address itself can disclose a diagnosis.

A URL like /conditions/hepatitis-c/consultation-confirmed tells the ad platform something about the person who reached it. So does a confirmation page at /schedule/addiction-treatment/thank-you. The information does not have to be attached to a name to create a problem, because it arrives alongside identifiers the platform already holds.

The fix is boring. Confirmation and thank-you pages should be generic. One /thank-you page, or a small number of them named for the action rather than the condition. Educational pages can and should describe conditions, because that is how patients find you. It is the conversion and post-form pages that need to be neutral.

Name conversions for the action, not the condition

Inside your advertising accounts, conversions have names. Someone chose those names, usually in a hurry.

An event called Booked_Bariatric_Consult sends the platform a diagnosis-adjacent fact every time it fires. An event called Appointment_Booked gives you exactly the same operational information, because you already know which campaign produced it. The campaign structure tells you the service line. The event does not need to.

Track the behavior. Let your campaign organization carry the clinical context, inside your own account, where it belongs.

Keep condition fields out of your tracking tools

Intake and contact forms often ask why the patient is reaching out. That answer belongs in your practice management system or CRM. It does not belong in an analytics or advertising tag.

The failure is usually accidental. A form plugin passes every field to Google Analytics by default, or a “reason for visit” dropdown gets included in the event payload because nobody excluded it. Ask your web developer directly: Which form fields are passed to analytics or ads, and can we remove the clinical ones? The answer takes minutes to implement.

Nothing behind the login

Marketing tags do not belong on authenticated pages. Not the patient portal, not anything a patient reaches after entering credentials, not the pages where they view results or message a provider.

This has been the clearest line in this area for years. Federal guidance on online tracking technologies that covers user-authenticated pages remains in force, even after a federal court in 2024 vacated the portion addressing public, unauthenticated pages. If you check one thing this week, check this.

Know which targeting is actually off limits

Here the platforms are specific, and knowing the specifics saves you from both violations and unnecessary panic.

Google treats health as a sensitive interest category. That covers more than most physicians expect: physical and mental health conditions, sexual health, chronic conditions, treatments and devices for them, anything involving intimate body parts or functions, disabilities and invasive procedures including cosmetic surgery.

For advertising in those categories, Google prohibits what it calls advertiser-curated audiences. In practice, that means no Customer Match uploads, no remarketing lists built from your own site visitors, no lookalike or similar segments, and no audience expansion.

What remains available is substantial: in-market segments, affinity audiences, demographics, life events, location targeting and custom segments within limits. Plain search intent, meaning someone actively looking for the care you provide, is untouched and remains the most valuable traffic in medicine.

Meta applies its own restrictions to advertisers it classifies as health and wellness, which can limit which conversion events are available for optimization. Its business tools terms already prohibit sending sensitive health information. If your account has been restricted, that is a signal to review what you are sending, not merely an obstacle to route around.

The headline for a practice owner: You have not lost the ability to advertise. You have lost the ability to build audiences out of your patients’ conditions, which is the thing you did not want to be doing.

Make sure your marketing claims are true

Regulators do not limit their reading to the privacy policy. In its July 2026 action against the telehealth company Hims & Hers, the Federal Trade Commission pointed to privacy representations made across the company’s homepage, advertisements and paid influencer endorsements, not just its policy page.

So treat the words on your site as commitments. “Private,” “secure,” and “confidential” are claims. If your site makes them, someone at your practice should be able to explain why they are accurate. The same applies to money. Be clear about when a patient is charged, what recurs and how to cancel. Billing clarity sits in the same family as privacy clarity, and it generates at least as many complaints.

Where vendors fit

There are legitimate tools that filter data before it reaches ad platforms, and for a large multisite organization with complex tracking, they can be a reasonable investment.

For most independent practices, they are an optimization, not a prerequisite. Buy one because you have mapped your data flows and identified a gap that software solves, not because a headline made you nervous. The order matters. A tool layered on top of a system nobody has audited mostly produces confidence, which is the one output you cannot afford to be wrong about.

The short version

Know what your site sends. Keep conditions out of URLs, event names and form payloads. No tags behind the login. Follow the platforms’ targeting rules. Say only what is true.

That is the whole list. It requires attention rather than expertise, and the practices that get into trouble are almost never the ones that sat down and made the list.

Mike Funkhouser is the founder of Practice Growth Co., a health care marketing agency focused on patient acquisition for specialty medical practices.