Marketing Telehealth Without Regulatory Risk: FTC, HIPAA, Kickbacks and Board Rules

Telehealth brands grow through ads, social media, influencers and reviews. Each of those channels has rules, and a claim that would be harmless for a consumer product can be a problem when it is about medical care. This guide covers the main federal rules and the state layer on top, and ends with a review process you can put in place.

Truthful, substantiated claims

Section 5 of the FTC Act, 15 U.S.C. 45, prohibits unfair or deceptive acts or practices, which includes deceptive advertising. For health-related products, the FTC's Health Products Compliance Guidance sets the substantiation standard as "competent and reliable scientific evidence." For telehealth that means:

• Outcome claims need evidence. Weight lost, hormones balanced, results in a set time: if you say it, be able to prove it is true for the people you say it applies to.
• No guarantees. Medical results vary, and a guarantee implies they do not.
• Disclose what matters. If eligibility depends on a clinical assessment, if a prescription is not assured, or if the price excludes medication or labs, say so plainly and near the claim.
• Credentials must be accurate. Clinician titles, specialties and board certifications in ads and directories must match reality.

Write prescription access carefully. A patient receives a prescription only when a licensed clinician decides it is clinically appropriate and permitted, so ads should not promise one.

Reviews and testimonials: the FTC's 2024 rule

The FTC's rule on consumer reviews and testimonials, 16 CFR Part 465 (89 FR 68077, August 22, 2024), makes specific practices unfair or deceptive, including:

• Fake reviews and testimonials (465.2): writing, creating or selling reviews or testimonials that misrepresent that the reviewer exists, that they used the service, or what their experience was, and buying or disseminating ones the business knew or should have known were false.
• Paying for sentiment (465.4): giving compensation or other incentives in exchange for, or conditioned on, reviews expressing a particular sentiment, positive or negative.
• Insider reviews (465.5): reviews or testimonials by officers or managers, and testimonials by employees or agents, that do not clearly disclose their relationship to the business when that relationship is not otherwise clear.
• Company-controlled review sites (465.6): misrepresenting a website or organization you control as providing independent reviews or opinions.
• Review suppression (465.7): using unfounded legal threats, intimidation or false accusations to stop or remove reviews, or implying that the reviews you display are all or most of the reviews submitted when you are withholding some based on their rating or negative sentiment.
• Fake social influence (465.8): buying or selling fake followers or views.

You can still ask every patient for honest feedback. What you cannot do is pay for positive reviews or hide the negative ones.

Endorsements and influencers

The FTC's Endorsement Guides, 16 CFR Part 255, apply to influencers, affiliates, ambassadors and employees who promote your service.

• Disclose material connections. Under section 255.5, a connection that "might materially affect the weight or credibility of the endorsement" and that the audience would not expect "must be disclosed clearly and conspicuously." Payment, free or discounted services, and family or business relationships all count.
• Typical results. Under section 255.2, an endorsement about a key attribute will likely be read as representing what people generally achieve. If you cannot substantiate that, the ad should clearly and conspicuously disclose the generally expected results, and you must be able to substantiate that disclosure.
• You are responsible. Review sponsored content before it runs and keep records of what each influencer was told.

HIPAA: marketing and patient stories

If your practice is a HIPAA covered entity, the Privacy Rule limits how patient information is used in marketing.

• What counts as marketing. Under 45 CFR 164.501, marketing is "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service," with exceptions such as refill reminders and certain treatment and operations communications (unless a third party pays for them).
• Authorization is required. Under 45 CFR 164.508(a)(3), a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," except face-to-face communications and promotional gifts of nominal value. If a third party pays for the communication, the authorization must say so.
• Patient stories. A testimonial, photo or case story that identifies a patient uses their health information. Get a written HIPAA authorization that says exactly what will be used and where.
• Vendors. Marketing agencies, analytics providers and other vendors that handle patient information on your behalf need a business associate agreement, and should only get what they need.

State privacy laws can apply even where HIPAA does not, especially to consumer health data collected through websites and apps.

Kickbacks and referral payments

The federal Anti-Kickback Statute, 42 U.S.C. 1320a-7b(b) makes it a crime to knowingly and willfully offer, pay, solicit or receive remuneration to induce or reward referrals of items or services payable by a federal health care program. Many telehealth programs are cash-pay, but if any part of your business touches Medicare, Medicaid or another federal program, these questions matter:

• Per-patient or per-lead payments to marketers, affiliates or influencers tied to the volume or value of federal program business.
• Free or discounted services offered to federal program beneficiaries to win their business.
• Payments to clinicians or referral sources that are not for real work at a fair price.

Many states have their own anti-kickback, fee-splitting and patient-brokering laws, and some apply to cash-pay care as well. Check the laws of each state you market in before paying anyone per lead or per patient.

State boards regulate advertising too

State medical and professional boards regulate how licensees advertise. California is a clear example. Business and Professions Code section 651 makes it unlawful for a licensee to disseminate any public communication "containing a false, fraudulent, misleading, or deceptive statement, claim, or image" to induce professional services. It specifically includes statements that create "false or unjustified expectations of favorable results," including any photograph or image that does not accurately depict the results of the procedure or that has been altered.

For aesthetic and wellness brands, that rules out retouched before-and-after photos and selective results presented as typical. Other states have their own rules. Because the clinicians' licenses are at stake, board advertising rules effectively apply to the brand that markets their services.

In corporate practice of medicine states, marketing should also make clear that clinical services are provided by licensed clinicians through the medical practice, not by the brand or management company itself.

A compliance-first review process

1. Write a claims file. For every outcome or speed claim, keep the evidence that supports it.
2. Review before publishing. Have someone who knows these rules review ads, landing pages, emails, scripts and influencer briefs before they go live. Clinical claims should also be checked by a clinician.
3. Run reviews honestly. Ask all patients, do not pay for sentiment, do not suppress negatives, and do not post reviews from staff without disclosure.
4. Manage influencers. Use written agreements that require disclosure, prohibit unsupported claims and give you approval rights.
5. Get authorizations. No patient story, photo or name without a written HIPAA authorization.
6. Check your vendor contracts. Business associate agreements where needed, and no compensation structures that pay per federal program referral.
7. Train your team on these rules at least once a year and whenever you launch a new channel.

Scope your program with TrueEval

TrueEval is a licensed medical group and physician network that provides the clinical side of telehealth programs in all 50 states plus DC. If you are planning a launch and want the clinical model settled before the marketing goes out, scope your program with us.