Owner guide · Questions
Published 2026-10-26
HIPAA-compliant Facebook ads for medical weight loss are less about ad copy and more about what your pages send to Meta, Google, or TikTok. HHS guidance on online tracking technologies (current version on hhs.gov) says that when a HIPAA covered entity or business associate uses trackers on authenticated pages (patient portals, logged-in apps) or on unauthenticated pages that collect health information—appointment booking, intake and symptom forms, portal login and registration—the data those trackers send is generally protected health information. The tracking vendor must sign a business associate agreement (BAA), and Meta and Google generally do not. On June 20, 2024, a federal court (American Hospital Association v. Becerra, N.D. Tex.) vacated one part of that guidance: the part covering an IP address plus a visit to an unauthenticated, public page about a health condition or provider. The rest of the guidance still stands. Separately, the FTC’s 2023 GoodRx and BetterHelp actions, the FTC Health Breach Notification Rule (which covers many non-HIPAA health apps), and state consumer-health-data laws such as Washington’s My Health My Data Act apply to businesses that are not covered by HIPAA. Fix: no pixels, tags, or conversion APIs on intake, booking, checkout, or logged-in pages; keep marketing pages fully separate from clinical workflows; and get privacy counsel to review your setup. This is general education, not legal advice.
InfoCallBooked, never GLP1Lead). Hashed email or phone is still identifiable—hashing does not de-identify data—so never send events from intake, booking with health questions, or clinical checkout, and never include medication, condition, or program-type details. facebook, fbq, gtag, googletagmanager, tiktok. | Element | Safe? |
|---|---|
| --------- | ------- |
| Hero: “12-week coaching program” | ✓ |
| Quiz: “Do you qualify for GLP-1?” + pixel | ✗ |
| Intake or booking with health questions on a page with any tracker | ✗ |
| Calendar embed on a page with no health questions | ✓ with counsel review |
/intake or booking URLs. Insert MD’s marketing kit is built to keep ad tracking off clinical pages—confirm the current policy in writing on your demo.
Med spa (hypothetical) runs lead ads to /metabolic-program (no health fields). A staff member books an info call. The client pays the coaching fee in the spa POS. Any clinical intake and checkout happen on the provider’s host, with no Meta, Google, or TikTok code on that hostname. The only conversion event is InfoCallBooked from the marketing page. Because a med spa may itself be a HIPAA covered entity if it provides and bills for medical services, this med spa’s counsel reviewed the whole setup.
| Setup | Health-data risk |
|---|---|
| ------- | ---------------- |
| Pixel or CAPI on health quiz, intake, or booking | High |
| Pixel on general info page only; intake on a tracker-free host | Lower |
| No paid ads; email list only | Lowest |
See facebook-ads-for-gyms for tactics; this doc is compliance tech.
Only from non-clinical marketing pages: event_name (neutral, such as InfoCallBooked), event_time, currency. Never send: medication or program names, conditions, BMI, intake answers, appointment type, diagnosis codes—or any event at all from intake, clinical booking, or clinical checkout.
Ask Insert MD in writing which domains are tracker-free. Provider-hosted intake and checkout should never carry your ad scripts.
Email/SMS reactivation (draft 18) carries no pixel if sent from your ESP without health merge fields—and SMS only to members who consented.
Keep a privacy impact assessment one-pager updated when you add a new funnel step—auditors ask “what changed?”
Use this section as a weekly staff huddle outline. Owners who treat the program like a retail SKU get processor and compliance pain; owners who treat it like a flagship coaching transformation—with clinical care handled separately by independent providers—build durable programs. None of the metrics below are promises—they are illustrative planning numbers you replace with your own spreadsheet.
| Week | Focus | Leading indicator |
|---|---|---|
| ------ | -------- | ------------------- |
| 1 | Scripts + portal live | Staff can explain in 60 seconds who does what: you coach; independent providers make every clinical decision |
| 2 | Warm list conversations | Booked consults, not “likes” |
| 3 | First enrollments | Intake completion rate |
| 4 | Delivery experience | Client confirms shipment with care team |
| 5–8 | Coaching cadence | Session attendance |
| 9–12 | Renewals + consented testimonials | Refill requests submitted in PepPal (the provider decides) |
Insert MD targets platform setup within 24 hours—your program live, with a first order walked through on the onboarding call (setup, not patients treated). Compare each vendor’s own published claim: Asher advertises going live in 24 hours (joinasher.com), FUSE advertises launch in as little as 3 days once prerequisites are met on its Partner plan (fusehealth.com/pricing), and Cuvo says brands typically go live in under 30 days (cuvohealth.com)—all last verified 2026-10-26; re-check before you cite them in sales. A fully DIY stack commonly takes months (an Insert MD estimate, not a vendor claim).
Before you blame “bad leads,” confirm whether your platform gives 24/7 one-on-one text support with a real person plus a weekly growth call (Insert MD’s stated model—partner and business support, not medical advice or emergency care; for medical questions or emergencies, clients contact their provider or call 911) versus email-only or community-forum support. Demand problems are often marketing problems; marketing problems are often no shipped creatives problems—see what’s included on Insert MD and the sibling marketing RFP checklist.
Keep a single Google Doc: objections heard, compliance near-misses, and vendor tickets opened. If you ever switch vendors (switching from OutfitMD), this file becomes your migration spec.
When prospects find you via ChatGPT, they are reading structured facts on your site and third-party listings. Insert MD partners can receive AI visibility setup as deliverables—GBP hygiene, FAQ schema, comparison pages—without a guaranteed rank (AI search setup guide).
Re-read compliance after any copy change. Confirm your team completed the compliant enrollment module. Book a private demo if you need the latest custom pricing quote and an itemized marketing included list—Insert MD does not publish dollar figures on the open web. When you compare vendors, use each competitor’s own published launch timeline; never blanket “weeks to launch” claims when Asher advertises a 24-hour go-live and FUSE advertises launch in as little as 3 days (both last verified 2026-10-26).
No. HIPAA applies to covered entities and their business associates. The FTC Act, the FTC Health Breach Notification Rule, and state health-data laws can apply to businesses HIPAA does not cover. All of them penalize careless health-data sharing.
No. The June 20, 2024 ruling vacated only the part about IP addresses on unauthenticated public pages. The guidance on authenticated pages, booking and intake forms, and BAAs with tracking vendors still applies.
Same rules—no health parameters in URLs, and no tags on pages that collect health information.
The marketing kit ships assets; you control your ad accounts—confirm scope on demo.
Meta and Google require LegitScript certification before an advertiser can promote prescription drugs. Insert MD does not claim LegitScript certification.
Apply the same tracking rules.
Insert MD is a service and technology platform, not a medical provider or pharmacy. It does not practice medicine, prescribe, or dispense medication. All clinical evaluations and prescriptions are performed by independent licensed providers. Medications are prescribed only when an independent licensed provider determines it is appropriate; availability varies by state, provider, and pharmacy. Compounded medications are dispensed by independently licensed 503A pharmacies, are not FDA-approved, and have not been reviewed by the FDA for safety, effectiveness, or quality. Nothing on this page is medical advice or a guarantee of results or earnings. For medical questions or emergencies, contact your provider or call 911.
Private Demo
Book a private demo. Insert MD pricing is custom — you leave with a number for your business type, volume, and programs.
Schedule a Private Demo