How can a healthcare practice market for new patients legally?

Healthcare practices face a set of marketing rules that plumbers and roofers do not. The core issue is simple: in health care, paying someone for sending you patients can be a crime, even when the same arrangement would be ordinary business in another industry. This guide covers the main federal laws, a state example from Texas, the HIPAA rules on tracking pixels, Google’s ad policies, and why a flat marketing fee is the safer structure. It applies to therapy and mental health practices, physical and speech therapy, medical practices, and orthotics and prosthetics (O&P) providers.

This is a summary, not legal advice. The rules turn on specific facts, so talk to a healthcare attorney before signing any marketing or lead contract.

The Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)) makes it a felony to knowingly and willfully offer, pay, solicit or receive “any remuneration (including any kickback, bribe, or rebate)” to induce or reward referrals, or the arranging for or recommending of items or services, paid for by a federal health care program¹. Penalties are fines up to $100,000, up to 10 years in prison, or both¹. A person “need not have actual knowledge of this section or specific intent to commit a violation”¹, and claims that include items or services resulting from a violation are false claims under the False Claims Act¹.

Marketing is squarely in scope. In a 1998 advisory opinion, OIG quoted its own earlier statement that “many marketing and advertising activities may involve at least technical violations of the statute,” and said percentage compensation for marketing services “may implicate the anti kickback statute”⁴.

What does OIG say about per-patient and per-lead marketing fees?

OIG’s clearest statement for marketers is Advisory Opinion 08-19, about an internet advertiser selling “pay per call” and “pay per lead” advertising to chiropractors³. OIG wrote that advertising, “like any marketing, is meant to induce the use of an item or service,” and that “per patient, per unit-of-service, or similar variable compensation structures are particularly problematic under the statute, because they relate to the volume or value of business potentially generated between parties”³.

OIG still approved that specific arrangement, but only because of a combination of safeguards³:

1. The advertiser was not a health care provider and did not collect health information such as payer, medical history or diagnosis.
2. The advertising did not target federal health care program beneficiaries and did not ask for insurance information.
3. Fees did not depend on whether the person became a patient, or on what services were provided. OIG contrasted this with “problematic ‘success fees.’”
4. The advertiser did not steer patients to particular providers.

Notice what that means. A fee per booked appointment, per new patient, per admission or per insurance-verified lead looks much more like the “success fee” OIG warned about. And an advisory opinion protects only the party that requested it³.

What is the safe harbor for marketing contracts?

The personal services and management contracts safe harbor (42 CFR 1001.952(d)) protects payments to an agent when all its conditions are met, including: a signed written agreement covering all services, a term of at least one year, and a compensation methodology that is “set in advance, is consistent with fair market value in arm’s-length transactions, and is not determined in a manner that takes into account the volume or value of any referrals or business” generated for federal programs². A fixed monthly fee for defined marketing services can be built to fit this. A per-patient or percentage fee cannot.

The Eliminating Kickbacks in Recovery Act (EKRA, 18 U.S.C. 220) covers payments for referrals to a recovery home, a clinical treatment facility, or a laboratory⁵. A clinical treatment facility is a non-hospital setting licensed or certified by a state to provide substance use detoxification, risk reduction, outpatient treatment, residential treatment or rehabilitation⁵.

Two features make EKRA stricter than the Anti-Kickback Statute:

• It covers all payers. It applies to services covered by a “health care benefit program”⁵, defined as “any public or private plan or contract” providing medical benefits⁶. Commercial insurance counts.
• Higher fines. Up to $200,000, up to 10 years in prison, or both, for each occurrence⁵.

EKRA has an exception for payments to employees or independent contractors, but only where pay “is not determined by or does not vary by” the number of people referred, the number of tests or procedures, or the amount billed or received⁵. Addiction treatment programs, sober living homes and labs should treat any per-admission or per-lead payment as off limits and have a healthcare attorney review any marketing arrangement.

Yes. Many states have their own anti-kickback or patient-brokering laws, and some reach private-pay care. Texas Occupations Code chapter 102 is a good example:

• The offense. A person commits an offense by knowingly offering to pay or agreeing to accept “any remuneration in cash or in kind” for “securing or soliciting a patient or patronage for or from a person licensed, certified, or registered by a state health care regulatory agency”⁷. It is a Class A misdemeanor, and a third-degree felony for repeat offenders or government employees⁷. Nothing in the text limits it to government-paid care.
• Federal safe harbors carry over. The Texas law permits any payment practice permitted by the federal Anti-Kickback Statute or its regulations⁸.
• Advertising is allowed. The offense “does not prohibit advertising,” unless the advertising is false, misleading or deceptive, claims professional superiority that cannot be readily verified, or is prohibited under Texas Health and Safety Code chapter 164 (a 2025 amendment)⁸.
• Disclosure. A person who lawfully accepts pay to secure patients must disclose, at first contact and at referral, any affiliation and the fact that they are being paid⁹.
• Treatment facilities. Under Health and Safety Code chapter 164, since Sept. 1, 2025 a covered mental health or chemical dependency treatment facility may not contract with a marketing provider for call center or website referrals or leads unless the contract terms are disclosed to the prospective patient; whether an outpatient clinic is covered is a question for a Texas healthcare attorney¹⁹.
• Referral services. Health care information services that match consumers with providers are exempt only if they meet a long list of conditions, including a fee that is “set in advance, is consistent with the fair market value” and “is not based on the potential value of a patient” or a percentage of a professional service¹⁰.

A Texas therapy, PT, speech, medical or O&P practice should assume chapter 102 applies to its marketing and confirm the details with counsel. Other states have their own versions.

O&P providers that bill Medicare as DMEPOS suppliers have an extra rule. A supplier must agree not to contact a beneficiary by telephone about supplying a Medicare-covered item unless the person gave written permission, the call is to coordinate delivery of an item already furnished, or the supplier has furnished a covered item to that person in the past 15 months¹⁶. Cold calling or buying lists of Medicare patients to phone is not an option.

Be careful. For Medicare and Medicaid patients, offering anything likely to influence their choice of provider can bring civil penalties, and OIG interprets permitted gifts of nominal value as no more than $15 per item or $75 per patient per year, with no cash or cash equivalents¹⁷. OIG counts items that can be used like cash, such as a general purpose debit card, as cash equivalents¹⁸. A thank-you note is safe. A $50 gift card per referral is not: it is well over the $15 per-item limit, and it pays for a referral. Ask a healthcare attorney before starting any referral reward.

Tracking tools such as the Meta pixel, Google Analytics and ad conversion tags send data about visitors to third parties. For HIPAA covered entities, that creates risk when the data includes protected health information.

The 2024 court ruling. HHS’s Office for Civil Rights issued a bulletin on online tracking technologies in December 2022 and revised it on March 18, 2024¹¹. Part of it said that connecting a visitor’s IP address with a visit to an unauthenticated public webpage about specific health conditions or providers could be protected health information, a rule the court called the “Proscribed Combination”¹¹. On June 20, 2024, the U.S. District Court for the Northern District of Texas held that HHS exceeded its authority and vacated that part of the bulletin¹¹. The court stressed that its ruling covered only the Proscribed Combination, and noted that the bulletin “contains an array of guidance for covered entities, much of which is both legally and pragmatically sound”¹¹.

What still applies. HIPAA itself did not change. A covered entity may disclose protected health information to a business associate, such as a vendor that handles it on the practice’s behalf, only with satisfactory assurance that the vendor will safeguard it¹². If a tracking or ad vendor will not give that assurance in writing, do not send it patient data.

Not just HIPAA. In 2023, online counseling company BetterHelp agreed to an FTC order requiring it to pay $7.8 million to consumers over charges that it shared sensitive data, including email addresses, IP addresses and health questionnaire information, with Facebook, Snapchat, Criteo and Pinterest for advertising¹³.

Practical rules for a practice website:

• No ad pixels or third-party analytics on patient portals, intake forms, appointment request forms or any page behind a login.
• Track conversions with events that carry no health details. “Form submitted” is fine. “Depression intake submitted” is not.
• Do not pass names, emails or phone numbers of patients to ad platforms.
• Review what every tag on the site sends, and get a written opinion from a HIPAA attorney on your setup.

Google restricts healthcare advertising through several sub-policies, from prescription drugs to clinical trials to addiction services¹⁴.

• Addiction treatment. In the US, advertisers for recovery-oriented drug and alcohol addiction services must be “certified as an addiction services provider by the LegitScript Certification program,” and must also be certified with Google¹⁴.
• Personalized advertising. Google treats health as a sensitive interest category. Its policy covers “physical or mental health conditions” and treatments, and advertiser-curated audiences, a group that includes customer match and your own data segments, “can’t be used if promoting in sensitive interest categories”¹⁵. In practice, you cannot upload your patient list for targeting or build remarketing audiences around health conditions.

Search ads that show for what a person types, such as “physical therapist near me,” are the cleanest paid channel for most practices, alongside a strong Google Business Profile and local SEO.

Every law above points the same direction. The risk rises when pay goes up with the number of patients, referrals, admissions or dollars billed, and falls when pay is fixed in advance for defined work at fair market value²³⁵¹⁰.

All inputs are illustrative.

A physical therapy clinic is offered two marketing deals.

• Deal A: $150 per new patient who books an evaluation.
• Deal B: $3,000 a month flat for local SEO, Google Business Profile management and a search ad campaign, with ad spend paid directly to Google.

If the campaign produces 20 new patients a month, the cost is the same: 20 x $150 = $3,000 for Deal A, and $3,000 for Deal B. The economics are identical at that volume. The legal profile is not. Deal A ties payment to each patient, which OIG calls particularly problematic³, and in Texas it looks like paying remuneration for securing patients⁷. Deal B pays for defined work at a fixed price².

Now check whether Deal B pays off. Suppose a new patient averages 8 visits at $95 net collected per visit, or $760, and the clinic’s contribution margin after therapist time and supplies is 40%:

• Contribution per new patient: $760 x 0.40 = $304.
• Patients needed to cover the fee: $3,000 / $304 = about 10 new patients a month.
• At 20 new patients: 20 x $304 = $6,080 contribution, minus $3,000 = $3,080 a month after the marketing fee.

The decision rule: a flat fee is worth it when expected new patients times contribution per patient clearly exceeds the fee. You carry the volume risk instead of the vendor, which is the price of the safer structure. Track results carefully (see lead tracking and attribution) and renegotiate on scope at renewal, not on patient counts.

• Pay for marketing work and advertising, not for patients, referrals, admissions or a share of revenue.
• Flat fees set in advance at fair market value, in a written contract of at least a year, are the structure the federal safe harbor and the Texas information-service exemption point to. Each has other conditions too.
• Addiction treatment, sober living and labs face EKRA on every payer; use no per-lead or per-admission pay at all.
• Keep ad pixels off portals, intake forms and anything that reveals a condition, and never upload patient lists to ad platforms. Google does not allow customer lists for ads in its health category anyway.
• This is not legal advice. A healthcare attorney should review any marketing contract, referral reward or tracking setup before you sign or launch.