The six areas where healthcare recruitment and patient acquisition campaigns get paused, banned, or fined, with the check and the fix for each. Run it before every launch.
Marketing operations, not legal advice.
Most healthcare marketing accounts get paused for the same handful of reasons, and almost none of them are subtle. This is the checklist we run before any recruitment or patient campaign launches. Marketing operations, not legal advice; have counsel review claims and consent language.
1. Meta employment ads (recruitment campaigns)
- Declare the Special Ad Category. Every job ad on Meta must be flagged as Employment. Unflagged job ads get rejected, and repeated misses earn account strikes.
- Accept the targeting limits. No age, gender, or zip-code targeting; location radius has a minimum; lookalikes are replaced by special ad audiences. Plan creative to self-select the audience instead ("ICU nights, $2,450/week" does the targeting the platform won't).
- Keep preference signals out of copy. "Young, energetic team," "recent grads only," "perfect for moms" all read as discrimination. Describe the role, not the person.
2. Health data and patient campaigns
- Never imply the viewer's condition. "Struggling with anxiety?" targets a personal attribute. "Therapy that fits a work schedule, evenings available" describes a situation. The second passes; the first gets rejected and, repeated, gets the account restricted.
- No condition-based audiences. No custom audiences built from patient lists by diagnosis or service line, and be careful with remarketing on sensitive lines: a retargeting ad for fertility care on a shared family device is a privacy problem and a reputational one.
- Know the health-site event limits. Meta restricts which conversion events health-related domains can send and optimize on. Plan the optimization event (booked consult, not "viewed pricing") and expect some events to be blocked.
3. Tracking and PHI
- Nothing identifying in the pixel, URL, or event name. No condition, appointment type, provider, or patient identifier in any parameter that reaches Meta, Google, or TikTok. "Consult booked" is fine; "sleep_apnea_consult_booked_jsmith" is a breach.
- Server-side tracking, configured for healthcare. Conversion APIs pass what the platform needs for optimization and nothing else. This is the difference between a funnel that can optimize and one that runs blind.
- BAAs where required. Any tool that touches patient data (scheduling, CRM, messaging) needs one. Ad platforms will not sign one, which is exactly why no PHI can reach them.
- Consent captured on every form. Text consent, in particular, before any SMS follow-up.
4. Platform certifications
- Google healthcare certification is required to advertise in several categories, including prescription-related and some addiction and telehealth services. Apply before launch; approvals take time.
- LegitScript certification for pharmacies, telehealth prescribing, and addiction treatment on both Google and Meta.
- Verify, don't guess. When it's unclear whether a category needs certification, treat it as required until confirmed. A false pass costs weeks of paused spend.
5. Claims and testimonials
- No guarantees, cure language, or "best" claims without substantiation.
- Before-and-after imagery follows each platform's rules (largely prohibited on Meta for health and weight).
- Testimonials need to be real, consented, and typical, or accompanied by typicality disclosure.
- Recruitment earnings claims ("earn up to $200k") need the real basis stated.
6. Text messaging (TCPA and TCR)
- Register the campaign with The Campaign Registry before sending business texts. Unregistered traffic gets filtered and fined.
- Prior express consent for every recipient, captured at the form, with the consent language your counsel approved.
- Opt-out in every program, honored immediately, and quiet hours of 8 AM to 9 PM local except for the single immediate reply to a person's own inquiry.
The pattern: almost every paused healthcare account traces to one of four things: an unflagged employment ad, copy that implies a condition, a pixel carrying health data, or an uncertified category. Check those four and you've prevented most of the damage.
Compliance is built into every Provido engagement during week one of the recruitment marketing or patient acquisition launch, because the campaigns cannot run without it.
Common questions
Straight answers
Why do healthcare ad accounts get banned?
Most often for one of four reasons: a job ad not declared as an Employment Special Ad Category on Meta, copy that implies the viewer has a health condition, a pixel or URL carrying health or patient data to an ad platform, or advertising in a category that requires certification without it.
Is HIPAA a concern for healthcare advertising?
Yes, indirectly. Ad platforms will not sign a business associate agreement, so no protected health information can reach them through pixels, URLs, audiences, or event names. Server-side tracking configured for healthcare lets campaigns optimize without exposing patient data.
Do I need to register before texting applicants or patients?
Yes. Business SMS in the US requires registration with The Campaign Registry (TCR), and each recipient needs prior express consent under the TCPA. Opt-out must be honored immediately.
Can I retarget people who visited my clinic website?
Only carefully. Remarketing on sensitive service lines can reveal a condition to whoever sees the screen, and Meta restricts health-site events. Many practices limit remarketing to non-sensitive pages or skip it for sensitive lines.
Free first step
Want it checked on your own campaigns?
Send us one open role or one service line. We run the speed-to-lead audit, flag the compliance risks we see, and send a written report in two business days. Free.
Book your 30-minute call