Here's the part most practices miss: in every one of those cases, the marketing itself was ordinary. Pixels on pages. Forms feeding a CRM. Retargeting audiences. The kind of setup a typical agency installs in week one without a second thought. The fines and deplatformings didn't happen because someone did exotic marketing — they happened because the plumbing underneath ordinary marketing routed patient data to companies that had no business receiving it.

So when you evaluate a "HIPAA-compliant marketing agency," you're really evaluating plumbing. Anyone can put "HIPAA-compliant" on a services page. The only way to separate agencies that have actually built for healthcare from agencies that discovered healthcare pays well is to ask specific, technical questions — and know what a good answer sounds like.

Here are the 12 questions we'd ask any agency, including us. This checklist is ungated; take it into your next sales call.

First, a note on the legal landscape in 2026

You'll hear some agencies claim the compliance question is moot because "the OCR guidance got thrown out." That's a half-truth, and how an agency handles this half-truth tells you a lot.

In June 2024, the U.S. District Court for the Northern District of Texas vacated a portion of OCR's web-tracking guidance — specifically, the position that an IP address combined with a visit to an unauthenticated health-related webpage automatically constitutes protected health information. That specific inference was struck down.

What did not change: HIPAA itself. If a tracking tool captures information that identifies a patient and relates to their care — a name in a form field, an appointment request, a phone number typed into a chat widget, a URL that reveals a patient relationship — disclosing it to a vendor without a BAA is still a violation. State privacy laws (Washington's My Health My Data, California, others) have meanwhile gotten stricter, and the FTC has been active against exactly this behavior — that's the Cerebral fact pattern. We cover the ruling in detail in our breakdown of what still applies after the vacatur.

An agency that cites the Texas ruling as "you don't need to worry anymore" has just failed the checklist before you asked question one.

The 12 questions

1. Will you sign a Business Associate Agreement — as the agency?

The baseline. If a marketing agency will create, receive, maintain, or transmit PHI on your behalf — and any agency handling your leads, call recordings, form submissions, or CRM does — HIPAA requires a BAA between you and them. Not just between you and the software they use. Them.

The right answer looks like: "Yes, here's our standard BAA," produced without a pause, a legal review, or an upcharge. Hesitation here means they've never been asked, which means their other healthcare clients are exposed too.

How PilotPractice answers it: We offer a BAA as a standard part of onboarding. It's listed on our public trust center at trust.pilotpractice.com, not negotiated ad hoc.

2. Do you have SOC 2, and can I see the evidence without an NDA-and-sales-call gauntlet?

A BAA is a promise. SOC 2 is an auditor checking whether the promise is operationalized: access controls, change management, vendor management, incident response. An agency that touches PHI but has never been audited is asking you to take its word for it.

The right answer looks like: SOC 2 plus a HIPAA attestation, with a live trust center where you can view the report, control status, and monitoring — ideally continuously verified rather than a once-a-year PDF.

How PilotPractice answers it: SOC 2 and HIPAA, with a Drata-backed trust center at trust.pilotpractice.com showing continuously monitored controls. You can check it before you ever talk to sales.

3. Can I see your subprocessor list?

Your data doesn't stop at the agency. It flows to their hosting, their CRM, their call tracking vendor, their email platform, their AI transcription tool. Every one of those is a subcontractor under HIPAA, and each needs its own BAA chain. An agency that can't name its subprocessors doesn't know where your patients' data goes — which means you don't either.

The right answer looks like: a published, current subprocessor list, with an update mechanism so you hear about new vendors before your data does.

How PilotPractice answers it: the subprocessor list is published on our trust center. No request form, no NDA.

4. When a patient submits a form on my website, exactly what path does the data take?

This is the single most revealing technical question, because the default answer in the industry is bad. The typical agency setup: a form plugin stores the submission in the website's database, emails a copy to the front desk, and fires a webhook or Zapier task to a general-purpose CRM — with marketing pixels watching the whole page. That's four or five disclosures, most of them to vendors without BAAs, and a copy of PHI sitting in a WordPress database that gets breached at commodity rates.

The right answer looks like: submissions travel server-to-server, authenticated, directly to a system built to hold PHI — and do not accumulate in the website database or in inboxes.

How PilotPractice answers it: form entries POST server-to-server from the site to app.pilotpractice.com with a per-site bearer token. Nothing rides in the browser where pixels can see it. Spam is filtered before it ever reaches the CRM. And passwords are structurally unstorable in our pipeline — blocked at ingest, stripped by the model layer, and retroactively scrubbed as a third net — because "we ask people not to type sensitive things" is not an architecture. Full detail in Is Gravity Forms HIPAA compliant?

5. What tracking scripts run on my site, and who controls them?

Most healthcare website violations are just this: a tag manager full of third-party pixels, each one shipping page URLs, click data, and form interactions to an ad platform. The URMC and Froedtert enforcement actions were tracking-technology cases.

The right answer looks like: one first-party script the agency controls end to end — not a GTM container that five people have edited and nobody has audited.

How PilotPractice answers it: a single first-party tracking script with an explicit allowlist for UTMs and click IDs. It stitches sessions with a hidden visitor ID, not a third-party cookie, and nothing on the page ships data to an ad platform directly. If you want to see what's currently running on your site, our 10-minute PHI leak self-audit walks you through checking.

6. How do you get conversion data to Google and Meta without giving them my patients?

Here's where "compliant" agencies usually go quiet, because the honest answer to "how do we optimize ads without pixels" requires real engineering. Ad platforms need conversion signals to optimize. They must never receive form contents, health conditions, or patient identity.

The right answer looks like: offline/server-side conversion uploads — the platform learns "this click converted," never who or why — with a retraction path when something is sent in error.

How PilotPractice answers it: conversions are uploaded to ad platforms as offline conversion events keyed to click IDs. Platforms get the event; they never get form contents. Retraction jobs exist for the failure case, because a compliance story with no undo button is a story about the first incident.

7. Do I have to give up Google Analytics?

The Paubox-style verdict blogs answer "GA4 isn't HIPAA compliant, remove it" and stop. True as far as it goes — Google won't sign a BAA for GA4 — but "fly blind" is not a marketing plan, and an agency whose whole compliance posture is subtraction will subtract your ability to measure anything.

The right answer looks like: a server-side forwarding layer that gives you GA4 reporting with the identifying data removed before Google ever sees it.

How PilotPractice answers it: we're building a HIPAA-safe GA4 Measurement Protocol forwarder into the platform — synthetic client IDs, a PII-scrub layer, and a whitelist of allowed parameters. The design lets you keep GA4 dashboards while Google never receives PHI. The full mechanics are in Is Google Analytics HIPAA compliant?

8. Where does my lead and call data live, and how is it protected at rest?

The agency's CRM is now a PHI repository. Ask about it like you'd ask a health-tech vendor: encryption, audit logging, access control.

The right answer looks like: field-level encryption on the records that hold patient data, an append-only audit log of who accessed what, and monitoring for anomalous access — not "it's in HubSpot, they're very big."

How PilotPractice answers it: leads, messages, calls, and files carry field-level encryption; PHI access is written to an append-only audit log; logins are watched for impossible travel and new devices; and insider-threat analytics score unusual PHI access patterns. This is the difference between a marketing tool that stores PHI and a system designed to.

9. Who on your team can see my patient data, and what happens when they leave?

BAAs bind organizations; breaches come from people. A 22-person agency where every account manager can export every client's lead list is a breach that hasn't been dated yet.

The right answer looks like: role-based access, per-client scoping, access logging (see question 8), and a documented offboarding process — all of which SOC 2 auditors actually test, which is another reason question 2 matters.

10. Have you ever been deplatformed, or had a client deplatformed, and what's the contingency?

The Klaviyo telehealth deplatformings proved that compliance risk isn't only fines — it's your email list going dark on a Tuesday because your vendor decided healthcare wasn't worth the risk. An agency running your patient communication through consumer-grade marketing platforms has this exposure whether they've admitted it to themselves or not.

The right answer looks like: patient communication running on infrastructure that was built for healthcare — where the vendor signing your BAA is the same vendor operating the sending — plus honest acknowledgment of the risk, not "that won't happen to us."

11. Who actually runs the marketing?

This is where the market splits into two camps that each solve half your problem:

• Compliance software vendors (Freshpaint is the best known) sell you a tracking layer. Genuinely useful — and then you still need someone to build the website, write the ads, manage the budget, answer the phones, and book the patients. The software doesn't run your marketing; it watches it.
• Healthcare agencies without a software layer (Cardinal and similar) will run your campaigns competently — on top of whatever off-the-shelf tools the industry uses, with the compliance characteristics described in questions 4 through 8.

The right answer looks like: one accountable party for both the compliance architecture and the campaign performance, so "the pixel leaked PHI" and "the ads underperformed" can't be pointed at each other.

How PilotPractice answers it: we're the agency and the platform. The tracking script, the forms pipeline, the CRM, and the people running your ads and SEO are one vendor under one BAA. HIPAA-compliant by default — and we actually run your marketing.

12. Show me, don't tell me: can you audit my current site right now?

The fastest way to grade an agency is to watch them look at your existing website. A serious healthcare agency can open your homepage and, within minutes, tell you which trackers are firing, what they're capturing, and what a regulator would see.

The right answer looks like: a concrete finding-by-finding walkthrough — "here's the Meta pixel firing on your contact-us thank-you page" — not a generic pitch deck. If they can't detect a PHI leak, they can't prevent one.

How PilotPractice answers it: run the self-audit yourself first, then ask us to verify what you found.

The scorecard

Ten or more strong answers: hire them. Fewer than that, and remember what URMC's $2.85 million actually bought — a lesson that the plumbing is the product.

The part after the checklist: someone still has to do the marketing

Compliance is the floor, not the strategy. The practices winning in 2026 are the ones whose compliant infrastructure enables aggressive marketing — full-funnel ad tracking via server-side conversions, GA4 reporting via a scrubbing forwarder, EHR-integrated online booking, automated follow-up — rather than a compliance posture that amounts to turning things off. That's the standard we build to across everything in the HIPAA-compliant marketing guide, and it's the same architecture we scale for multi-location groups, DSOs and MSOs.

If you'd rather ask us the 12 questions directly: book a demo. Bring the checklist — we built our answers before we published the questions.

Security documentation, SOC 2 report, BAA, and subprocessor list: trust.pilotpractice.com