What questions should I ask a healthcare agency about marketing automation?
Ask a healthcare agency four kinds of questions about marketing automation: how patient data is protected, how consent is collected and honored, how workflows hand off to your staff, and who owns the system and its data. Automation sends messages at scale, so one mistake repeats thousands of times. Good answers are specific and written down; vague ones are a warning.
- Data first: ask which tools touch patient information and whether each one is covered by a Business Associate Agreement.
- Consent: marketing texts need documented prior express written consent, and every channel must honor opt-outs.
- HIPAA marketing rules: some messages count as marketing under HIPAA and may need patient authorization.
- Ownership: confirm you own the accounts, contact lists and workflows if the agency leaves.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What should I ask about patient data and HIPAA?
Start with data, because automation tools store names, phone numbers, appointment details and sometimes reasons for visit. Ask the agency to list every platform in the workflow, what patient data each holds, and whether it has a signed Business Associate Agreement with each vendor that handles protected health information.
- Which systems will store patient contact and appointment data?
- Does every vendor that handles protected health information sign a BAA, and will you sign one with us?
- Do messages ever include health details, such as a procedure or condition, in the subject line or text preview?
- Are ad pixels or tracking tags present on the forms that feed the automation?
- Who on the agency team can see patient records, and how is access removed when someone leaves?
A careful agency will also separate patient lists from prospect lists. Our page on what practices should require from agencies and vendors covers contract terms in more detail.
What should I ask about consent, opt-outs and marketing rules?
Ask how the agency collects and records consent for each channel, and how opt-outs flow back into every list. Texting, email and HIPAA each have their own rules. An agency should explain them in plain words, show where consent is stored, and tell you to confirm details with your counsel.
Texting
Under the TCPA, marketing texts need prior express written consent, and opt-outs must be honored. The FCC's separate one-to-one consent rule was vacated in January 2025, so the practical standard is documented consent and fast opt-out handling. More detail is in our SMS marketing and TCPA guide.
The FTC CAN-SPAM compliance guide says commercial emails must include a valid physical postal address, a working opt-out, and honest headers and subject lines. Opt-outs must be processed within 10 business days. The FTC also notes that a business cannot contract away its responsibility by hiring another company to send its emails.
HIPAA marketing
The HIPAA definition of marketing covers communications that encourage someone to buy or use a product or service. It excludes many communications about your own services and a patient's treatment, unless a third party pays you to send them. Ask the agency how it decides which messages are treatment communications and which may need written authorization.
What do good and bad answers sound like?
Good answers name specific tools, steps and owners. Weak answers rely on reassurance, such as "our platform is HIPAA-certified", which is not a real certification. Use this table in the agency meeting and ask for written answers to anything that matters to you before signing.
| Question | A good answer | A red flag |
|---|---|---|
| Will you sign a BAA? | Yes, before any patient data moves, plus BAAs with vendors that handle it | "We don't need one for marketing" |
| How is texting consent captured? | Clear consent language on forms, timestamped and stored with the contact | Importing old patient lists and texting everyone |
| How do opt-outs work? | One opt-out stops that channel in every workflow, automatically | Opt-outs handled manually, list by list |
| What happens after a lead replies? | Automation pauses and a named staff member follows up | Bots keep messaging after a human reply |
| How is success measured? | Booked appointments and show rates by workflow | Open rates and message counts only |
| Who owns the account? | The practice owns accounts, lists and templates | The agency owns everything and charges to export |
What should I ask about workflows, handoff and results?
Ask what each workflow is for, what triggers it, and when it hands off to a person. Automation should speed up response and follow-up, not replace your front desk. The best workflows are short, tied to one goal such as a booked consultation, and reviewed against real bookings every month.
- Triggers: which actions start a workflow, such as a form, a missed call or a canceled appointment?
- Speed: how quickly does a new inquiry get a first reply, and from whom?
- Handoff: when does a staff member take over, and how are they alerted?
- Content approval: who at the practice approves message wording before it goes live?
- Frequency limits: how many messages can one contact receive in a week across all workflows?
- Reporting: can you see bookings by workflow, not just clicks?
Questions about leaving
Ask now what happens if the relationship ends. Can you export contacts, consent records, opt-out lists and message history in a standard format? Will the agency hand over workflow logic so another team can rebuild it? How long will it keep your patient data after the contract ends, and how will it confirm deletion? Under a BAA, a business associate generally must return or destroy protected health information at the end of the contract where feasible, so the answers should already be in the agreement.
If you are weighing an agency against a self-serve platform, our comparison of agencies and all-in-one automation platforms sets out the trade-offs.
How does Ichelon Consulting US run marketing automation?
We build short, goal-based workflows for email, SMS and lead follow-up, with documented consent, automatic opt-outs and clear handoff to your staff. AtomCRM, our healthcare CRM with calling for front desks, can carry inquiries from first contact to booking. You own the accounts and data.
Our healthcare marketing agency service covers automation alongside search and ads. We sign a BAA with every US client, set monthly goals and report every Monday from Ichelon Agency OS. Retainers start from $499/month, custom-scoped. Book a call with the US team to review your current workflows.
Related pages from the US team
Healthcare marketing agency USA
How Ichelon Consulting US runs healthcare marketing.
Patient email and SMS marketing
Consent-first email and text programs.
CAN-SPAM for healthcare email
Email rules for practices and health brands.
CRM for multi-location clinics
Managing inquiries across several offices.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Does a healthcare agency need a BAA to run marketing automation?
Usually, yes. Automation tools often store patient names, contact details and appointment information, which can be protected health information. When an agency creates, receives, stores or transmits that information for a practice, it acts as a business associate. Ask for a signed BAA before any patient data moves into its systems.
Can a practice text patients appointment reminders and promotions the same way?
Not safely. Reminders about a patient's own care and promotional messages fall under different rules. Marketing texts need documented prior express written consent under the TCPA, and some promotions may count as marketing under HIPAA. Keep reminder and promotional workflows separate, with separate consent records and clear opt-outs.
How fast must an email opt-out be honored?
The FTC's CAN-SPAM guidance says opt-out requests must be honored within 10 business days, and the opt-out method must keep working after the message is sent. In practice, a well-built automation system removes the contact from all marketing email workflows immediately, which avoids any risk of further sends.
What is a red flag when an agency describes its automation platform?
Calling the platform "HIPAA-certified" is one. There is no official HIPAA certification for software or agencies. A credible agency explains how the platform protects data, confirms which vendors sign BAAs, and shows how access, consent and opt-outs are managed. Specific, written answers matter more than labels.
Who should own the marketing automation account?
The practice should. Ask for the account, contact lists, templates and workflow settings to be in the practice's name, with the agency given user access. That way you keep your data and history if you change agencies, and you avoid export fees or rebuilding workflows from scratch.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Want a second opinion on your marketing automation?
A 30-minute call with the US team. We'll review your workflows, consent records and handoffs and flag the risks and quick wins.
Email, SMS and recalls in the nine-stage patient journey
- 0Foundations
- 1Demand gen
- 2Capture
- 3Lead quality
- 4Lead mgmt
- 5Scheduling
- 6Show-up
- 7Conversion
- 8Retention
It works after the first visit: reminders so booked patients arrive, and recalls that bring past patients back. Our own software runs the work, and every stage is reported against a monthly target on Ichelon Agency OS.
See all nine stages and the tool behind each one →