Rules
Part of Healthcare Advertising Guide for Small Teams
Healthcare Advertising Checklist for 2027
Use this healthcare advertising checklist to document FDA, FTC, HIPAA, CMS, state, platform, accessibility, and release checks before campaigns go live.
What to take away
- Platform eligibility, legal review, claim support, accessibility, and service readiness are separate gates.
- Approve the rendered ad and complete destination for every live variant.
A healthcare advertising checklist should prevent release when a material fact, audience, control, or owner is missing. See healthcare advertising for context.
Copyable gate checklist, in release order:
- Scopeadvertiser, sponsor, offer, audience, markets, channels, dates, budget, and stop conditions.
- Eligibilityexact platform policy and version, account, domain, format, market, required certifications, and approval status.
- Claimsexact wording, claim-specific support, limits, risk information where applicable, reviewer, and expiry.
- Creativeevery rendered variant, required disclosures and important safety information, transcript, and alt text.
- Destinationmatching offer and current facts, accessible task, privacy review, and working response and adverse-event routes.
- Operationsstaffed capacity, access and spend controls, monitoring, correction owner, and stop procedure.
One dated change drives this edition. The Department of Justice's web accessibility rule for state and local government entities requires WCAG 2.1 Level AA. Compliance dates are April 24, 2026, for larger public entities and April 24, 2027, for smaller ones. Public health departments, Medicaid programs, and public hospitals are covered when operated by a state or local government entity subject to the rule.
Scope the campaign
- Name the advertiser, sponsor, offer, audience, jurisdictions, channels, and dates.
- Confirm product, service, professional, payer, research, privacy, and platform review routes.
- Record business objective, primary audience task, budget, capacity, and stop conditions.
- List every account, agency, vendor, feed, destination, call route, and follow-up.
Name the applicable legal route
- Prescription-drug advertisingroute review to the FDA's Office of Prescription Drug Promotion (OPDP). Check the indication, claim support, fair balance, important safety information, and limits on promoting unapproved uses. For applicable prescription-drug promotional labeling or advertising, confirm that Form FDA 2253 is submitted at initial dissemination or publication under 21 CFR 314.81(b)(3)(i), and retain the filing confirmation.
- Medicare Advantage and Part Dcheck current CMS marketing requirements in 42 CFR Parts 422 and 423, the plan contract, and the CMS Health Plan Management System (HPMS) submission or review process where required. Retain the submission and decision record.
- Medicaid managed carecheck 42 CFR 438.104 and the state Medicaid agency's contract and marketing review requirements.
- Clinician and service advertisingcheck each state's medical board or other relevant professional licensing board rules and applicable state advertising law. Record the jurisdiction and rule reviewed.
Mark each route applicable or not applicable, name its reviewer, and retain the authority or rule used. One approval does not replace the other applicable reviews.
Check platform eligibility
Google's current healthcare and medicines advertising policy describes prohibited, restricted, location-dependent, and certification-dependent categories across prescription services, drug terms, manufacturers, experimental treatments, clinical trials, addiction services, insurance, and other areas. Recheck the current page for every target market and format; platform eligibility does not replace applicable law.
Record healthcare certification
For restricted categories, complete the applicable Google Ads healthcare certification for the category and target location. Categories such as online pharmacies and addiction-treatment services may also require LegitScript certification. Verify the current requirements for each category and market, and retain the LegitScript certification and Google Ads certification or account decision that applies.
Platform eligibility decision
Is the category prohibited?
Do not run
Check restriction
Capture the policy version, exact account, domain, certification, and market, then test every automated combination. Capture format, audience, keyword, creative, and destination reviewed.
A status such as eligible, limited, rejected, or approved is a dated platform event, not a legal opinion or quality endorsement. Documenting each platform decision helps answer the common healthcare advertising questions that surface when approvals change.
Verify claims and disclosures
The FTC's .com Disclosures guidance addresses clear and conspicuous online disclosures and the relationship among claim, qualification, device, placement, proximity, prominence, and unavoidable viewing. It dates to 2013, so use its disclosure principles with current law, formats, technology, and qualified review.
The FTC's Health Products Compliance Guidance addresses health-related benefit and safety claims. Map each express and implied claim to competent and reliable scientific evidence appropriate to that claim, retain the supporting records, and document any limits on what the evidence establishes.
| Gate | Evidence to attach |
|---|---|
| Claim | Approved wording, exact support, limits, reviewer, and expiry |
| Audience | Fields, source, authority, exclusions, market, and explanation |
| Creative | Every rendered combination, transcript, alt text, and qualification |
| Destination | Current facts, accessible task, privacy, security, and response test |
| Operations | Capacity, access, spend cap, monitoring, correction, and exit owner |
Test release and failure paths
- View each format signed out on representative devices.
- Complete the task with keyboard and relevant assistive technology.
- Call every number and test after-hours and wrong-route behavior.
- Use an ineligible case and confirm a safe response.
- Trigger the campaign stop, account revocation, and correction process.
- Reconcile one platform event with the task's authoritative system.
The final approver should be able to identify the released claim, source, audience, market, spend, live copy, destination, owner, and stop control without asking the agency to reconstruct them. Store the approval and rendered evidence before launch.
Record the gate result
The W3C Privacy Principles statement gives shared privacy concepts and warns against shifting privacy work to individuals. Use it for the destination gate, then check the governing law and configuration.
Check HIPAA before using patient information
Before a campaign uses or discloses protected health information (PHI) for outreach, have the privacy reviewer determine whether the communication is marketing under the HIPAA Privacy Rule. HIPAA generally requires an individual's authorization for uses or disclosures of PHI for marketing, subject to exceptions; document the authorization or the specific exception relied on. If a vendor handles PHI on behalf of a covered entity or business associate, confirm the required business associate agreement and approved data use.
The CISA software acquisition fact sheet covers development practice, supply-chain exposure, deployment, and vulnerability management. Use those government-acquisition questions under the operations gate for vendor and feed exposure, not as local approval.
For every checklist item, record pass, fail, not applicable, or accepted exception. Add the evidence location, reviewer, decision date, and next review. A checked box without proof cannot protect a release. Stop the work when a mandatory privacy, security, data-quality, accessibility, or correction condition fails, even if the remaining score looks favorable.
Worked example of one gate entry, using placeholder wording. It is not a substantiated claim and must remain on hold until the evidence supports it:
- Claim"Most appointments within two business days."
- EvidenceAttach a dated scheduling-system report showing appointment availability for the relevant service and location. Record the measurement period, denominator, query or filters, and source owner; compare the report with the current destination page. The report must support both "most" and "two business days."
- ReviewerClinical lead and legal counsel; record their actual decisions after reviewing the evidence.
- Date2027-01-15.
- Next review2027-07-15, or sooner if the schedule changes.
- StatusFail until the required evidence is attached and substantiates the claim.
Common questions
Can one checklist cover every healthcare ad?
Use a common operating core, then add the product, service, jurisdiction, medium, data, and professional requirements that apply.
Is platform certification enough?
No. It establishes only the platform status and scope stated by that platform.
When should an ad be rechecked?
Recheck after material changes to evidence, offer, audience, rules, platform, creative, destination, capacity, or ownership.
