Facebook lead ads for medical practices: what to ask and what to avoid

How Facebook and Instagram lead ads work

Meta describes lead ads as "a quick and privacy-safe way to sign up to receive information from your business," with a form that "is mobile-friendly and uses information people already shared with Facebook" (Meta for Developers (opens in a new tab)). In practice:

1. A person sees your ad in Facebook or Instagram.
2. They tap the call to action and an instant form opens, often with name, email and phone already filled in.
3. They submit without visiting your website.
4. The lead sits in Meta until you retrieve it: in Leads Center in Meta Business Suite, through a CRM integration, or by an automated connection your developer builds.

That last step matters. Unlike a website form, the lead's first home is Meta's system, not yours.

Why lead forms are a HIPAA question for practices

HIPAA applies to covered entities, which include health care providers that submit standard transactions such as claims electronically (CMS (opens in a new tab)), and to their business associates. Under the regulations, information is individually identifiable health information when it is created or received by a health care provider, relates to a person's health, care or payment for care, and identifies them or could reasonably be used to (45 CFR 160.103 (opens in a new tab)).

Whether a given lead form crosses that line depends on who collects it, what it asks and why. A name and phone number for "a consultation" is different from a form that asks about a diagnosis. We won't give you a blanket conclusion, because there isn't one. The practical answer is to design forms so the question barely arises: ask nothing about health.

Meta has its own rule here too. Its Advertising Standards say advertisers "must not create lead ads questions" requesting certain information "without our prior written permission," and the list includes health information: "physical health, mental health, medical treatments, medical conditions or disabilities" (Advertising Standards (opens in a new tab), checked October 22, 2026).

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Setting up a lead ad, step by step

1. Pick one service per campaign, such as "laser hair removal consultation" or "new patient dental exam." The ad, not the form, says what it's for.
2. Write the ad within Meta's rules. Don't assert or imply the viewer has a condition: Meta allows "Depression counseling" but not "Depression getting you down? Get help now" (personal attributes (opens in a new tab)). More in Meta's health ad rules.
3. In Ads Manager, choose lead generation with an instant form.
4. Build the form: a short intro naming the service and practice, contact fields only (next section), a link to your practice's privacy policy, and a thank-you screen with your phone number.
5. Connect delivery so leads reach the front desk fast (see below), and test with a real submission.
6. Set a budget and run for two to four weeks before judging.

For ad strategy beyond lead forms, see Facebook ads for healthcare.

Safe form design: contact details only, no symptoms or conditions

Ask for:

• First name (or full name)
• Phone number
• Email
• Preferred time to call

Never ask for:

• Symptoms, diagnoses or conditions ("What are you struggling with?")
• Treatment or medication history
• Insurance member IDs or date of birth
• A dropdown of treatments that reveals health information (weight loss, mental health, fertility)

Two Meta details are worth knowing. Its standards say custom questions must not request "the same or substantially similar information" that a built-in prefill question already covers, so use Meta's standard fields where they exist. And health questions require Meta's prior permission, which a small practice is unlikely to seek or need.

If you need clinical details to triage, collect them later, on the phone or in a HIPAA-compliant intake form your practice controls.

Lead ads vs sending clicks to your website form

Sending people to your site is usually the better fit when the inquiry naturally involves health details, such as a consultation for a specific condition. The form needs to be built for it: see HIPAA-compliant website forms. Keep Meta's pixel and other ad tags off that page, or the risk moves rather than disappears; read tracking pixels and HIPAA.

Medfy takes the website route. Its forms are HIPAA-compliant, submissions land in the practice's patient CRM and inbox, and ad platforms never receive patient data. Medfy's Meta ads add-on runs static ads with creative testing; it doesn't sync Meta lead forms into the CRM. See how Medfy protects patient data.

Getting leads to your front desk within minutes

A lead is a person who wanted a call a moment ago. Delivery decides whether you reach them.

1. Choose a delivery route. Meta offers Leads Center in Business Suite, CRM integrations, and webhooks that send "an update" to your system "every time a new lead is submitted" (Meta for Developers (opens in a new tab)).
2. Make sure the destination is appropriate for patient contact details and access-controlled.
3. Name an owner and a backup for callbacks during office hours.
4. Write a short callback script: confirm the service, offer two times, book.
5. Set an after-hours rule: who calls the next morning, and how fast.
6. Log the source ("Facebook lead ad") in your practice management system.

Why speed matters, and how to measure it, is covered in speed to lead for new patients.

Measuring cost per lead and cost per booked patient

Meta reports cost per lead. Your schedule tells you cost per patient. Track both, monthly, by campaign.

Common mistakes

• Adding a custom question about symptoms "to save time on the call."
• Leaving leads in Leads Center for a day or more.
• Judging lead ads on cost per lead alone.
• Copying a form across services with a treatment dropdown.
• Writing ad text that implies the viewer's condition.

If you're not sure how your current ads and forms handle patient data, start with a free marketing audit; its ads check flags privacy risks such as pixels on patient forms. For every channel in one place, see our healthcare advertising guide.

Frequently asked questions

Are Facebook lead ads HIPAA compliant?

There's no blanket answer. Lead ads collect form answers inside Facebook or Instagram, so Meta receives whatever a person types before your practice does. Whether that information is protected health information depends on who collects it, what it asks and why. The safer design asks only for contact details and a preferred time, never symptoms or conditions. Confirm your specific setup with counsel.

What questions can a medical practice ask in a lead form?

Keep it to name, phone, email and a preferred time to call. Don't ask about symptoms, conditions, medications or treatment history: Meta's Advertising Standards bar lead ad questions requesting health information without its prior permission, and those answers would put health details on Meta's servers. Run a separate form for each service instead of asking which treatment someone wants.

Are lead ads cheaper than website leads?

Often per lead, because the form is short and pre-filled, but not always per patient. A form that takes seconds to submit attracts some people with little intent, so more leads may never answer the phone. Compare cost per booked patient, not cost per lead: track how many leads from each source book and attend over the same month, then decide.

How fast should a practice call back a new lead?

As fast as you reasonably can, ideally within minutes during office hours, while the person still remembers filling in the form. Set up instant notifications or a direct connection to your system, name who calls back, and agree on a fallback for when that person is busy. Leads that sit untouched until the next day tend to go cold.