Operations
Part of Healthcare Marketing Compliance Guide for Clinics
Healthcare Marketing Compliance Checklist
A healthcare marketing compliance checklist for privacy, claims, consent, email, accessibility, vendors, approvals, and release testing.
What to take away
- Every checked item needs an owner, evidence, date, and material scope.
- Approve accessible rendered output and the complete destination, not only source copy.
- Test stop, revocation, correction, and vendor-exit paths before launch.
- Record pass, fail, not applicable, or accepted exception for every item, with evidence location, reviewer, decision date, and next review.
- Stop the work when a mandatory privacy, security, data-quality, accessibility, or correction condition fails, even if the remaining score looks favorable.
- Print or save this page as the working checklist.
Use this healthcare marketing compliance checklist to stop release when a material fact, authority, control, or record is missing. The healthcare marketing compliance review should mark an item not applicable only with a reason and qualified owner.
Scope and authority
- Name the entity, sponsor, offer, audience, exclusions, jurisdictions, channels, dates, and next action.
- Identify current legal, regulatory, professional, payer, product, data, accessibility, and platform review routes.
- Record decision rights, escalations, conflicts, and unresolved limits.
- Confirm current service capacity, location, language, access, and response routes.
US legal and regulatory anchors
| Rule | Core citation | What it covers |
|---|---|---|
| HIPAA Privacy, Security, Breach | 45 CFR Parts 160 and 164 | Protected health information use, disclosure, safeguards, breach notice |
| FTC truth-in-advertising | FTC Act Section 5, 15 U.S.C. 45 | Deceptive or unfair claims, including health claims |
| FDA OPDP | 21 CFR Part 202 | Prescription drug promotional labeling and advertising |
| TCPA and CAN-SPAM | 47 U.S.C. 227; 15 U.S.C. 7701 | Calls, texts, and commercial email consent and opt-out |
State and provincial rules add duties. California's Confidentiality of Medical Information Act and Washington's My Health My Data Act restrict use of health data. Ontario's PHIPA governs personal health information. Canada's PIPEDA and CASL apply to commercial electronic messages. Check the current text of each rule and any state or provincial amendment before you rely on this table.
US campaign compliance checks
HIPAA privacy and vendor controls
- Determine whether the campaign uses or discloses protected health information (PHI) for marketing. Obtain a valid written HIPAA marketing authorization before the use or disclosure unless an exception applies; check the required elements in 45 CFR 164.508(c).
- Confirm that treatment, payment, or enrollment is not improperly conditioned on an authorization, and document any applicable exception under 45 CFR 164.508.
- If a vendor is a business associate, execute a Business Associate Agreement (BAA) under 45 CFR 164.504(e) before it handles PHI. Check that any applicable subcontractor has the required agreement, too.
- Check the Notice of Privacy Practices (NPP) under 45 CFR 164.520 for accurate privacy practices and provide it as required.
- For a breach of unsecured PHI, follow the HIPAA Breach Notification Rule in 45 CFR 164.400–414. Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, and determine whether notice to HHS or the media is also required.
Claims, referrals, and prescription drug promotion
- Apply the FTC’s Health Products Compliance Guidance to express and implied health claims. Substantiate claims before publication with competent and reliable scientific evidence appropriate to the claim, and review the overall impression, including images, testimonials, and omissions.
- Review compensation, referral, and patient-inducement arrangements under the Federal Anti-Kickback Statute, the Physician Self-Referral Law (Stark Law), and applicable beneficiary-inducement rules.
- For prescription drug advertising, check FDA fair-balance requirements under 21 CFR Part 202. When a submission is required, submit the applicable advertising and promotional labeling to FDA on Form FDA 2253 at initial dissemination or publication.
- Set a documented route for product complaints and adverse events received through a campaign to reach the responsible manufacturer or regulatory function, consistent with applicable FDA reporting duties.
Calls, texts, and commercial email
- For telemarketing calls or texts, obtain and retain prior express written consent when required by the TCPA and FCC rules. Keep the consent language and evidence tied to the seller, purpose, and contact method.
- Provide a working way to revoke consent, honor revocations, maintain an internal do-not-call suppression list, and check the National Do Not Call Registry where applicable. Verify applicable calling-hour restrictions before launch.
- For commercial email, comply with CAN-SPAMuse accurate header information and a nondeceptive subject line, identify the message as an advertisement when required, include a valid physical postal address and clear opt-out method, and honor opt-outs within 10 business days.
Platform and accessibility checks
- For Google placements, check the Google Ads Healthcare and medicines policy. For Meta placements, check Meta Advertising Standards and the requirements applicable to health-related ads. Record the policy version or review date and the campaign-specific decision.
- Identify the applicable accessibility standard. For web content, check the relevant Web Content Accessibility Guidelines (WCAG) success criteria; for covered federal information and communications technology, check the Revised Section 508 Standards.
- Test meaningful images for text alternatives, prerecorded video for captions, pages and forms for keyboard access and visible focus, form fields for labels and instructions, and text and controls for adequate contrast. Test the delivered page and documents, not just source files.
Accessibility and delivered format testing
Section508.gov provides a prepublication checklist for web content covering native accessibility checks, HTML testing, document formats, color contrast, continued scanning, and manual testing where possible.
It is federal Section 508 guidance. Determine the accessibility standards and legal duties that apply to the actual organization and audience. A healthcare content marketing checklist keeps those accessibility checks attached to each delivered format.
- List every express and implied material claim.
- Attach exact support, scope, limitations, reviewer, approval, and expiration.
- Review every headline, image, demonstration, chart, audio track, endorsement, and disclosure.
- Test each rendered format and destination with relevant devices and access needs.
- Preserve approved and delivered copies with dates, placements, and versions.
Data, vendors, and product-specific submissions
FDA's OPDP eCTD resource page explains the electronic-submission guidance and supporting materials for promotional labeling and advertising submissions within its stated human prescription-drug scope. Do not treat that submission process as a requirement, review, or approval for unrelated healthcare campaigns.
| Gate | Evidence to attach |
|---|---|
| Audience | Fields, source, authority, exclusions, suppression, and explanation |
| Vendor | Configured service, access, data, subcontractors, audit, correction, and exit |
| Platform | Account, market, policy version, status, format, and destination |
| Approval | Complete rendered copy, reviewers, decisions, dates, and expiry |
| Monitoring | Live-copy check, incidents, owner, stop rule, and correction test |
Release and correction
- Attempt release with a missing claim source and confirm the gate stops it.
- Revoke a test user and confirm every connected permission is removed.
- Trigger the campaign pause across platforms, feeds, vendors, and scheduled work.
- Change a material fact and find every derived public copy.
- Verify the corrected result from outside the organization.
The final approver should be able to reconstruct the campaign without asking an agency or former employee.
Retain records by type. Keep HIPAA privacy and security documentation for 6 years. Keep state medical records typically 7 to 10 years. Keep Ontario PHIPA records for 10 years after the last entry. Keep campaign evidence for the same period as the underlying claim support.
For a prescription drug ad, keep the approved copy, OPDP submission, and claim support for 6 years after the last publication, or longer if state law requires.
Worked example: A clinic posts a patient testimonial that says the treatment cured diabetes. The claim gate fails because there is no substantiation and the implied cure claim is not permitted. Correction: remove the post, replace it with a balanced statement, keep the removal record, and retrain the reviewer.
Evidence and gate result
For each gate, attach the evidence, governing law or policy, configuration tested, and reviewer decision. General privacy principles cannot substitute for checking the rule and settings that apply to the live campaign.
For acquisition campaigns, use the common patient acquisition questions to define the strategy, then verify the campaign’s claims, audience, and channels against the compliance checks above.
A gate result is only as strong as the evidence attached to it. Store the record where the next reviewer can find it.
Common questions
Can a checklist replace legal review?
No. It records a process; qualified reviewers still need the actual facts, evidence, and current requirements.
Should inaccessible content be approved with a later fix?
Treat accessibility as a release requirement according to the applicable standard and provide a safe equivalent route when needed.
When should the checklist be reopened?
Reopen it after material changes to the offer, evidence, audience, data, rule, platform, format, destination, vendor, owner, or service capacity.
