In June 2022, The Markup found Meta Pixel trackers sending patient data from 33 of the top 100 US hospitals straight to Facebook.
That included a "pregnancy termination" search term captured when a visitor clicked to schedule an appointment at University Hospitals Cleveland Medical Center, and medication names and dosages sent from Novant Health's site. Those 33 hospitals reported more than 26 million patient visits between them in 2020.
That's the risk sitting underneath every freelancer vs agency healthcare marketing decision. Whoever runs your campaigns also handles protected health information, whether they realize it or not, and that changes who you can safely hire.
Nobody installed those trackers to leak patient data on purpose. They were running ordinary marketing campaigns, the same conversion tracking any freelancer or agency sets up for a client in any other industry.
The compliance layer most freelancers can't offer
Under HIPAA, sharing protected health information with a marketing vendor requires a signed business associate agreement, or the data has to be stripped of anything identifying first.
Paubox has laid out which platforms will actually sign one: Google won't, for Analytics or Ads. Neither will Facebook or LinkedIn. Adobe only covers select products.
Run your ads from a personal Google account and there's no BAA to offer, because that account was never built to hold one. A shop that's already handled healthcare clients should know which platforms to avoid and how to structure tracking around the gap before it becomes a problem.
| Platform | Signs a BAA | What that means for you |
|---|---|---|
| Google Ads / Analytics | No | Keep PHI out of every tracked event |
| Meta (Facebook/Instagram) Ads | No | Same restriction covers Pixel and Conversions API data |
| LinkedIn Ads | No | Same restriction, including retargeting audiences |
| Adobe | Only on select products | Confirm per product before connecting patient data |
Freelancer vs Agency Healthcare Marketing in Practice
One person covering everything from ad copy to landing pages, at a lower monthly cost than a team: that's what a freelancer usually means, and it fits a single-location practice running one or two channels well.
It fits less well once you need someone who understands HIPAA and paid search at the same time. That combination is rarer, and harder to check from a portfolio alone.
Spread across a team, the same work looks different. One person owns compliance review, another runs the campaigns, a third reports on what worked. Our healthcare local SEO work shows what that looks like when compliance review happens inside the process rather than tacked on at the end.
What in-house adds to the bill
Photo by Tima Miroshnichenko on Pexels
Bringing marketing in-house looks cheapest on a job posting.
Business Initiative's breakdown of employee costs puts benefits, payroll taxes and overhead at roughly 30 to 50% on top of salary.
That gap doesn't show up on the job posting, only on the first quarter's payroll run. A $50,000 marketing hire runs closer to $72,000 once insurance and equipment are counted in.
That's before the practice has bought ad spend, licensed any software, or covered the gap while that one hire is out sick.
A practice running a single channel consistently can absorb it. One juggling paid search, local SEO and a site that has to load fast in a waiting room usually can't, with just one person.
Our work with OptimalMD and the healthcare growth stack we've built for other practices both rest on the same idea: compliance review has to sit inside the marketing process, not get bolted on afterward.
The digital marketing and growth team builds that in from the first campaign, whichever route you're weighing it against.
Cover photo by Tima Miroshnichenko on Pexels
