A rehab marketing agency can build a program's reputation or quietly put its license at risk. Lead selling and paid referrals were common enough in this field that Congress passed a law named for them, the Eliminating Kickbacks in Recovery Act, so choosing an agency is due diligence, not a beauty contest. Demand for the service is small and specific: about 170 US searches a month for "rehab marketing agency" and 320 for "addiction treatment marketing" (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
This guide gives you the red flags, the data and contract terms to insist on, and the questions to ask on the first call.
What a legitimate rehab marketing agency does
A good agency builds assets your program owns and keeps its hands off your patients. In practice that means:
- Your website and listings: accurate pages for each level of care, a clean Google Business Profile, and content written for patients and families.
- Paid ads, only after certification: campaigns run in ad accounts held in your name, once LegitScript and the platforms have approved you.
- Measurement without patient data: calls, form completions and admissions by source, reported in aggregate from your own systems.
- Compliance as a working habit: ad copy checked against platform rules, no tags on intake pages, and written agreements before touching any record.
It does not run "helpline" sites, sell leads to several programs, route calls among clients, or get paid more when your census rises. Our addiction treatment marketing hub explains the rules behind each of these lines.
Red flags: lead selling, call routing and paid referrals
Listen for these phrases on a sales call:
| What you hear | Why it's a problem |
|---|---|
| "You only pay for admissions." | Payment tied to referrals is the core of federal and state patient-brokering laws. |
| "We own a network of helpline and directory sites." | Lead generators covering addiction services are ineligible for LegitScript certification, and Florida requires call-center lead generators to disclose which providers pay them. |
| "Calls come in on our national number and we route them." | Callers may not know who they're speaking to, and you don't control the number or the recordings. |
| "We can run ads before you're certified." | Google and Meta require certification for treatment ads; workarounds put your accounts at risk. |
| "We arrange travel for out-of-state patients." | LegitScript disqualifies programs that pay for patient travel. |
| "Send us your census so we can optimize." | Patient lists are protected records; marketing doesn't need them. |
The federal Eliminating Kickbacks in Recovery Act, or EKRA (18 U.S.C. § 220 (opens in a new tab)), makes it a crime to knowingly and willfully pay or receive remuneration to induce referrals to a clinical treatment facility, recovery home or laboratory, with fines up to $200,000 and up to 10 years in prison per occurrence. Its exception for employees and independent contractors applies only if their pay is not "determined by" or does not "vary by" the number of people referred, tests performed or amounts billed.
States add their own penalties. Florida's Patient Brokering Act (opens in a new tab) makes paying or receiving anything to induce patient referrals a felony, with mandatory fines from $50,000 to $500,000 depending on the number of patients. For Medicare- and Medicaid-billed services, the federal Anti-Kickback Statute also applies, which HHS OIG (opens in a new tab) describes as criminalizing payments "to induce or reward patient referrals."
For the full legal picture, read patient brokering laws; for the business case, see buying leads vs owning demand.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
LegitScript and platform-policy experience
No agency can certify you. LegitScript certifies treatment providers, and Google and Meta then approve them. What a good agency brings is experience preparing a program for that review.
LegitScript's standards (opens in a new tab) look at licensing, staff qualifications, website accuracy, privacy compliance, advertising transparency and patient incentives. They also require no ownership of or affiliation with lead generators. That cuts both ways: an agency that also runs lead-generation sites can become a liability in your own application.
Ask the agency to walk you through:
- Google's addiction services policy (opens in a new tab), including that it covers "lead generators or referral agencies for addiction services";
- Meta's requirement (opens in a new tab) for LegitScript certification plus written permission from Meta;
- how it would fix a disapproved ad without changing what the ad truthfully says.
Data handling: HIPAA, 42 CFR Part 2 and call recordings
Decide what the agency will touch before you sign anything. Most marketing work needs no patient information at all.
If the agency will handle records (answering calls, storing recordings, hosting intake forms or running a CRM), two kinds of agreement may apply:
- A business associate agreement (BAA) under HIPAA, if your program is a covered entity.
- A qualified service organization agreement (QSOA) under 42 CFR 2.11 (opens in a new tab), in which the vendor acknowledges it is "fully bound" by Part 2 and will resist efforts in judicial proceedings to obtain patient information except as Part 2 allows.
Part 2's definition of records includes emails, voicemails and texts, and it protects people who have only applied for treatment. Call recordings and intake notes therefore count. Vendors holding records also need formal security policies under 42 CFR 2.16 (opens in a new tab), and state call-recording consent rules vary, so check yours.
Our guide to 42 CFR Part 2 covers consent, redisclosure and tracking in detail.
Contracts: who owns phone numbers, websites and ad accounts
Ownership disputes are how programs get trapped with a bad agency. Put every asset in your program's name from day one:
| Asset | Your program should | Watch for |
|---|---|---|
| Call-tracking and main phone numbers | Hold the account, or have a no-fee right to port every number | Numbers "licensed" to you that stay with the agency |
| Domains | Be the registrant | Domains registered to the agency or a principal |
| Website and content | Own the site, content and photos, with a handover on exit | Sites hosted on a proprietary platform with no export |
| Google Ads and Meta ad accounts | Own the accounts and payment method; grant the agency user access | Ads run from the agency's account, so history leaves with them |
| Google Business Profile | Be the primary owner | Profiles created by the agency; Google's guidelines (opens in a new tab) also exclude lead-generation agents |
| Analytics and call data | Own the properties and exports | Reports you can see but never download |
Add termination terms: 30 days' notice, transfer of all assets within a set number of days, and deletion of any patient information with written confirmation. Our guide to marketing agency contracts has clause language to review with your attorney.
Pricing models and what they incentivize
How an agency is paid shapes what it does. Compare models before comparing prices:
| Model | What it rewards | Risk in addiction treatment |
|---|---|---|
| Flat monthly retainer | Defined work done well | Lowest; check deliverables are specific |
| Percentage of ad spend | Spending more | Budgets drift up; cap the fee or the spend |
| Pay per lead or per call | Volume, not fit | Can become remuneration for referrals; lead quality is often poor |
| Pay per admission | Admissions at any cost | Highest legal risk under EKRA and state brokering laws |
Your real cost drivers are ad spend once you're certified ("detox near me" averages $107.39 a click, same data source), certification fees (LegitScript listed $1,595 to apply and $3,095 a year per facility for one to nine facilities on October 22, 2026), content production and the staff who answer the phone.
Where Medfy fits. Medfy charges a flat monthly subscription ($349 for the base plan, add-ons at fixed monthly prices), and ad spend is paid directly to Google and Meta, never marked up. For treatment programs the limits come first: Medfy does not provide LegitScript certification, and its commitments cover HIPAA-protected data under a BAA, while its handling of 42 CFR Part 2 records is not confirmed. Substance-use intake should stay in your program's own Part 2-compliant systems.
Questions to ask on the first call
- How exactly are you paid, and does any part of your fee vary with calls, leads or admissions?
- Do you own or operate any helpline, directory or lead-generation sites, or work for other programs in my area?
- Whose name will be on the phone numbers, domains, website, ad accounts and Google Business Profile?
- Which certified treatment programs can I call as references?
- How have you prepared programs for LegitScript review, and what did you change on their websites?
- Will you ever receive patient information? If so, will you sign a BAA and a QSOA?
- Where are call recordings stored, who can hear them, and how long are they kept?
- Which tags will you place on our site, and will any run on intake or thank-you pages?
- How do you report results without patient-level data?
- What happens to every asset and every record if we end the contract?
- Who writes our ad copy, and how is it checked against Google and Meta policies?
- Have you or your principals been the subject of any regulatory action?
Our general list of questions to ask an agency covers reporting and performance terms. Before the call, a free marketing audit gives you a baseline: it reads public information only and flags privacy risks such as pixels on patient forms.
Frequently asked questions
How do I know if a rehab marketing agency is legitimate?
Ask how it is paid, whose name is on every account, and whether it runs any lead-generation or helpline sites. A legitimate agency works for a flat fee, builds assets you own, has helped programs prepare for LegitScript certification without claiming to provide it, and never needs patient records to report results. Ask for references you can call, and read the contract for per-admission or per-call terms before signing.
Is pay-per-admission marketing legal?
It is one of the riskiest arrangements in this field. EKRA (18 U.S.C. § 220) makes it a crime to pay remuneration to induce referrals to treatment facilities, and its exception for employees and contractors applies only when pay doesn't vary with the number of people referred or the amount billed. State laws such as Florida's Patient Brokering Act add felony penalties. Get a healthcare attorney's written opinion before agreeing to any outcome-based fee.
Who should own the phone numbers an agency uses?
Your program should. Tracking numbers belong in an account in your program's name, or must be portable to you on request without fees, and the same goes for domains, websites, Google Ads and Meta accounts, Google Business Profiles and analytics. If an agency keeps the main number when you part ways, your callers keep reaching it. Write ownership and transfer terms into the contract before any work starts.
Does a rehab marketing agency need to sign a BAA?
If it will create, receive or store patient information for you, yes, and for a Part 2 program it may also need a qualified service organization agreement accepting that it is bound by 42 CFR Part 2. Call answering, recordings, intake forms and CRMs all count. An agency that only runs ads and reports aggregate numbers shouldn't need patient data at all. Ask counsel which agreement fits your setup.