What are the red flags when hiring a doctor marketing agency?
The biggest red flags in a doctor marketing agency are a refusal to sign a Business Associate Agreement, tracking pixels on booking or intake pages, guaranteed rankings, fake or gated reviews, and accounts the agency owns instead of you. Vague reports that never mention booked appointments are the next warning. Any one of these can cost a physician practice money, patients or a regulator's attention.
- No BAA, no deal: an agency that handles form fills, call recordings or patient lists on your behalf should sign a Business Associate Agreement.
- Ask where the ad pixels fire. Tracking on patient portals and booking or intake flows is a HIPAA risk.
- Nobody can guarantee a Google ranking, and review schemes that filter or fake reviews break FTC rules.
- You should own the website, domain, ad accounts, analytics and Google Business Profile, with the agency added as a user.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
Which warning signs matter most for a physician practice?
Seven warning signs cover most bad agency relationships in physician marketing. Four are compliance risks: no BAA, unsafe tracking, review schemes and unverifiable claims. Three are business risks: agency-owned accounts, long lock-ins and reports that skip booked appointments. Use the table below during the sales call, not after signing.
| Red flag | Why it hurts a practice | What to ask instead |
|---|---|---|
| Will not sign a BAA | Leaves patient information shared without the contract HIPAA expects | "Will you sign our BAA, or send yours, before onboarding?" |
| Pixels on booking or intake pages | Can send patient data to ad platforms | "Which pages carry tracking, and what data leaves the site?" |
| Guaranteed first-page rankings | No one controls Google's results; the promise hides weak work | "What will you do each month, and how will we see it?" |
| Review gating or bought reviews | Fake or suppressed reviews break the FTC rule; gating breaks platform policies | "How do you ask for reviews, and who gets asked?" |
| Agency owns your accounts | You lose history, data and ads if you leave | "Whose name is on the domain, ad account and profile?" |
| Long contract with no exit | Locks you in even when results stall | "What is the notice period, and what do we keep?" |
| Reports with only clicks and impressions | Hides whether marketing produced patients | "Can you report calls, forms and booked appointments by channel?" |
Which HIPAA warning signs should a practice owner watch for?
Two HIPAA warning signs matter most: an agency that will not sign a Business Associate Agreement, and an agency that wants ad pixels on every page. If a vendor creates, receives, stores or sends protected health information for you, it is a business associate. HIPAA expects a written BAA before that work starts.
A missing BAA
An agency that refuses a BAA, or says it "does not need one", has not planned for patient data.
Marketing touches more patient information than many owners expect. Appointment-request forms, recorded calls, recall lists, chat transcripts and email lists of existing patients can all carry health information. See the official HHS guidance on business associates for what the contract should cover.
What to check in the BAA conversation
- Who on the agency side can see patient data, and how access is removed when people leave.
- Which subcontractors and software tools touch the data, and whether they sign BAAs too.
- How the agency reports a suspected breach, and how fast.
- What happens to your data when the contract ends.
Our guide on what practices should require from agencies and vendors lists the clauses in more detail. Confirm the final wording with your own counsel.
A careless tracking plan
Be wary of any agency that wants pixels everywhere and plans to "optimize later". HHS still treats tracking on patient portals and logged-in pages as covered by its online tracking technologies guidance. Booking flows and intake forms can also pass identifiable details to ad platforms.
Ask the agency three things on the sales call:
- Can you list every page where an ad-platform tag fires today, and who added it?
- How will you count booked appointments without sending patient details to Google or Meta?
- Which measurement tools will touch patient data, and will each one sign a BAA?
Vague answers are the red flag. See our HIPAA-safe website tracking guide and the Meta ads setup guide for practices before you approve a tag plan, and confirm it with counsel.
Are guaranteed rankings or patient numbers a warning sign?
Yes. Google's own advice to site owners hiring SEO help is that no one can guarantee a first-place ranking. An agency that promises a set number of new patients without knowing your schedule, payer mix and phone handling is selling a script, not a plan.
Reasonable agencies commit to work and to measurement. They agree monthly goals with you, such as profile calls, form enquiries or booked new-patient visits, and show progress against them. They explain what is in their control and what depends on your front desk.
Review schemes
Watch how the agency plans to grow reviews. The FTC rule banning fake reviews and testimonials took effect in October 2024. It covers fake reviews, such as ones written by staff or an agency in a patient's name, paying for reviews that must be positive, and suppressing negative reviews through threats or intimidation. Confirm the details with your counsel. Asking only patients you expect to be happy, through a filter that routes unhappy ones elsewhere, also breaks Google's review policy against selectively soliciting positive reviews. A safe routine asks every patient, the same way, without rewards.
Who should own your website, ad accounts and data?
Your practice should own every marketing asset, and the agency should be added as a user with the access it needs. That includes the domain name, website hosting, Google Ads and Meta ad accounts, analytics properties, Google Business Profile, call-tracking numbers and any patient-facing email or texting lists.
When an agency builds accounts under its own login, leaving it means starting over. You lose years of ad history, conversion data and sometimes your phone numbers. Ask on the first call: "If we part ways, what do we keep, and how fast do we get it?" A clear written answer is a good sign. Hesitation is a red flag.
Contracts deserve the same scrutiny. Some agencies offer month-to-month terms after an initial setup period; others ask for a fixed term. A long lock-in with no performance review and no exit is a reason to keep shopping.
Does the agency actually understand physician practices?
A quieter red flag is an agency that treats a primary care or specialty practice like a restaurant or a law firm. Physician marketing runs on insurance, referrals, provider schedules and front-desk capacity. An agency that never asks about those will plan campaigns your office cannot absorb.
Questions that expose a generalist
- "Which services should we promote, given our payer mix and open slots?" A specialist asks about capacity before spending.
- "How will you handle insurance questions in ads and on the website?" The answer should mention clear insurance pages, not vague promises.
- "What can and cannot appear in a patient testimonial in our state?" Good agencies point you to your state medical board's rules and to counsel.
- "How do new-patient calls reach our front desk, and what happens after hours?" Follow-up decides whether paid clicks become visits.
Also ask who will do the work. Some agencies sell with senior people and hand the account to rotating juniors or subcontractors who have never seen a BAA. Ask for the named account lead, how often you will meet, and who writes the content. If the answer changes between the pitch and the contract, treat it as a warning.
Finally, look at the agency's own content. Copy full of cure claims, before-and-after promises or "best doctor" language suggests it will write the same for you, and your license carries the risk.
What does honest reporting look like for a doctor's office?
Honest reporting connects marketing activity to booked appointments. It shows where calls and forms came from, how many were answered, and how many became visits. Impressions, clicks and "reach" are useful context, but a report built only on them hides whether the spend produced patients.
A good monthly report for a physician practice usually answers five questions:
- How many new-patient calls and forms came in, by channel?
- How many calls were missed or returned late?
- How many enquiries became booked visits?
- What did each channel cost per booked visit?
- What will change next month, and why?
At Ichelon Consulting US, we agree monthly goals with each practice and track them live on Ichelon Agency OS, with a report every Monday. Whatever agency you choose, ask to see a sample report before signing, or book a call and we will walk you through ours. For the wider picture of the service, see what a doctor marketing agency does and our doctor and primary care marketing overview.
Related pages from the US team
Doctor & Primary Care Marketing USA
How Ichelon Consulting US markets physician and primary care practices.
HIPAA for agencies and vendors
What a practice should require from every marketing vendor.
HIPAA-safe website tracking
Where tags can and cannot fire on a practice website.
Doctor marketing agency cost
How agency pricing models work for physician practices.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
What is the biggest red flag when hiring a medical marketing agency?
Refusing to sign a Business Associate Agreement is the clearest red flag. Agencies that handle appointment forms, call recordings or patient lists for a practice act as business associates under HIPAA. An agency that will not sign one has not planned for patient data, and that risk lands on the practice.
Can a marketing agency guarantee first-page Google rankings for a doctor?
No. Google's own guidance to site owners says no one can guarantee a first-place ranking. An agency can commit to specific work, such as profile updates, service pages and technical fixes, and to transparent measurement. A ranking guarantee usually signals weak methods or a contract built to look good on paper.
Should my practice or the agency own the Google Ads account?
Your practice should own the Google Ads account, along with the domain, website, analytics, Google Business Profile and other ad accounts. The agency should be added as a user. If the agency owns the account, leaving it can mean losing campaign history, conversion data and sometimes tracked phone numbers.
Is it a red flag if an agency wants a Meta pixel on every page of my site?
Yes, for a medical practice. HHS guidance still covers tracking on patient portals and logged-in pages, and pixels on booking or intake forms can send identifiable details to ad platforms. A careful agency keeps ad-platform tags off those pages and measures conversions through a HIPAA-safe setup.
How can I check an agency's review practices before hiring?
Ask exactly how they request reviews, who receives the request and what the message says. Every patient should be asked the same way, without rewards or filters that route unhappy patients elsewhere. The FTC rule banning fake reviews and testimonials took effect in October 2024, so fake reviews, reviews written in a patient's name and payments for positive reviews are off limits.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Want a second opinion on an agency proposal?
A 30-minute call with the US team. We'll go through the proposal with you, flag any risks and tell you which questions to ask before you sign.
We cover every stage, from first search to repeat visit
- 0Foundations
- 1Demand gen
- 2Capture
- 3Lead quality
- 4Lead mgmt
- 5Scheduling
- 6Show-up
- 7Conversion
- 8Retention
We work across all nine stages, from foundations to past patients, and fix the stage that leaks first. Our own software runs the work, and every stage is reported against a monthly target on Ichelon Agency OS.
See all nine stages and the tool behind each one →