Last verified: October 2026, against Google's and Meta's current policy pages. Policies change — re-verify every six months. General information, not legal advice — confirm with your compliance officer or attorney.
Healthcare remarketing, meaning showing ads to people because of what they did on your site or because they're on your patient list, sits under three rule sets at once: HIPAA, Google's personalized advertising policy and Meta's advertising terms. All three point the same way. Retargeting based on health interests or patient status is mostly off the table, and the audiences that remain are built from place, search intent and context.
What remarketing means in a medical context
Remarketing covers any audience built from what a platform knows about specific people:
- Website-visitor lists: people whose browser fired your pixel or tag on certain pages
- Customer lists: emails or phone numbers you upload so the platform can match them to accounts (Google calls this Customer Match; Meta calls it a Customer List Custom Audience)
- Lookalike or similar audiences: strangers who resemble the people on those lists
- Engagement audiences: people who watched your videos or interacted with your posts
For a shoe store these are routine. For a practice, each one risks saying something about a person's health. A list of everyone who visited your "erectile dysfunction treatment" page is a list of people the platform can now associate with that condition.
Patient lists and Customer Match: a HIPAA problem first
Before any ad policy applies, HIPAA does. Individually identifiable health information includes information that relates to "the provision of health care to an individual" and identifies them (45 CFR 160.103 (opens in a new tab)). A list of your patients' emails says each person received care from you. Uploading it to an ad platform to sell them something is a disclosure of PHI for marketing, which requires each patient's signed authorization under 45 CFR 164.508(a)(3) (opens in a new tab).
Hashing doesn't fix it. Platforms hash uploaded emails so they can match them to accounts; matching to a real person is the point.
Nor can you turn the platform into a business associate. Google's HIPAA BAA (opens in a new tab) covers a listed set of Google Cloud and Workspace products, not its ad products. Meta's Business Tools Terms (opens in a new tab) take the opposite approach: advertisers must not send data that "includes or is based on, directly or otherwise, health information." Neither company's ad terms that we reviewed offer a BAA.
The platforms restrict this on their own terms too. Meta's Customer List Custom Audiences Terms (opens in a new tab), effective December 3, 2025, require that audience names and criteria not be based on "health information, financial information, consumer report information or other categories of sensitive information."
Google's personalized advertising policy and health
Google's personalized advertising policy (opens in a new tab) restricts targeting for sensitive interest categories, and its health in personalized advertising (opens in a new tab) page (checked October 2026) defines the health category: "Content related to Health is a sensitive interest category and includes personal health content like:"
- "Physical or mental health conditions, including diseases, sexual health, and chronic health conditions"
- "Products, services, or procedures to treat or manage chronic health conditions," including over-the-counter medications and medical devices
- "Invasive medical procedures, including cosmetic surgery, surgical procedures, or injections"
- "Disabilities, even when content is oriented toward the user's primary caretaker"
Google's examples include "Counseling services for mental health issues like depression, anxiety, and addiction" and "Medical devices for sleep apnea like CPAP machines."
When an ad promotes something in that category, advertiser-curated audiences "can't be used." That includes your data segments (Google's term for remarketing lists), Customer Match, lookalike segments and audience expansion. Predefined Google audiences remain available, because Google excludes sensitive signals from them. Custom segments are allowed only in limited forms.
The Customer Match policy (opens in a new tab) adds that advertisers "can't use data from your Customer Match campaigns to identify sensitive interest categories," and bars ad content that "implies knowledge of personally identifiable information or sensitive information." For the wider set of Google rules, see Google's healthcare ad policy.
Meta's health and wellness restrictions on audiences
Meta's rules work through ad content, targeting options and data terms:
- Ad content. Meta's Privacy Violations and Personal Attributes (opens in a new tab) policy says ads "must not contain content that asserts or implies personal attributes," including physical or mental health. "Do you have diabetes?" is disallowed; "New diabetes treatment available" is allowed. A retargeting ad saying "Still thinking about your knee pain?" implies the viewer has knee pain.
- Targeting options. In a November 9, 2021 announcement (opens in a new tab), Meta said that from January 19, 2022 it would remove detailed targeting options tied to sensitive topics, including health causes such as "Lung cancer awareness," "World Diabetes Day" and "Chemotherapy."
- Age limits. Meta's Health and Wellness (opens in a new tab) policy requires weight-loss and cosmetic procedure ads to be targeted to people at least 18 years old.
- Data terms. The Business Tools Terms and Custom Audiences Terms above bar health-based data and audiences.
More detail on what Meta allows in health ads is in our guide to Meta's health ad policy.
Website-visitor retargeting after the HHS tracking guidance
Retargeting website visitors depends on a pixel or tag firing on your pages, which is where HIPAA and the HHS tracking-technology guidance come in. A 2024 federal court ruling vacated part of that guidance, but PHI from forms, booking flows and portals is still protected; the details are in our guide to tracking pixels and HIPAA.
If you run any visitor audience at all, build it only from pages that reveal nothing about health:
| Include in audiences | Exclude from audiences |
|---|---|
| Home page | Every service and condition page |
| About, team and careers pages | Intake, contact and appointment-request forms |
| Location and hours pages | Booking widgets and confirmation pages |
| General blog posts (e.g., "how to choose a pediatrician") | Patient portal, bill pay, site search results |
Even then, the ad you show must not be in Google's health category if you want to use remarketing lists, and it must not imply anything about the viewer under Meta's rules. Many practices find that leaves too little to be worth the setup.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Audiences that stay safe for practices
These reach the right people without patient data or health inferences:
- Geography. A radius around each office, or the ZIP codes your patients come from. See location targeting for practices.
- Search intent. Keywords like "dermatologist accepting new patients" do the targeting for you, because the searcher chose the topic.
- Contextual placements. Ads next to content about the topic, rather than aimed at people profiled for it.
- Broad audiences with strong creative. Adults 25–64 within 15 miles, with an ad specific enough ("Same-week appointments for skin checks") that the right people respond. Our guide to Facebook and Instagram ads for practices covers structure and creative.
- Aggregate measurement. Count calls and form submissions as generic conversions so the platform can optimize without learning who your patients are.
Where Medfy fits. Medfy's Google Ads management add-on ($199/month) runs daily search-term reviews and negative keywords, keeps budget pacing inside a monthly ceiling you control, logs every change and makes it reversible. The Meta ads + AI creatives add-on ($199/month) makes on-brand static ads from your website, with copy written for healthcare ad policies and creative testing that rotates ads when they tire. Ad spend is paid directly to Google and Meta, never marked up, and ad platforms never receive patient data. See Medfy pricing and add-ons, or start with a free marketing audit, whose ads check flags privacy risks such as pixels on patient forms. For the full rule set, see HIPAA marketing rules.
Frequently asked questions
Is remarketing allowed for medical practices?
Only narrowly. Google doesn't support remarketing lists or Customer Match for ads promoting services in its health sensitive category, and Meta's terms bar audiences based on health information. HIPAA adds risk whenever the audience comes from patient data or from pixels on sensitive pages. Retargeting visitors of general pages with a non-sensitive ad may be possible, but confirm it with your compliance officer or attorney first.
Can I upload my patient email list to Facebook?
Not without each patient's written HIPAA authorization, and even then Meta's Customer List Custom Audiences Terms prohibit audiences based on health information. A list of your patients reveals that each person received care from you, which is PHI. Hashing the emails before upload doesn't change that, because the purpose of the upload is to match real people. Confirm with your compliance officer or attorney.
Does Google allow remarketing for healthcare ads?
Not for ads in its health sensitive interest category. Google's personalized advertising policy says advertiser-curated audiences, including your data segments and Customer Match, can't be used when promoting health conditions, chronic-condition treatments, invasive procedures and similar services. Keywords, locations, contextual targeting and Google's predefined audiences remain available. Policies change, so re-check them every six months and confirm with your compliance officer or attorney.
What audiences can a practice target safely?
Location (a radius around your office or a list of ZIP codes), search keywords, contextual placements next to relevant content, and broad age-and-location audiences with strong creative. None of these uses patient data or implies anything about the viewer's health. Measure results with aggregate conversions, such as calls and form submissions counted without their contents. Confirm any custom audience with your compliance officer or attorney.