Paid Search Compliance for Healthcare and Regulated Industries: What to Ask Your Agency

Paid search in healthcare, finance, and other regulated categories runs on a shrinking set of tools. Audience targeting is restricted, keywords sit behind certifications, and the tracking that powers smart bidding can create legal exposure on its own.

Enforcement runs at scale. Google suspended 24.9 million advertiser accounts in 2025, and personalization violations ranked among the most common reasons in the US, the same policy that governs health targeting.

This guide gives you the questions to put to any agency before it touches a regulated account, plus the policy and legal background behind each one.

P.S. If you'd rather start with an account review, our team runs compliant health and wellness marketing for brands in restricted categories. Book a call and we'll walk through your setup.

TL;DR

• Ask about experience, ownership, and liability first. Certification history in your markets, who owns the account, and who carries the risk if a tag breaks the rules tell you more than any case study.
• Tracking is the biggest legal exposure. Ad copy rarely triggers HIPAA. The data your conversion tags send back to Google can.
• Google blocks consumer health remarketing. Customer Match, your data segments, and lookalikes can't be used to promote health conditions or treatments.
• Certifications gate keywords and launch dates. LegitScript plus a Google application can take weeks, and that time belongs in your launch plan.
• Cost runs highest in behavioral health. Mental health and addiction recovery carry the highest cost per lead in healthcare search.

Agency answer scorecard

The table below condenses the answers. Score each agency on your shortlist against it, and keep the red flags column handy for the first call.

Before we delve into the questions, remember this: We treat compliance as part of how media, creative, and measurement get built, from the first keyword list to the last conversion action. When a platform takes away remarketing and lookalikes, the keyword architecture and the ad copy have to do the targeting those tools used to do. And when tracking is where the legal risk sits, the measurement plan stops being a reporting detail and becomes the core of the compliance plan. An agency that bolts a legal review onto the end of that process will keep finding problems after launch, when they're most expensive.

Questions to Ask a PPC Agency Before It Manages a Regulated Account

Here, we discuss the right questions to ask a PPC agency before it manages a regulated account cover experience in your exact vertical and markets, account ownership, launch timing, liability, tracking architecture, and how the agency builds audiences and copy inside platform rules.

They're ordered below by what buyers usually worry about first, and you can run them against any shortlist, including the healthcare marketing agencies we've compared. Each one comes with the literal question to ask and what a strong answer covers.

1. Ask which regulated accounts they've run in your vertical and markets

"Which accounts like ours have you run, in which countries, and which certifications did each one need?"

Regulated categories aren't one category. A telehealth brand, an addiction treatment center, and a consumer lender each answer to different policies, and the rules change by country. Google's Healthcare and medicines policy keeps adding country-specific rules: in 2026 alone it opened prescription services for certified online pharmacies in India and telemedicine for certified providers in New Zealand.

A strong answer names verticals and markets that match yours and the certification each account held. A vague "we've worked with lots of healthcare brands" usually means dental practices and med spas, which sit under lighter rules than prescription or addiction services.

Remember: The same test applies to any search partner. The signals that separate strategy from spend in Google Ads agencies matter twice as much when a policy mistake can pause the account.

2. Ask who owns the ad account and certifications if you part ways

"Whose Google Ads account will we run from, who holds the certifications, and what happens to both if we end the contract?"

Certifications attach to your business and, on Google, to a specific Google Ads account ID. If an agency runs your campaigns from an account it owns, your certification history and your conversion data can stay with the agency when you leave. LegitScript certification is issued per website, so it belongs to your domain, but the Google approval tied to it doesn't move automatically.

Financial services add another layer. Google's verification program recognizes "First Party" and "Authorized Advertisers," and approved third-party advertisers can't apply for verification at all. Ask the agency which role it plans to hold. A strong answer keeps the account, billing, and certifications in your name, with the agency on manager access.

3. Ask how long launch takes once certification is factored in

"If we need certification, what's the sequence and the realistic timeline before our first ad serves?"

Certification is usually two steps: a third-party review, then a separate application to the ad platform. LegitScript charges $975 per website to apply and $2,150 per year once certified, with an extra $2,500 fee to start review within two business days. Google's own approval follows after that.

A strong answer lays out the sequence week by week and plans work that can run in parallel: keyword research on non-restricted terms, landing page fixes, and tracking cleanup. An agency that quotes a launch date without asking whether you need certification hasn't run many of these.

4. Ask what performance you'll give up and how they forecast it

"Which targeting and bidding tools won't be available to us, and how does your forecast account for that?"

For health content, Google blocks every advertiser-curated audience: Customer Match, your data segments, audience expansion, and lookalike segments.

Remarketing, the cheapest conversions in most accounts, is off the table for consumer health conditions and treatments.

A strong answer adjusts the forecast for that loss and explains where the volume will come from instead:

• Tighter keyword architecture
• Predefined Google audiences
• Better landing page conversion rates

Be wary of a forecast that looks like an ecommerce account with a healthcare logo on it.

5. Ask who carries liability if an ad or tag breaks the rules

"If a tag you deploy sends health data to an ad platform, or an ad you write makes a claim we can't support, who is responsible under our contract?"

The stakes are real. Penn Medicine set up a settlement fund of up to $9.5 million over Meta and Google tracking on its patient portal, and Wellstar Health agreed to a $4.25 million settlement over tracking pixels in 2026.

A strong answer covers three things: written change control for any tag or script, a sign-off from your team before new tracking goes live, and contract language on indemnity your legal team can review. Your counsel should have the final word here; the agency's job is to be clear about what it does and doesn't take on.

6. Ask how they handle disapprovals and account suspensions

"Walk us through the last suspension you resolved for a regulated client: what triggered it, how long it took, and what changed afterward."

Disapprovals are routine in regulated accounts. Suspensions are the real risk, because they can freeze every campaign at once. For many restricted policies Google issues a warning at least seven days before suspending an account, and an agency that monitors Policy Manager daily can act inside that window.

Google says its systems cut incorrect advertiser suspensions by 80% in 2025, so a strong answer also distinguishes a false positive worth appealing from a real violation worth fixing first. Agencies that appeal everything by reflex tend to get slower reviews.

7. Ask exactly which events their tracking sends to Google

"Show us every conversion action and parameter you plan to send to Google, and tell us what you strip out before it leaves our site."

The question is about mechanics. An agency should be able to produce an event inventory: each conversion action, the page it fires on, and every parameter attached. Look for three practices in the answer:

• Server-side redaction that removes page paths, form fields, and query strings naming conditions or treatments before data reaches the platform. Our guide to server-side tracking for paid media teams covers the setup.
• A deliberate call on enhanced conversions. The feature sends SHA256-hashed emails, names, addresses, and phone numbers that Google matches to signed-in accounts, so hashing doesn't make the data anonymous.
• Generic conversion names. "Lead_submitted" tells Google what it needs; "Oncology_consult_booked" tells it too much.

8. Ask who signs a BAA and with which vendors

"If any of your systems will touch protected health information, will you sign a business associate agreement, and which of your vendors will too?"

A business associate agreement (BAA) is the HIPAA contract that covers any vendor handling protected health information for a covered entity. Google Analytics doesn't qualify: Google states it makes no representation that Analytics satisfies HIPAA and offers no BAA for it.

That shapes the whole architecture. A strong answer names the server-side or customer data platform vendor that will sign a BAA, explains which data stops at that layer, and confirms the agency itself will sign one if its team can see PHI, for example through CRM access for offline conversion imports.

9. Ask how they build audiences without health remarketing

"With remarketing and Customer Match off the table, how will you find and re-engage the right people?"

The answer should start with keyword research, because in restricted categories the query is the audience. Strong agencies split campaigns by intent stage (symptom research, treatment comparison, provider selection) and write copy for each, so the search term does the qualifying.

Beyond keywords, look for three tools.

• Predefined Google audiences such as in-market and life events remain available for health content.
• Consented first-party lists can power email and owned channels, a model we cover in our post on retention marketing for acquisition teams.
• And for B2B health brands, Google has excluded content aimed at healthcare professionals in their professional capacity from the health category since May 2025.

10. Ask who reviews ad copy and landing pages, and how fast

"Who checks claims in ads and on landing pages before launch, in what order, and how quickly can you turn around a legal revision?"

Copy is where platform policy and advertising law overlap. Health claims need substantiation, prescription references need certification, and Microsoft explicitly bars ads that target users based on sensitive health information, which in practice rules out "your condition" phrasing.

A strong answer describes an approved claims library your legal or medical reviewers sign off once, so the agency can test variations inside it without a full review each time. That's how a creative testing system keeps running in a regulated account.

Pro tip: Match the agency's turnaround to your legal team's: a 24-hour copy cycle means little if review takes two weeks.

11. Ask what they need from your team to stay compliant

"What do you need from us, and who on our side should own each piece?"

A prepared agency will ask for licenses and certification numbers, a named legal or compliance contact, access to the CRM for offline conversions, and an owner for landing page edits. Unclear ownership of landing pages causes many disapprovals, because the ad gets fixed while the page it points to doesn't.

A strong answer arrives as a written onboarding list. If the agency has no requests for your legal team, it's planning to find the gaps after launch.

12. Ask how they report results when platform data is partial

"With restricted tracking, what will you report on, and how will you tie spend to qualified patients or customers?"

Redacted tracking means platform-reported conversions will undercount. A strong answer moves the scoreboard to your CRM: qualified leads, booked appointments, or funded accounts, imported back to Google as offline conversions where your BAA setup allows. Modeled conversions fill some gaps, and the agency should say which numbers are modeled.

Warning: A BAA with an agency or intermediary doesn’t automatically authorize disclosure to Google or override Google’s policies. Separate internal CRM reporting from platform uploads, and assess the receiving platform and each measurement product independently.

13. Ask how they price compliance work

"Which compliance tasks are in the retainer, which are billed separately, and which third-party fees will we pay directly?"

Compliance has real costs: the tracking audit and rebuild, certification fees you'll pay to LegitScript, policy monitoring, and extra copy review cycles. LegitScript also runs enterprise certification programs for agencies managing many clients, which can speed up review. A strong answer separates one-off setup from ongoing work and doesn't mark up pass-through fees.

14. Ask which policy changes they're tracking this quarter

"What changed in the policies that affect us over the last three months, and what's coming next?"

A good agency answers without looking it up. Right now that list includes Google's small US test of healthcare ads in AI Mode, eligible through Performance Max, AI Max with search term matching, Shopping, and broad match, with no pinned assets or text disclaimers in the first iteration. It also includes state health privacy laws and new ad surfaces in AI search, which is why we track agencies testing ChatGPT ads as closely as Google's changelog.

What Paid Search Compliance Means in Regulated Industries

Paid search compliance in a regulated industry means meeting three sets of rules at once: the ad platform's policies, the laws and regulators that govern your category, and the privacy rules covering the data your campaigns collect. In pay per click advertising, each layer fails differently, and a campaign can pass one while breaking another.

Which Industries Count as Regulated in Google Ads?

Google treats healthcare, pharmacy, telemedicine, addiction treatment, clinical trials, financial services, gambling, alcohol, and cryptocurrency as restricted categories, each with its own certification or targeting rules.

The list keeps moving. In June 2026 Google extended financial services verification, run through its partner G2, to 24 more European Economic Area markets, with enforcement starting July 23.

How Google Ads Healthcare Policy Restricts Targeting and Keywords

Google Ads healthcare policy limits three things: who you can target, which keywords you can buy, and which claims you can make.

The Health in personalized advertising policy covers:

• Physical and mental health conditions
• Treatments for chronic conditions
• Intimate health
• Invasive procedures
• Disabilities

And it removes advertiser-curated audiences for all of them.

Prescription drug keywords need certification. In the US, Canada, and New Zealand, online pharmacies, telemedicine providers, and manufacturers must hold the right healthcare certification to target prescription drug terms, though since late October 2025 Google has allowed those terms in non-promotional contexts such as public health announcements.

The one widening is for B2B: content aimed at healthcare professionals in their professional role sits outside the health category, and the restricted drug terms exclusion took effect July 1, 2025.

Why Conversion Tracking Is the Biggest HIPAA Risk in Healthcare PPC

Conversion tracking is the biggest HIPAA risk because the data that tags send back to Google and Meta can count as protected health information, while ad text and keywords rarely do. Being HIPAA compliant in paid search is mostly a measurement problem.

The rules shifted twice in two years. HHS's Office for Civil Rights issued a tracking technologies bulletin in December 2022 and revised it in March 2024.

In June 2024, a federal court in Texas vacated one part of it: the rule that an IP address plus a visit to an unauthenticated page about a health condition counts as protected information.

HHS withdrew its appeal that August. The rest of the bulletin stands, and tracking on authenticated pages such as patient portals is still generally treated as touching PHI.

The habit is widespread.

A Health Affairs census found third-party tracking on 98.6% of US hospital websites, with Alphabet receiving data on 98.5% of them. The data dates from 2021, but settlements show the cost landing now: Advocate Aurora agreed to a $12.225 million fund covering about 2.5 million people.

Brands outside HIPAA aren't exempt. The FTC fined GoodRx $1.5 million in its first Health Breach Notification Rule case, and BetterHelp paid $7.8 million after health data was used to target about 5.6 million people. In the Flo Health case, a jury found against Meta in August 2025, and plaintiffs are seeking $5,000 per class member.

Washington's My Health My Data Act adds a private right of action for consumer health data.

Pro tip: Fixing this sits with whoever owns your analytics and measurement, and it's work the agency questions above should already have surfaced.

What Compliant Healthcare PPC Costs and How to Judge ROI

Compliant healthcare marketing in paid search costs the most per lead in behavioral health, plus fixed certification and setup costs. LocaliQ's healthcare benchmarks put the average healthcare search cost per lead at $66.02, but the spread is wide: mental health averages $141.17 and addiction recovery $120.30, while dermatology sits at $18.54.

The two most expensive are behavioral health categories that Google names in its health targeting policy, and addiction treatment also needs LegitScript certification before a single ad serves. Financial services runs high too, with a $74.44 average cost per lead and a 2.64% conversion rate in 2026.

Judge ROI on qualified outcomes from your CRM: booked consults, admitted patients, funded accounts. A higher cost per lead is fine when lead quality holds and lifetime value supports it. If you want a second view of the numbers, our Google Ads team can model compliant performance against your current account.

How to Audit Your Current Account for Compliance Gaps

Audit your current account in six steps, starting with what Google has already flagged. This is the in-house version of the agency questions, for teams checking their own setup.

1. Export Policy Manager disapprovals and limited statuses. Sort by policy and look for repeat violations, which carry more suspension risk than one-off disapprovals.
2. Inventory every tag on authenticated and condition pages. Use a tag scanner or your tag manager to list every script firing on portals, booking flows, and condition pages.
3. Check audience lists for health-based segments. Remove any Customer Match list or website visitor segment built from health pages, and confirm no health campaign uses them.
4. Review conversion actions, enhanced conversions, and imports. Rename descriptive conversions, confirm what parameters each one sends, and decide whether enhanced conversions belong in the setup at all.
5. Confirm certification status per country. Match every market you target against the certifications on file, including renewal dates for LegitScript.
6. Re-check Microsoft Ads imports. Campaigns imported from Google can bring audience lists and settings that break Microsoft's rules, which require preapproval for pharmacy and telemedicine advertisers. The same check applies to any channel you add as you diversify beyond Meta.

Build Compliant Paid Search with 9AM

Compliance in regulated paid search works best when the people buying media, writing copy, and building tracking plan it together.

That's how we run regulated accounts at 9AM: keyword architecture built around intent stages, an approved claims library your reviewers sign off once, and measurement designed so the data that leaves your site is the data you meant to send.

Media buyers, creative strategists, and analysts sit on the same account team, so a tracking change gets checked against the copy it measures, and a new ad angle gets checked against the policy it has to pass before anyone spends against it.

We've done this work in sensitive categories for years.

For GenomeLink, a DNA analysis platform, we produced around 70 unique assets a month across six formats and cut customer acquisition cost by 77% over a three-year partnership. The creative volume mattered as much as the media plan: a steady supply of compliant variations kept performance from decaying while the account scaled across more than five channels.

If you're evaluating agencies or auditing your own setup, bring the scorecard above to the conversation, along with your current certification list and a recent export from Policy Manager. Those three documents usually show quickly whether the gaps sit in targeting, tracking, or copy review.

Book a strategy call and we'll review your certifications, tracking, and targeting, then show you where the compliant growth is.

FAQs

Does enhanced conversions create HIPAA exposure if the data is hashed?

It can. Hashing hides the raw email, but Google uses the hash to match a real, signed-in person, so the data still identifies someone. If the conversion it's attached to reveals a health service, treat it as potential PHI and keep it out of Google unless your legal team approves the setup.

If an agency imports offline conversions from our CRM, does it need a BAA?

If the agency's team or tools can access protected health information in the CRM, a BAA is generally expected. Many teams avoid the question by having the CRM export only an anonymous click ID, a timestamp, and a generic conversion value, with no condition or patient detail.

Does LegitScript certification carry over to Microsoft Ads and Meta?

The certification itself is recognized by Google, Microsoft, Meta, TikTok, and others, but each platform runs its own approval. You still apply separately on each platform, and Microsoft adds its own preapproval step for pharmacy and telemedicine advertisers.

Can a telehealth brand run Performance Max under Google's healthcare policy?

Yes, if the brand holds the certifications its offer requires, and Performance Max is one of the campaign types eligible for Google's AI Mode healthcare test. The catch is control: you can't add advertiser-curated audience signals for health content, and the first AI Mode iteration excludes pinned assets and text disclaimers, which many regulated advertisers rely on.