Addiction treatment marketing compliance involves federal and state law, platform policies and professional standards. Which obligations apply to you depends on the services you provide, your legal status, the information you handle, your payment arrangements and where you operate.
| Rule | Type of authority | Who it applies to | What it controls in your marketing | Enforced by |
|---|---|---|---|---|
| HIPAA Privacy and Security Rules | Federal law | Covered entities and their business associates | How protected health information is used, disclosed and secured in marketing tools | HHS Office for Civil Rights |
| 42 CFR Part 2 | Federal law | Qualifying federally assisted SUD programs, with some duties reaching others who receive protected records | Use and disclosure of patient records, including for fundraising | HHS Office for Civil Rights |
| EKRA, 18 U.S.C. 220 | Federal criminal law | People and organizations in covered remuneration arrangements, subject to conditions and exceptions | How agencies, call centers and lead sources are paid | US Department of Justice |
| Anti-Kickback Statute | Federal criminal law | Arrangements involving items or services payable by a federal health care program | Referral payments tied to federal program business | DOJ and HHS Office of Inspector General |
| FTC Act, and the Opioid Addiction Recovery Fraud Prevention Act | Federal law | Advertisers within the statute’s jurisdiction; OARFPA covers SUD treatment products and services | Outcome claims, who your ad says you are, how calls are answered | Federal Trade Commission |
| FTC Endorsement Guides | Agency interpretation | Advertisers using testimonials or reviews | Patient stories, reviews, influencer and staff endorsements | Federal Trade Commission |
| Google Ads addiction services policy | Platform condition | Advertisers promoting covered addiction services through Google Ads in the United States | Whether your ads are allowed to run at all | Google, with LegitScript certification |
| NAATP Code of Ethics | Membership code | NAATP members | Referral payments, transparency, use of patient identities | NAATP, through membership |
| State licensing and advertising statutes | State law | Providers and other people covered by the applicable state statute | Required disclosures, prohibited marketing conduct | Licensing agencies, public enforcement authorities and, where authorized, private plaintiffs |
Platform approvals and membership obligations are separate from legal requirements. Record which rules apply to you before you review the next campaign.
Patient privacy: HIPAA, 42 CFR Part 2, tracking, and call recording
For HIPAA, start with two questions: is your organization regulated, and is the information you collect or disclose protected health information? Only then does it make sense to ask whether a particular use or disclosure is permitted.
A provider is a HIPAA covered entity, in HHS’s wording, “only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.” Treating addiction does not by itself make you covered. 42 CFR Part 2 is a separate test, and “federally assisted” reaches well past grant funding: under 42 CFR 2.12(b) it covers participating in Medicare, registration to dispense controlled substances used in treating substance use disorders, and “the granting of tax exempt status to the program.” Confirm that your program and its records fall within Part 2, and which federal assistance criterion applies.
On 20 June 2024 a federal court vacated the part of HHS’s tracking guidance that treated an IP address plus a visit to a public health related page as enough to trigger HIPAA obligations. Public booking forms can still disclose protected health information. A cookie banner is not a HIPAA authorization, and a business associate agreement does not authorize an otherwise impermissible disclosure.
Permission is where this gets expensive. HIPAA generally requires an authorization to use or disclose protected health information for marketing, subject to limited exceptions. Part 2 consent is a separate question, and permission for treatment, payment and health care operations does not automatically authorize marketing. Part 2 also limits using records to fundraise unless the patient first gets “a clear and conspicuous opportunity to elect not to receive fundraising communications.” Its 2024 final rule carried a compliance date of 16 February 2026, now passed, and OCR opened a civil enforcement program that day with penalties aligned to HIPAA’s.
Before you switch on call recording, have the privacy or legal lead review the recording requirements that apply to you, plus vendor access, storage and retention. Recording a call and publishing a patient’s story are separate assessments with separate permissions.
Open your tag manager, your call tracking settings and your CRM integrations, list every vendor that receives form or call data, and establish for each one what it receives, what agreements are in place and what permissions the use requires.
Paying for referrals and leads: EKRA, the Anti-Kickback Statute, and patient brokering
Referral related compensation needs review under the laws that apply to the arrangement, including EKRA, the federal Anti-Kickback Statute and state patient brokering laws.
EKRA, at 18 U.S.C. 220, makes it an offense, with respect to services covered by a health care benefit program and in or affecting interstate or foreign commerce, to knowingly and willfully solicit, receive, pay or offer remuneration in return for referring a patient to, or inducing the use of, a recovery home, clinical treatment facility or laboratory. The penalty is a fine of not more than $200,000, imprisonment of not more than 10 years, or both, for each occurrence. Its exceptions, including payments to employees and contractors and properly disclosed discounts, each carry conditions, and the employment exception has limits tied to compensation that varies with referral volume, tests or billings. The federal Anti-Kickback Statute is a separate law, covering arrangements involving items or services payable by a federal health care program.
What you cannot safely conclude: that pay per lead is always illegal, that a flat monthly retainer makes an arrangement lawful, that employees are automatically exempt, or that disclosing a referral relationship cures a payment. Each depends on facts the statutes care about, which is why counsel needs to see the arrangement, not the label.
Collect the service description, fee formula, patient routing process and payer information for every agreement, and have counsel review new or changed arrangements before they take effect.
Our addiction treatment SEO work starts from the same map as this page. We are marketers, not your compliance counsel.
Let’s plan your strategySubstantiating claims and avoiding deceptive recruitment
Two FTC cases illustrate the risks of misleading advertising identities and deceptive call routing.
In June 2025 the FTC announced that Evoke Wellness and two executives agreed to pay $1.9 million to settle claims they misled people seeking treatment, under the FTC Act and the Opioid Addiction Recovery Fraud Prevention Act of 2018. The order bans those defendants from using rivals’ names in search engine ads and from impersonating other businesses. Later that month the FTC sued Mercury Marketing and others, alleging they “used Google search ads to prominently display the names of specific clinics” while routing the calls to a defendant call center, where telemarketers “typically posed as representatives of consumers’ searched-for clinics.” Those are the FTC’s allegations. The FTC case page lists stipulated orders involving some defendants under 24 September 2025 and 2 March 2026, and the page, last updated 2 March 2026, labels the case pending.
The Evoke order binds those defendants. It does not establish an industry wide prohibition on competitor keyword bidding.
Objective treatment claims need adequate support before you publish them. Testimonials cannot supply evidence the advertiser lacks. Under the FTC Endorsement Guides, if a story implies results people generally achieve, substantiate that implication or clearly disclose the supported generally expected results, and that disclosure does not cure an unsupported treatment claim underneath it. Privacy permission to publish someone’s story is a separate requirement again.
Write down, for every objective treatment claim on your site, what it measures, over what period, for which patients, and who can produce the underlying data. Anything you cannot answer comes down until you can.
Professional ethics: what NAATP and ASAM say about marketing
NAATP makes its Code of Ethics a condition of membership, so for members this is not optional. Assess its requirements separately from applicable law and from ASAM’s policy recommendations.
The Code prohibits patient brokering outright: no financial rewards, gifts or other remuneration for patient referrals, including through consulting contracts or fee splitting. On patient stories it is stricter than most marketers expect, permitting a patient’s identity to be used “only following the completion of treatment and only with the patient’s written informed consent,” and not at all during the engagement. NAATP’s Quality Assurance Guidebook adds that marketing should make the program’s actual corporate identity easily available and reflect clinical competence, location, staff and credentials accurately. One concrete application: do not present outpatient treatment with housing as licensed residential treatment.
ASAM is a different kind of source. Its advertising guideline applies to ads carried in ASAM’s own publications, and its 2024 policy addresses government strategies for ethical addiction treatment, including truthful advertising. Neither is a universal provider advertising code, and its 2018 statement on ethical promotion now carries a notice that it “is archived and no longer considered active ASAM policy.”
If you are a NAATP member, audit your referral agreements, patient stories and service descriptions against the Code.
State rules that catch people out
State requirements can include advertising disclosures, prohibitions on deceptive recruitment, patient brokering restrictions and confidentiality protections that sit alongside Part 2.
California is the clearest worked example. Health and Safety Code section 11831.12, added by SB 541, requires covered facilities to disclose their license number and expiration date. Their websites must clearly display “Licensed by the State Department of Health Care Services” and link to the department page containing those details. Advertising may disclose the details directly or use that wording and link. Certified programs have parallel certification requirements, and a facility holding both must meet both.
Check every state you advertise into, not just the one you sit in. Your licensing agency and attorney general are the places to look.
List every state you run ads into, then check disclosures, recruitment rules, brokering statutes and confidentiality law for each one before the next campaign goes live.
The minimum you need to run paid ads
Yes, Google requires certification, and it is two separate approvals, not one.
Google’s location specific requirements for the United States state that to advertise recovery oriented drug and alcohol addiction services “you must be certified as an addiction services provider by the LegitScript Certification program,” and that “Advertisers must also be certified with Google.” The services in scope are clinical treatment providers, recovery support services such as sober living and mutual help organizations, lead generators or referral agencies, and crisis hotlines. LegitScript generally excludes lead generation websites and organizations that route patients to providers for compensation, while some crisis hotlines operating through call centers can qualify, subject to its standards.
Certification does not establish compliance with privacy, advertising claim, referral payment or state law requirements. Check Google’s US policy and LegitScript’s current eligibility standards before you apply.
Before you budget for paid search, confirm which approvals you hold, which you need, and the name of the person responsible for keeping them current.
What to verify before you approve a campaign
Assign an owner to each check and keep the supporting evidence with the campaign approval. Seven things to have in hand:
- Applicability assessment. Which HIPAA and Part 2 duties apply, including obligations that follow records you receive, plus any other privacy requirements. Privacy lead
- Data flow and vendor review. What each tool receives, its permitted uses, the agreements and permissions required, and retention controls. Privacy lead + marketing
- Compensation review. Every agency, call center and lead contract, reviewed for services performed, payment formula, referral process and the conditions that apply. Legal
- Claim substantiation. Documented support for objective claims about outcomes, services, credentials and insurance participation. Clinical lead
- Patient story permissions. Privacy permissions confirmed, NAATP requirements met for members, and substantiation settled for anything the story claims. Clinical lead + marketing
- Required disclosures. Disclosures and links verified for each jurisdiction and each ad format. Marketing
- Advertising approvals. LegitScript and Google certifications current, with renewal dates. Marketing
Schedule quarterly reviews and repeat the relevant checks before any change to campaigns, vendors, data sharing, compensation or claims. Record the approval, and any unresolved issues, before launch.
Frequently asked questions
Why is addiction treatment marketing regulated?
These rules protect confidential patient information, address misleading treatment claims, and restrict improper referral payments. The requirements that apply depend on the provider, the records involved, the payment arrangement, and the jurisdiction. Platform certification and professional membership standards add separate obligations.
Can we pay an agency a fee for each admission?
Have counsel review the arrangement before agreeing to admission based fees. Relevant facts include the services performed, the source of referrals, the patients and payers involved, and how compensation is calculated. EKRA, the federal Anti-Kickback Statute, and state laws have different requirements and exceptions.
Do we need LegitScript certification to run Google Ads?
For covered addiction services in the United States, yes, and you also need Google’s own certification. They are separate approvals. Services that cannot qualify for LegitScript certification are not permitted to advertise under that policy.
Can we publish patient success stories?
Confirm applicable HIPAA, Part 2, and state privacy permissions before publication. NAATP members must also meet its post-treatment, written informed consent requirement for identifying patients. Substantiate the claims the story conveys and, where required, disclose supported generally expected results. A generic release does not establish all of these.
Does HIPAA apply to our website analytics?
It depends on HIPAA applicability and the information collected or disclosed. A visit to a public health information page does not automatically establish a HIPAA disclosure. Review the actual data sent from forms, portals and tracking tools, and assess Part 2 and state privacy requirements separately.
What changed for 42 CFR Part 2 in 2026?
16 February 2026 was the compliance deadline for the 2024 final rule and the start of OCR civil enforcement. Affected organizations should review consent forms, patient notices, breach procedures and vendor arrangements. Permission for treatment, payment and health care operations does not automatically authorize marketing.
Bring this checklist to your next marketing and compliance review. If you want a second pair of eyes on the marketing side of it, we work with addiction treatment programs on strategy and search.
Book a Free CallSources
Sources checked 13 October 2026. Primary documents are linked at the relevant claims: 18 U.S.C. 220; 42 CFR Part 2, including section 2.12; the HHS Office for Civil Rights bulletin on online tracking technologies and its June 2024 vacatur notice; the OCR press release of 13 February 2026; HHS guidance on covered entities; FTC press releases of 10 June 2025 and 24 June 2025 and the Mercury Marketing case record; the FTC Endorsement Guides at 16 CFR Part 255; the Google Ads addiction services policy and its United States location requirements; LegitScript’s certification standards; the NAATP Code of Ethics Version 3.1 and Quality Assurance Guidebook Section H; ASAM’s advertising guideline and public policy statements; and California Health and Safety Code section 11831.12.