The fix isn't a memo. It's a standardization program: one architecture, deployed practice by practice, with go-live gates and verification at every phase. This is the playbook — every phase maps to a specific control, so by the end you have not just compliance but a provable compliance posture.

The standardization map: risk surface → standard control

Print this table. It's the whole program in one view; the phases below are just the order you deploy the rows in.

Phase 0 (Days 1–7): Audit — trust nothing, crawl everything

For each acquired property:

1. Crawl every page for third-party scripts. Categorize: ad pixels, analytics, session recorders, chat widgets, embedded schedulers. Anything on an appointment, contact, or condition page is priority-zero. (Self-serve version: Does Your Practice Website Leak PHI?.)
2. Trace every form to its destination. "The website database" and "the office manager's inbox" are both findings.
3. Inventory access: domain registrar, DNS, hosting, CMS admin, GBP, ad accounts, analytics, phone/SMS vendors. Note everything held by a departing agency or the seller personally.
4. List every marketing vendor and check for BAAs. No BAA + patient data = a disclosure happening daily.

Ideally this ran before close — that version is the Marketing Due Diligence Checklist for Healthcare Acquirers. Post-close, it's triage.

Phase 1 (Days 7–21): Tracking teardown and replacement

The tracker layer goes first because it's the active, ongoing exposure — every day the old pixels stay up is another day of disclosures.

• Remove every non-allowlisted third-party script from every page. No exceptions for "but that's how we measure ads" — measurement is replaced, not deleted.
• Deploy the standard first-party tracker: it captures allowlisted campaign parameters and a hidden visitor ID, and nothing a patient types.
• Re-point conversion measurement to offline conversion uploads: the platform stitches click → lead → booked appointment internally, then feeds ad platforms the bare conversion event. Rankings intact, optimization intact, PHI never leaves.
• Replace raw GA4 with a scrubbing forwarding layer (synthetic client ID, PII scrub, whitelisted params — the design we're building into the platform) so leadership keeps its dashboards. Details: Is Google Analytics HIPAA Compliant?

Gate: a fresh crawl of every page shows zero unapproved third-party requests. Screenshot it; that's your day-21 evidence artifact.

Phase 2 (Days 14–30): Forms

Overlapping with Phase 1: every form on every site moves to the server-to-server pipeline — submissions POST directly to the platform with a per-site token, spam is filtered before it ever reaches the CRM, and password-type fields are structurally impossible to store (blocked at ingest, stripped at the model, scrubbed retroactively). Then purge historical submissions from the web databases they've been sitting in.

Gate: test submission on every form lands in the CRM; web database contains no form entries table with patient data.

Phase 3 (Days 21–45): Website hardening

Acquired sites are soft targets, and a hacked practice site is a breach with a press cycle. Standardize the fleet: fail-closed two-factor on every admin, nightly allow-list malware scanning (allow-listing catches attacker-added "legitimate" files that signature scanners bless), off-site cloud backups, fleet-wide bot protection with monitored rollout, and noindexing on anything patient-adjacent (galleries, portals). Full architecture: How We Build HIPAA-Compliant WordPress Sites.

Gate: every site passes the hardening checklist; backups verified restorable.

Phase 4 (Days 30–60): Booking

Replace whatever mix of Calendly links, PDF forms, and "call us" the portfolio arrived with. The standard: an EHR-integrated booking widget, iframed off the website so patient intake never touches the web stack, configured per location (providers, appointment types, DOB rules, timezone verified at every layer, slot QA before go-live), with patient notifications silenced before any first historical sync. The location-by-location sequence is in Rolling Out EHR-Integrated Online Booking Across a Group.

Gate: test booking reaches each location's EHR; slots render sane in local time.

Phase 5 (Days 45–75): Messaging and AI

• Register SMS properly: brand and campaign 10DLC registration (automatable), per-message compliance checking, opt-out enforcement, and consent capture built into booking flows. Ad-hoc texting from unregistered numbers gets filtered by carriers anyway — compliance and deliverability are the same project here.
• Inventory and either kill or cage every AI experiment the acquired practices were running. Caged means: guard layers on outbound messages, fail-closed egress, hard automated-reply caps with human handoff, per-agent permissions, and a compliance log. See HIPAA-Compliant Marketing Automation.

Gate: all outbound texting flows through registered, checked channels; no ungoverned AI touches patients.

Phase 6 (Days 60–90): Governance — make it stay standardized

Standardization decays without enforcement. Institutionalize:

• Continuous tracker scanning across all portfolio domains — drift becomes an alert, not an annual audit finding.
• One data platform with field-level encryption, append-only audit logs, and access-anomaly monitoring, so "who saw what" is always answerable.
• Vendor paper on file: BAAs, the SOC 2 report, the live trust center link, the subprocessor list — the data-room folder that makes your next transaction faster. (This is the whole thesis of MSO & PE Roll-Up Marketing Infrastructure.)
• The add-on template: freeze phases 0–5 as the standing playbook, with named owners and gate evidence, so the next acquisition is a schedule, not a scramble.

Rebrands and domain consolidations run after all of this, as separate controlled migrations — see Post-Acquisition Brand & Domain Migration Without Losing Rankings.

Day-1 vs. day-90, honestly

Day 1: N websites, unknown trackers, forms landing everywhere, schedulers without BAAs, texting from personal cells, and liability you can't even enumerate. Day 90: one architecture everywhere, evidence artifacts for every gate, per-location attribution actually working, and a marketing operation that makes the next acquisition cheaper to integrate. The standardization program pays for itself twice — once in removed risk, once in the growth engine it leaves behind.

Actually doing the marketing

Standardized infrastructure is what makes portfolio marketing work: local search per location, managed GBPs, service-line pages, and monthly budget shifts toward the locations with the best cost per booked appointment — measurable because the tracking layer is one system. The playbook is in Multi-Location Practice Marketing and the enterprise pillar, all on the compliance foundation of the HIPAA-Compliant Marketing guide.

Or skip the build: PilotPractice is this standard — the tracker, forms pipeline, hardened sites, EHR-integrated booking, compliant messaging, caged AI, and the team that runs the marketing on top, under one BAA with a live trust center. Book a demo and bring your gnarliest acquired site; we'll run Phase 0 on it during the call.