Healthcare marketing agencies mostly sell strategy — Cardinal and Healthcare Success will build you a smart media plan. What a platform company actually needs from its marketing vendor is closer to what it demands from its EHR vendor: security attestations, a BAA, audit logs, and a repeatable deployment model that works at add-on #2 and add-on #22. This article covers that layer.

What "infrastructure" means when the buyer is an operating partner

Three requirements separate roll-up marketing from practice marketing:

1. Diligence-grade vendor posture. Your marketing vendor will appear in your next diligence — at the recap, the continuation fund, or the exit. "Our agency is HIPAA-compliant, trust us" doesn't survive a data room. SOC 2 plus HIPAA attestation, a live trust center, a signed BAA, and a published subprocessor list do.
2. Repeatable deployment. A platform that adds four practices a quarter can't run marketing integration as a bespoke project each time. It needs a templated rollout with go-live gates.
3. Audit-grade data handling. Patient-adjacent data flows through marketing systems — leads, calls, messages, booking details. In a roll-up, so do employees who joined last month from an acquired practice. The infrastructure has to assume both external attackers and internal misuse.

The vendor-posture layer: what to demand, and what we show

Put your marketing vendor through the same screen you'd put a clinical software vendor through. The concrete artifacts:

One structural question belongs on the same screen: does the vendor own its stack, or resell someone else's? Many healthcare agencies resell Freshpaint for HIPAA-safe tracking — which means you pay the agency's fee plus a Freshpaint subscription, and you hold two BAAs and two subprocessor lists for one function. Every resold tool is a vendor your diligence has to chase and a contract that can churn independently of your agency relationship. An owned platform is one vendor, one BAA, one trust center — a materially shorter row in your own data room.

If a vendor can't produce these in a week, they can't produce them in your data room either. The full 12-question screen is in The HIPAA-Compliant Marketing Agency Checklist.

The data layer: encryption and audit trails as a feature, not a promise

Roll-ups concentrate risk: one platform, many practices, many newly-onboarded staff. The controls that matter are the boring, structural ones:

• Field-level encryption on the records marketing actually touches — leads, messages, calls, files. Not "encrypted at rest" as a disk-level checkbox, but per-field encryption on the models that hold patient-adjacent data.
• Append-only audit logging. Every access to protected records lands in an audit log that can't be edited after the fact. When a payer, a plaintiff, or your own compliance officer asks "who viewed this patient's messages in March," the answer is a query, not an investigation.
• PHI-access monitoring and insider-threat analytics. Access patterns are scored continuously — the employee from the practice you acquired in Q2 who starts pulling records outside their location's scope is a detection, not a surprise.
• Login forensics. Impossible-travel and new-device detection on every account. In a roll-up, credential sprawl is the default; the platform has to compensate.

This is the difference between a marketing vendor that says HIPAA and one whose architecture would survive an OCR desk audit. It's also, bluntly, an exit asset: "all patient-adjacent marketing data is encrypted, access-logged, and monitored across all N locations" is a sentence your bankers get to write.

The 100-day marketing plan for a platform (and every add-on after it)

Days 0–14 — Inventory and triage. Run marketing diligence findings to ground truth: crawl every acquired domain for trackers, locate every form's destination, confirm ownership of domains, GBPs, and ad accounts. Kill URMC-class exposures (pixels on patient-facing flows) immediately — this is the one action that shouldn't wait for a plan. The pre-close version of this is the Marketing Due Diligence Checklist for Healthcare Acquirers.

Days 15–45 — Consolidate onto the platform stack. One tracker architecture, one form pipeline, one booking layer, one reporting definition of "booked appointment," deployed practice by practice from a template. Consolidation is also vendor-count reduction: every point tool you retire (the call-tracking vendor without a BAA, the chat widget nobody vetted) is a subprocessor you no longer have to explain.

Days 46–75 — Standardize measurement. Per-location attribution live at every practice, so the board deck's marketing slide is built on one definition, one pipeline, and numbers a CFO can reconcile. The capital-allocation input is location-level CAC per kept appointment — the patient sat in the chair, per the practice system — not cost per booked. Booked-appointment CAC flatters every location with a no-show problem, and in a roll-up the no-show rate varies wildly by acquired practice; measuring to kept is how you find out that location #9's "cheap" leads are actually the portfolio's most expensive patients.

Days 76–100 — Template the add-on motion. Freeze the integration playbook: audit checklist, standard configs, go-live gates, owner per step. From here, an add-on's marketing integration is a two-to-four-week templated sequence, not a project. The detailed playbook is Standardizing HIPAA-Compliant Marketing Across an Acquired Portfolio.

Rebrands and domain consolidations get sequenced after stabilization, each as its own controlled migration — see Post-Acquisition Brand & Domain Migration Without Losing Rankings. A same-quarter rebrand-plus-replatform is how roll-ups lose their organic patient volume for a year.

What the operating partner should measure

Infrastructure exists to make four numbers trustworthy across the whole portfolio:

1. CAC per kept appointment, per location, per channel — kept in the practice system, not booked, and certainly not a form fill. A closed loop that stops at "booked" hides no-shows, and no-shows are where acquired practices differ most.
2. Marketing-sourced revenue per location — attribution stitched from click to appointment inside a BAA-covered platform.
3. Compliance surface — count of non-allowlisted trackers across all portfolio domains (target: zero, verified by scan, continuously).
4. Integration velocity — days from close to marketing-live for each add-on (target: a number, trending down).

Note the pairing: #1 and #2 are growth numbers, #3 and #4 are risk and execution numbers, and all four come out of the same infrastructure. That's the tell that the layer is real — when the compliance metric and the CAC metric are produced by the same pipeline, neither can quietly drift while the other looks healthy.

If your current agency can't produce #1 and #3, you don't have a marketing vendor problem — you have a marketing infrastructure gap.

Why "kept" is the only CAC denominator that survives an IC meeting

Walk the funnel math for one location. Say a channel produces 100 leads at $60 each: $6,000 in spend. Forty of those book, so cost per booked appointment is $150 — a number most agency dashboards would present proudly. Now apply that location's 30% no-show rate: 28 patients actually arrive. Real CAC per kept appointment is $214 — 43% worse than the reported figure, and worse still if you cared about new-patient kept appointments only. Multiply the distortion across a portfolio where no-show rates range from 8% at your mature flagship to 35% at last quarter's add-on, and cost-per-booked doesn't just overstate performance — it misranks locations, which means it misallocates the next quarter's budget.

Getting to a kept-appointment denominator is precisely why the loop has to close in the practice system rather than on a thank-you page: the booking widget writes into the EHR/PMS, and the appointment's terminal status — kept, no-show, cancelled — flows back into attribution. Marketing-mix models and platform-reported conversions can't see any of that; they stop at the click or, at best, the booking. The kept number is also the one that reconciles: your CFO can tie it to production reports, which is exactly the property you want in the metric your bankers will eventually restate.

The economics of owning vs. renting the stack

The Freshpaint-resale pattern generalizes. An orchestration agency typically sits on top of rented components: tracking (Freshpaint), call tracking (CallRail), scheduling (a booking SaaS), chat (a third widget) — each with its own subscription the portfolio pays, its own BAA, its own subprocessor list, and its own renewal cycle that doesn't align with your agency contract. At recap time, that's five vendor files instead of one, and a marketing capability that partially evaporates if any single subscription lapses. Consolidating onto an owned platform isn't only a cost play (though eliminating pass-through subscriptions at N locations is real money); it's a diligence play. One vendor, one BAA, one trust center, one line in the data room.

The MSO/PE vendor screen, condensed

Before signing or renewing any marketing vendor across the portfolio, get yes-with-evidence on all nine:

1. SOC 2 report available under NDA?
2. HIPAA attestation and signed BAA?
3. Live trust center and subprocessor list?
4. Field-level encryption and append-only audit logs on patient-adjacent records?
5. Access monitoring (insider analytics, impossible-travel detection)?
6. Templated per-location deployment with documented go-live gates?
7. Attribution that reaches kept appointments (no-show-aware, closed in the practice system) without sending PHI to ad platforms?
8. Owned tracking stack — or a resold Freshpaint subscription that doubles your fees and your BAA count?
9. Clean exit terms — you own domains, ad accounts, GBPs, and data?

Actually doing the marketing

Once the infrastructure exists, the marketing itself follows the multi-location playbook: local search per location, GBP as a managed channel, service-line pages that rank, budget rebalanced monthly by per-location CAC per kept appointment. It's covered in depth in Multi-Location Practice Marketing and the enterprise pillar — and every piece of it runs HIPAA-compliant by default, per the HIPAA-Compliant Marketing guide.

You can assemble this from point vendors and hope the subprocessor list stays defensible. Or you can run it on one platform with one BAA, one trust center, and one team that also does the marketing. PilotPractice is built for exactly this buyer: SOC 2 + HIPAA, Drata-backed trust center, encrypted and audit-logged data handling, and a templated add-on rollout your ops team can put in the IC memo. Book a demo — bring your platform's location list and your next add-on's LOI timeline.