What compliance rules apply to direct-to-consumer telehealth marketing?
Direct-to-consumer telehealth marketing is governed by several rulebooks at once: FTC truth-in-advertising law, FDA limits on how prescription drugs are promoted, state licensure and medical board rules, HIPAA or the FTC's health-privacy rules for tracking data, and subscription billing law. No single agency covers all of it, so the marketing team needs one review process that checks each layer before anything ships.
- Advertise the service, not a guaranteed prescription: a licensed clinician decides, and ads should say so.
- Drug claims draw FDA attention: since September 2025 FDA has sent telehealth firms warning letters over misleading drug marketing, including compounded GLP-1s.
- Target only states where your clinicians are licensed: the patient's location at the time of the visit generally sets which license is needed.
- Know which privacy law covers you: HIPAA for covered entities and business associates, the FTC Health Breach Notification Rule for many apps, plus state laws such as Washington's.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“When I first approached Ichelon Consulting, my YouTube channel was stuck and despite my own efforts, it was not growing. They created a specific strategy which was based on SEO, and completely evaluating the channel, which worked great and has propelled our YouTube channel to new heights. Because of the channel growth, we have seen new patient consultations coming on a regular basis.”
Which agencies and laws apply to direct-to-consumer telehealth marketing?
At least five layers apply. The FTC polices deceptive and unfair advertising and health data practices. FDA oversees how drugs are promoted. States license clinicians and regulate medical advertising. HHS enforces HIPAA where the company is a covered entity or business associate. And subscription billing rules apply to memberships. Most compliance gaps sit between these layers.
| Layer | Main rules | What it means for marketing |
|---|---|---|
| Advertising truthfulness | FTC Act Section 5; FTC Health Products Compliance Guidance | Health claims need competent and reliable scientific evidence; no misleading impressions |
| Drug promotion | Federal Food, Drug, and Cosmetic Act; FDA enforcement | No false or misleading drug claims; compounded drugs are not FDA-approved |
| Clinician licensure | State medical, nursing and pharmacy boards | Serve and advertise only where clinicians may practice |
| Controlled substances | Ryan Haight Act; DEA telemedicine rules | Special care before advertising any controlled medication |
| Health data privacy | HIPAA; FTC Health Breach Notification Rule; state health privacy laws | Tracking pixels, email lists and ad audiences need a lawful basis |
| Endorsements and reviews | FTC Endorsement Guides; Consumer Reviews and Testimonials Rule | Disclose paid creators; no fake or suppressed reviews |
| Memberships | ROSCA; state automatic renewal laws | Clear recurring terms, consent and simple cancellation |
Platform rules sit on top. Ad platforms commonly require certification for telemedicine and online pharmacy advertisers and restrict health-based targeting. Check each platform's current policy before launch. This page is a marketing overview; confirm specifics with healthcare counsel.
What can a telehealth company say about prescriptions in its ads?
A telehealth ad can describe the service: a visit with a licensed clinician who may prescribe if appropriate. It should not promise that a visit ends in a prescription, imply that a compounded or unapproved drug is FDA-approved, or present benefits without fair mention of risks. FDA has made misleading direct-to-consumer drug marketing an enforcement priority.
On September 9, 2025, FDA announced a crackdown on deceptive drug advertising, saying it was sending thousands of letters to companies about misleading ads and restating that drug advertising must present a fair balance of risks and benefits. On March 3, 2026, FDA said it had warned 30 telehealth companies over false or misleading claims about compounded GLP-1 products, describing them as the second group of such letters since September.
Claims that create the most risk
- "Get [drug] prescribed today" or "guaranteed approval", which suggests the clinician's judgment is a formality.
- Calling a compounded drug "generic" or "the same as" a brand-name approved product.
- Using the telehealth company's own brand name on a compounded drug in a way that hides who actually compounded it.
- Benefit-heavy ads with risk information pushed into a footnote or a separate page.
- Before-and-after or outcome claims without evidence that typical patients get those results.
Search terms and landing pages
Bidding on a brand-name drug as a keyword is a common telehealth tactic. The landing page then has to be precise about what the patient can actually get. If the clinician may prescribe a different or compounded product, say so plainly at the top, not after the price. Ad platforms also apply their own rules to prescription-drug keywords and usually require advertiser certification; check the current policy.
Safer framing
Lead with access, convenience and the clinical process: licensed clinicians, a medical history review, follow-up care, transparent pricing. When a specific medication is named, include balanced safety information close to the claim and link to full prescribing information where it exists. Our page on the advertising rules for compounded GLP-1 medications covers that category in detail.
How do state licensure and prescribing rules shape telehealth ad targeting?
Clinicians generally must be licensed, or otherwise legally allowed to practice, in the state where the patient is located at the time of the visit. The HHS guidance on licensing across state lines lists the main routes: full licenses, licensure compacts, temporary practice rules and telehealth registrations. Advertising should follow the license map, not the other way round.
Turning licensure into marketing rules
- Geo-target paid campaigns only to states where you have licensed clinicians and pharmacy coverage for the service advertised.
- Show state availability on landing pages and confirm the patient's location at intake, before booking.
- Check state advertising rules. State medical boards have their own rules on testimonials, credentials and claims, and they differ.
- Name credentials accurately. "Board-certified" or "physician-led" must be literally true for the clinicians who see the patient.
- Update campaigns when the license map changes. A lapsed license in one state should switch off ads there the same day.
Controlled substances
Prescribing controlled substances by telemedicine is governed by federal law and DEA rules. In January 2026, HHS and DEA extended the telemedicine flexibilities through December 31, 2026. They allow prescribing without a prior in-person visit under set conditions while permanent rules are finalized. Because these flexibilities are temporary, avoid building acquisition campaigns that depend on them. Never advertise a controlled medication as easy to get. Our glossary entry on telehealth across state lines explains the licensure terms.
Which privacy rules apply to telehealth tracking pixels and marketing data?
It depends on what the company is. A provider that bills health plans electronically is usually a HIPAA covered entity, and its vendors may be business associates. A cash-pay app outside HIPAA can fall under the FTC's Health Breach Notification Rule and state health privacy laws. Sending health signals to ad platforms without a lawful basis is the main risk.
If HIPAA applies
The HHS OCR guidance on online tracking technologies (December 2022, updated March 2024) warns that tracking tools can disclose protected health information. In June 2024 a federal court (AHA v. Becerra) vacated the part covering certain unauthenticated public pages, but tracking on patient portals, intake flows and other authenticated pages is still covered. Pixels on booking and intake screens are where most risk sits.
If HIPAA does not apply
The FTC says its Health Breach Notification Rule covers vendors of personal health records and related entities, including many health apps, and that a breach includes unauthorized disclosure, such as sharing health data with an ad platform without consent, not only hacking. Notice to affected people is due no later than 60 calendar days after discovery.
Washington's My Health My Data Act protects consumer health data held by companies outside HIPAA. It applies to businesses that serve Washington consumers, requires a separate consumer health data privacy policy linked from the homepage, requires authorization before selling health data, and allows consumers to sue. Other states have passed related laws.
A practical setup: server-side or consent-gated tracking, no third-party pixels on intake or authenticated pages, conversion events that carry no health detail, and a BAA or equivalent data agreement with every vendor that touches patient data. Our HIPAA-safe website tracking guide walks through the options.
How should telehealth brands use testimonials, creators and reviews?
Use them carefully and with disclosure. The FTC's Endorsement Guides require paid creators, affiliates and anyone else with a material connection to disclose it clearly. The Health Products Compliance Guidance says testimonials are not a substitute for scientific evidence and that atypical results need context. Patient testimonials raise extra privacy steps for HIPAA-covered providers.
Patient stories
A covered provider generally needs a valid written HIPAA authorization before using a patient's story, photo or name in marketing. Keep the signed authorization on file and let patients withdraw it. Even with permission, the story is an advertising claim: if it implies results most patients do not get, it is misleading.
Clinicians as creators
When a company clinician posts on social media about the service, the employment relationship is a material connection to disclose. Clinicians also carry state board obligations of their own. Give them the same claims guidance as outside creators, plus a rule never to discuss an individual patient.
Reviews
The FTC's Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, prohibits fake reviews, sentiment-conditioned incentives, undisclosed insider reviews and review suppression. Reply to public reviews without confirming that the reviewer is a patient or mentioning any health details.
What rules apply to telehealth memberships, bundles and pricing?
A telehealth membership that bills monthly is a negative option offer, so ROSCA applies when it is sold online: disclose all material terms before taking billing details, get express informed consent and offer a simple way to stop charges. State automatic renewal laws add notices and cancellation rules. Pricing clarity matters most.
Telehealth-specific pricing traps
- Visit fee versus medication cost. If the advertised price covers the consultation but medication costs extra, say so next to the price.
- Introductory prices. State when an introductory rate ends and what the ongoing price will be.
- Prescription not guaranteed. Explain what is charged, and what is refunded, if the clinician decides treatment is not appropriate.
- Bundled membership and medication. Show both components, how often each bills and how cancellation affects ongoing prescriptions.
- Insurance language. Do not imply insurance coverage you have not confirmed for that patient.
Cancellation for a medical membership has a care dimension too: tell members how to get their records and how ongoing prescriptions will be handled after they leave.
How should a telehealth company organize marketing compliance?
Give one person ownership of a written review process that every ad, landing page, email, creator brief and pricing change passes through. That person checks claims against a pre-approved claims library, routes drug and privacy questions to counsel and clinical leadership, and keeps records of what was approved and when. Speed comes from the library, not from skipping review.
A workable review chain
- Marketing drafts using approved claims and templates.
- Clinical review confirms medical accuracy and safety information.
- Legal or compliance review covers drug promotion, privacy, licensure and pricing terms.
- Final marketing sign-off checks targeting, tracking setup and disclosures before launch.
- Post-launch monitoring samples live ads, creator posts and reviews each week.
What goes in the claims library
- Service claims: approved wording for access, speed of booking, clinician credentials and follow-up care.
- Medication language: for each named drug, the approved description, the safety information that must sit beside it and the approval status.
- Pricing statements: current prices, what each includes and the required qualifiers.
- Banned phrases: "guaranteed", "same as", "generic" for compounded drugs, "cure", and any outcome claim without evidence.
- State notes: where a service is unavailable or a state board restricts a claim or testimonial format.
Review the library every quarter and whenever FDA, the FTC or a state publishes something new.
Keep a change log. When a rule changes, such as a new FDA statement or a state law, you can find every asset affected in hours rather than weeks.
Where a fractional CMO fits
Many telehealth startups need senior marketing leadership before they can justify a full-time hire. At Ichelon Consulting US, Santosh Reddy, Partner, Ichelon Consulting US, serves as fractional CMO, building this kind of review process alongside growth plans. Plans run $1,000/month (Advisory), $1,500/month (Growth) and $2,000/month (Embedded), with execution scoped separately. Read about Santosh Reddy, see our telehealth practice marketing guide, or book a call with the US team. We sign a BAA with every US client.
Related pages from the US team
Fractional CMO for healthcare companies
Senior marketing leadership for telehealth and healthtech teams.
Telehealth practice marketing guide
Channels, funnels and positioning for virtual care.
HIPAA-safe website tracking
How to measure campaigns without exposing patient data.
HIPAA-safe Meta ads
Running Meta campaigns for healthcare without privacy problems.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Who regulates direct-to-consumer telehealth advertising?
Several bodies. The FTC enforces truthful advertising and health privacy rules, FDA oversees drug promotion, state boards license clinicians and regulate medical advertising, HHS enforces HIPAA for covered entities and business associates, and DEA governs controlled-substance prescribing. Ad platforms add their own certification and targeting policies.
Can a telehealth ad promise patients a prescription?
It should not. A licensed clinician decides whether a prescription is appropriate after reviewing the patient. Ads that promise or imply guaranteed prescriptions misrepresent the service and draw regulator attention. Describe the visit, the clinician's review and the possible outcomes, including that treatment may not be prescribed.
Can telehealth companies advertise in every US state?
Only where their clinicians are licensed or otherwise permitted to practice. HHS guidance says the patient's location at the time of the visit generally determines which state license is needed. Geo-target ads to covered states, show availability on landing pages and confirm patient location at intake.
Can a telehealth company use the Meta pixel on its website?
Only with great care. For HIPAA-covered providers, HHS OCR guidance treats tracking on authenticated pages and intake flows as a disclosure risk. For non-HIPAA apps, the FTC treats sharing health data with ad platforms without consent as a possible breach. Many teams use consent-gated or server-side tracking that carries no health details.
Does the FTC Health Breach Notification Rule apply to telehealth apps?
It can. The rule covers vendors of personal health records and related entities that are not covered by HIPAA, including many health apps. A breach includes unauthorized disclosure, such as sharing data with advertisers without consent. Affected people must be notified no later than 60 calendar days after discovery.
Are DEA telemedicine flexibilities still in effect?
Yes, for now. DEA and HHS extended the telemedicine flexibilities for prescribing controlled medications through December 31, 2026, while permanent rules are finalized. Because they are temporary, telehealth companies should avoid marketing plans that depend on them and should never advertise controlled medications as easy to obtain.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Launching or scaling a telehealth brand?
A 30-minute call with the US team. We will review your ads, landing pages and tracking against the main federal and state rules and outline a review process your team can run.