Rules
Part of Healthcare Marketing Compliance Guide for Clinics
Healthcare Marketing Compliance Examples: Twelve Named Cases, Controls and Failure Tests
Twelve named healthcare marketing compliance examples, each paired with a control, a typical owner and a failure test a reviewer can reproduce.
What to take away
- Each campaign class needs its own control, owner and failure test, not one approval form copied across channels.
- The FDA's Office of Prescription Drug Promotion oversees prescription drug promotion. Provider service ads, devices and public education sit outside that scope.
- The FCC applies the TCPA to voice calls and texts, so consent, revocation and suppression must be tracked per number and per vendor.
- The examples below date from 2014 to 2024.
- Public orders name the failuresthe FTC's GoodRx, BetterHelp and Cerebral actions, and the Novant Health pixel settlement.
Healthcare marketing compliance examples should show different decisions, not one approval form applied everywhere. The twelve rows below name public enforcement actions, regulatory scopes and guidance documents. Each still needs review against the actual entity, offer, audience, jurisdiction and medium.
Twelve named examples, from Kisqali to 1health.io
The owner column names a typical owner for each class. Assign the real owner inside your own organization.
| Campaign class and named example | Typical owner | Material control | Failure test |
|---|---|---|---|
| Prescription drug broadcast: FDA's January 2024 untitled letter to Novartis over a Kisqali TV ad | Medical-legal review | Sponsor, labeling, benefit-risk presentation, exact format | Render audio and visual components together |
| Clinic and telehealth service ads: FTC and DOJ order with Cerebral, April 2024, $7 million | Marketing lead with compliance | Current service, geography, capacity, eligibility, destination | Attempt booking from an ineligible or closed location |
| Marketing text and calls: FTC v. Benefytt Technologies, 2022, over telemarketing for non-ACA health plans | Compliance | Sender, purpose, recipient basis, content, opt-out | Reused number and revoked-consent scenario |
| Creator endorsement: FTC Endorsement Guides, plus the October 2021 penalty offense notices to more than 700 companies | Marketing with legal | Experience, evidence, connection, script limits, monitoring | Creator edits or reposts an expired claim |
| Research recruitment: ClinicalTrials.gov registration under the FDAAA 801 final rule, in force since January 2017 | Clinical operations | Review status, criteria, risks, compensation, contact route | Ineligible viewer and urgent clinical inquiry |
| Public directory: No Surprises Act provider directory rules, effective January 2022 | Data operations | Field-level authoritative source and propagation log | Clinician departure or changed phone number |
| Patient story: HIPAA authorization, plus OCR's online tracking technologies bulletin, first issued December 2022 | Privacy officer | Exact use, authorization, edit, duration, withdrawal process | New channel or materially changed cut |
| Automated creative: FDA's 2014 draft guidances on social media and interactive promotional media | Content operations | Allowed combinations, locked claims, versions, audit trail | System pairs an old claim with new imagery |
| Public correction: FTC orders requiring GoodRx and BetterHelp to notify affected consumers | Privacy officer with communications | Affected-copy inventory, direct wording, notice, verification | Affiliate and scheduled copy remain live |
| Patient data and tracking pixels: Novant Health's proposed $6.6 million class-action settlement over Meta pixel tracking, January 2024 | Privacy and IT | Inventory of tracking technologies and the data each one receives | A pixel still fires on a page with a form |
| Health data used for advertising: FTC orders with GoodRx, February 2023, $1.5 million, and BetterHelp, March 2023, $7.8 million | Privacy officer | Written ban on disclosing health data for ad targeting | A vendor still receives an audience list |
| Consumer health apps: FTC orders with Flo Health, January 2021, and 1health.io, June 2023, $75,000 | Product privacy | Consent before disclosure, plus a data retention limit | A policy change applied to data collected earlier |
The Kisqali letter shows the scope of the prescription drug rules in practice. FDA said the TV ad made false or misleading efficacy claims, and the letter asked for corrective action.
That scope does not cover unrelated provider services, devices, foods or public education. Provider teams still face compliance questions about scope, authority and privacy that the OPDP rules do not answer.
The prescription drug row needs product-specific regulatory ownership and the exact current material. A clinic service team can borrow the discipline of rendered review without claiming the same rules or FDA status.
Treat calls and texts as their own system
The FCC's consumer guide on unwanted calls and texts summarizes the consent and do-not-call protections, and notes that the TCPA applies to voice calls and text messages. The FCC's 2024 order on revocations gives senders 10 business days to honor an opt-out. Confirm these details with current counsel and FCC material, along with the exact technology, purpose, recipient, relationship, revocation rules, exemptions and state rules.
- Identify every sender, vendor and number.
- Map each platform, template and data source.
- Separate informational, treatment, operational, fundraising and marketing purposes.
- Preserve the applicable basis and its exact scope for each recipient.
- Honor suppression and revocation across connected vendors and numbers.
- Test reassigned, shared and incorrectly formatted numbers.
- Archive the delivered message, time, route, response and change history.
The FTC's 2022 complaint against Benefytt Technologies alleged that telemarketing calls and lead-generation sites pitched health plans that were not ACA-qualified.
Make each example auditable
Attach the actual source, reviewer, approval and rendered copy. Attach the public destination, audience definition, data lineage and release record. Attach the monitoring result and any correction evidence.
Novant Health's tracking case shows why that record matters: it reported the tracker data sharing to federal regulators as a HIPAA breach in 2022, and a class action followed.
Label an example hypothetical until the organization has implemented and measured it.
Turn examples into test cases
The NIST Privacy Framework starting guide outlines a voluntary process for identifying and managing privacy risk. Use it to assign data and response owners. It is not legal clearance.
The W3C information and relationships guidance says visual structure and relationships should also be available programmatically. Apply that check to the outputs of each campaign class, then test the live page with the users and technology in scope.
Keep the evidence record beside the decision so a reviewer can reproduce the reasoning without relying on memory.
Common questions
Are these compliance guarantees?
No. They are control patterns that must be adapted and reviewed for the actual facts. None of them substitute for advice from qualified healthcare counsel.
Can one approval cover every format?
No. Approve each materially different rendered impression along with its destination, audience and delivery conditions, because a claim that is accurate in one format can mislead in another.
Which example should a small team test first?
Choose the campaign with clear ownership, stable facts, significant risk and a release system the team can inspect end to end. That combination lets you find real gaps without waiting for a full program build.
