BOLO Health Law, LLC | November 2, 2026 | Healthcare Transactions & Regulatory Compliance
A growing medical practice receives an attractive proposal: a marketing firm will send qualified patients, answer calls, manage online campaigns, and earn a fee each time a patient books an appointment. The pitch frames the arrangement as ordinary advertising. The marketing company may be excellent at its work, and the practice genuinely needs help reaching patients. But in healthcare, the compensation structure and the way patients are directed can matter just as much as the advertising itself.
Before signing, the practice should distinguish legitimate marketing services from an arrangement that could reward referrals or steering of federally reimbursable business. The analysis spans contract terms, the federal Anti-Kickback Statute (AKS), potential state law, HIPAA restrictions, advertising standards, and actual operational practice. Not every payment to a marketing company is prohibited. Equally, calling a payment an “advertising fee” does not make an otherwise problematic referral arrangement safe.
1. Start with the actual service, not the contract label
One vendor sells ordinary media placement, such as search ads targeted to a geographic area. A second operates the practice’s website, manages appointment requests, and gives staff a shared dashboard. A third controls a list of patients with specific clinical needs and directs those patients to whichever provider pays the highest amount. Those arrangements have materially different facts even if each vendor uses the phrase “patient acquisition.”
Map the entire path from advertising impression to patient scheduling and reimbursement. Who decides which provider is displayed? Does the vendor recommend treatment or steer a person based on clinical information? Is the vendor paid per impression, labor hour, campaign, appointment, qualified lead, completed service, or insurance claim? Who verifies the ad claims? Does the vendor obtain PHI or access the practice’s scheduling system?
A careful review looks at conduct and economics together. Pay particular attention when the firm says it has “relationships” with medical offices, nursing facilities, discharge planners, or other sources of patients whose services may be paid by Medicare, Medicaid, or another federal healthcare program.
2. Understand the federal Anti-Kickback Statute
The HHS Office of Inspector General’s fraud-and-abuse guidance explains that the AKS is a criminal statute prohibiting knowing and willful remuneration to induce or reward referrals or certain other business payable by federal healthcare programs. “Remuneration” means things of value, not just cash in an envelope. Free services, disguised discounts, excessive consulting fees, or other financial benefits can be relevant depending on their purpose and circumstances.
The statute is not a blanket prohibition on every marketing expense and does not classify every lead as a prohibited referral. The structure, intent, federal-program connection, and factual conduct all matter. But an explicit promise to pay a percentage of Medicare-derived collections for referred patients is a high-priority issue requiring legal analysis. The same is true of compensation that changes with the volume or value of business steered toward a provider.
A practice should not assume the risk disappears because the marketing company, rather than a physician, receives the fee. Nor does the word “independent contractor” resolve the question. A referral arrangement can implicate the statute even when its participants have ordinary business titles.
3. Do not confuse safe-harbor design with automatic legality
HHS-OIG publishes regulations describing arrangements that, when their conditions are fully satisfied, are protected under specific AKS safe harbors. The safe-harbor regulations include provisions for certain personal-services and management arrangements and other defined structures. Whether a particular arrangement fits any safe harbor requires element-by-element review.
Importantly, OIG’s current FAQ states two points that are often misstated: failing a safe harbor does not automatically make an arrangement illegal, but partial compliance does not provide partial safe-harbor protection. A transaction outside a safe harbor is assessed based on its particular facts, including intent.
For a marketing contract, ask whether compensation is set using an appropriate methodology, whether services are commercially reasonable and actually performed, and whether the arrangement’s economics track federal-program referrals in a problematic way. Fixed fees may make some issues easier to analyze, but a fixed fee is not a magic cure for sham services or improper referral intent.
4. Review per-lead, per-appointment, and percentage arrangements carefully
A marketing company might propose $150 per booked patient, 8 percent of collections, or a monthly retainer plus a success bonus. These formulas are not interchangeable. A fee contingent on the volume of patients or reimbursed business may raise different concerns from a reasonable, documented fee for a defined marketing campaign. The risk also changes based on whether the platform is a neutral advertiser or actively influences where a person obtains treatment.
Before accepting any performance formula, identify the payer mix, how “qualified” patients are counted, whether federal program beneficiaries are involved, what conduct generates payment, and whether the vendor controls referral decisions. Also inspect refunds, canceled appointments, minimum guarantees, exclusivity, and fees charged if the patient chooses another provider.
A useful stress test is to imagine the contract produced no booked patients for three months. Would the vendor still have delivered real and useful marketing work? Can the practice verify the work through invoices, ad-platform data, creative materials, and time records? Those records do not decide AKS compliance, but they help establish what the parties actually purchased.
5. HIPAA is a separate gate, not a substitute for AKS analysis
A vendor may need access to identifiable patients, referral notes, diagnoses, appointment schedules, or lists of people due for follow-up. For a HIPAA-covered practice, the Privacy Rule and business-associate framework control what information may be disclosed and how a contractor may use it. The HHS marketing guidance explains that PHI generally may not be used or disclosed for HIPAA-defined marketing without a valid authorization unless a regulatory exception applies.
The definition has important exceptions, including certain treatment and care-coordination communications and communications about the covered entity’s own health-related services. The precise content, purpose, and recipient matter. A paid list sale for a third party’s independent promotions stands in a very different position from an approved reminder about services at the patient’s own medical practice.
A business associate agreement may be required when a vendor performs authorized services involving PHI on the practice’s behalf, but a BAA does not legalize an otherwise prohibited disclosure or an otherwise unlawful financial referral arrangement. Do not treat a BAA as an all-purpose permission slip. Determine what data the vendor can receive, how it will secure those data, whether subcontractors are involved, and what happens after termination.
6. Avoid advertising claims that clinical staff cannot support
The practice remains concerned with the accuracy of statements made on its behalf. Ads should not promise outcomes, imply government endorsement, conceal material eligibility limits, or misrepresent provider credentials and treatment capabilities. A website built by a contractor can still create legal exposure for the advertised practice if its claims mislead patients.
Require preapproval of substantive claims, testimonials, payer statements, clinical before-and-after materials, and descriptions of licensure. Make the vendor maintain copies of live ads and associated landing pages. A dynamic ad changed by an optimization tool should not escape review merely because the initial copy received approval.
Lead-generation software can also create inaccurate attribution. A dashboard that marks every scheduled patient as “caused” by the campaign may count returning patients or people who independently selected the practice. Define conversion metrics honestly and audit them. This protects the financial relationship and improves operational decisions regardless of the legal risk.
7. Draft a contract that an investigator can understand
A defensible agreement describes the deliverables in concrete terms: campaign planning, search management, creative development, call handling, analytics, patient scheduling, compliance review, and reporting. State which party is responsible for content approvals and which may contact patients. Include ownership and return of accounts, phone numbers, websites, analytics data, and patient intake records; vendors should not be able to hold the practice’s identity hostage after termination.
The compensation section should explain what is paid, when it is earned, how expenses are approved, and what documentation supports the invoice. Add record-retention and audit rights proportionate to the arrangement. Where the vendor communicates directly with patients, define scripts, escalation rules, privacy procedures, nondiscrimination, complaint handling, and restrictions on inappropriate steering.
Require prompt disclosure of the vendor’s material subcontractors and potential conflicts. The practice should know if the marketing company also sells placement to a competing provider, performs a referral-selection function, or receives compensation from suppliers whose products the practice uses. Conflicts may not always invalidate a contract, but they affect the fairness and credibility of the patient’s choice.
8. Keep an operational firewall between marketing and clinical decisions
Clinical professionals should determine whether a service is appropriate for a patient. A marketing contractor should not be promising that every new inquiry needs a particular billable procedure, determining medical necessity, or altering records to justify payment. Establish a procedure for clinicians to reject inappropriate inquiries without financial penalties imposed by the marketing vendor.
Staff should be trained to recognize concerning requests: “send us the entire patient list,” “change your diagnosis language to improve conversion,” or “we can guarantee a Medicare patient stream.” Retain records of significant compliance questions, complaints, and corrective actions. If an arrangement begins behaving differently from its written contract, reassess the risk rather than relying on a prior legal review of language nobody follows.
For a multi-site practice, pay attention to state-specific rules on fee splitting, referral incentives, professional conduct, advertising, and corporate practice restrictions. The federal AKS analysis does not displace other state or professional requirements. A contracting system that only checks a federal safe harbor may miss substantial nonfederal exposure.
9. Run a five-part diligence review before signature
First, identify the actual marketing service and whether the vendor influences a patient’s selection of provider. Second, map the compensation and any federal-program business connection. Third, review the potential safe harbor and state-law considerations without assuming safe-harbor absence equals guilt. Fourth, map PHI, consent, business associate obligations, and advertising approval. Fifth, write an exit plan for patient data, accounts, phone numbers, and ongoing campaigns.
The goal is not to stop lawful marketing. It is to buy actual services at defensible terms while protecting patient choice and clinical judgment. A thorough agreement can support business growth without placing an invisible regulatory liability inside a routine monthly invoice.
BOLO Health Law advises medical practices, healthcare technology firms, and other regulated businesses on marketing and referral arrangements, contracting, and compliance controls. Explore healthcare transactions insights or request counsel before committing to a questionable fee model.
This article is general information, not an AKS safe-harbor opinion, HIPAA authorization, or legal advice for any particular arrangement. The law and analysis depend on services, payers, parties, compensation, and intent.