Medical practice marketing starts with the people already looking for you. Give them a complete Google listing, an answered phone and online booking first, then work on reviews and referral sources, and add paid search last, only for services with open slots. One number tells you whether any of it works: new patients who came in, by source, counted once a month in your practice management system (the software that holds your schedule and billing).
Quick answer
- Fix your Google listing and each doctor's, add a booking link, and count last month's missed calls.
- Ask every patient for a review the same way, and reply without confirming anyone is a patient.
- Make the referral source a required field at registration, with fixed answers.
- Pay for clicks only for a service with open slots, at a cost per new patient below what their first 90 days leave you.
- Each month, count new patients who came in, by source.
What should patients find when they search for you?
Your Google Business Profile, the free listing on Google Search and Maps, should answer three questions without a click: are you open, can I call, can I book. In its Booking section you can add up to 10 links that help patients book an appointment and mark one as preferred (Google, checked 2026-10-04). You can also connect a booking provider that works with Google, and it then shows on the profile (Google, checked 2026-10-04).
Search each doctor's name as well. Google treats doctors as individual practitioners who may have their own profiles. Where several work at one location, the practice keeps a profile for the location, and each doctor's profile is titled with the doctor's name alone, not the practice's (Google, checked 2026-10-04). A doctor's profile with an old address sends patients elsewhere.
Then pull last month's call log from the phone system and count calls in open hours that rang out or reached voicemail. Each one is a caller who did not reach a person. Online booking takes some of that load. Offer it for visits that need no triage, such as an annual physical, and keep the rest on the phone. What to check before you buy patient scheduling software covers the choice.
How do you get reviews without a HIPAA problem?
Ask every patient the same way after the visit: a text or email from your own system with a link to your Google review form. Google forbids offering anything for a review, asking only happy patients, and pressuring patients to review while still in the office (Google, checked 2026-10-04). The FTC's 2024 rule on consumer reviews bans incentives tied to a positive or negative review (FTC, checked 2026-10-04).
Leave anything clinical out of the request. A review tool fed patient names and phone numbers from your system handles protected health information (PHI, health information that identifies a patient), and HIPAA lets you share PHI with such a vendor only under a business associate agreement (BAA), a contract in which it promises to safeguard that information (HHS, checked 2026-10-04).
The reply is the risky part. In 2023 HHS's Office for Civil Rights (OCR), which enforces HIPAA, settled for $30,000 with a New Jersey psychiatric practice that disclosed four patients' information in replies to their negative Google reviews (HHS, checked 2026-10-04). Even a reply that only corrects the record can confirm the reviewer was seen, so use one that confirms no visit, doctor or date: "I'm the office manager, and I'd like to hear more. Please call me at the front desk."
Which doctors and employers send you patients?
Referrals do not show up in an ad report, so count them at registration, where they arrive. Make the source a required field with a fixed list: Google search or Maps, a doctor's referral (naming the office), an employer, an insurance plan's directory, a friend or family member, social media, other. A fixed list keeps "Dr. Patel", "Patel referral" and "patel" from becoming three sources. If your software has no such field, ask the vendor to add one.
Read referrals by referring office each month. An office that sent patients every month and then stops is a call to its manager, before any money goes to ads. List employers that send staff for physicals or work injuries by name, too.
When is paid search worth turning on?
Paid search, ads on Google's results that you pay for per click, comes last because every click costs money. That price is the CPC, cost per click. I bought Google and Meta ads from October 2023 to September 2025 (nearly $700K in cumulative spend), and before any budget I ask how many new-patient slots are open.
The table shows Google Ads Keyword Planner estimates for the US, October 2026: a national average cost per click, and the range advertisers have historically paid to show at the top of the page (Google, checked 2026-10-04). They are not what your clicks will cost, and local prices differ.
| Search | US searches a month | Average CPC | Top-of-page bid range |
|---|---|---|---|
| primary care doctor near me | 40,500 | $6.73 | $2.49 to $9.73 |
| pediatrician near me | 246,000 | $5.02 | $2.00 to $7.91 |
| dermatologist near me | 673,000 | $5.43 | $2.15 to $7.79 |
| ent doctor near me | 74,000 | $4.77 | $1.61 to $7.55 |
| cardiologist near me | 90,500 | $5.35 | $1.69 to $7.24 |
Your own numbers decide. Count ad patients through a phone number and booking page used only in the ads, as this break-even check explains, along with what a new patient's first 90 days leave you.
Illustrative: every number below is made up for an imaginary two-doctor dermatology practice, and none comes from a client.
- New patients per click = new patients from the ads ÷ ad clicks: 30 ÷ 600 = 0.05.
- Break-even cost per click = what a new patient's first 90 days leave you × new patients per click: $240 × 0.05 = $12.00.
- Cost per new patient = cost per click ÷ new patients per click: $6.40 ÷ 0.05 = $128, inside the $240.
- Next month's budget = open new-patient slots ÷ new patients per click × cost per click: 24 ÷ 0.05 × $6.40 = $3,072.
Spending past that budget buys patients the calendar cannot seat. Remarketing, ads that follow past visitors of your site, is limited too. Google treats ads about physical or mental health conditions, treatments for chronic conditions, and invasive procedures such as surgery or injections as a sensitive category and bars remarketing lists and Customer Match (uploaded contact lists) for them (Google, checked 2026-10-04). What Google's healthcare ad policy allows covers the rest.
Where else does HIPAA catch practice marketing?
In two more places: the tags on your website, and patients shown in your ads. A tag, or pixel, is code from Google, Meta or another vendor that reports what visitors do on your site back to that company. OCR addressed tags in a bulletin issued in December 2022 and revised on March 18, 2024. On June 20, 2024, a federal court in Texas (American Hospital Association v. Becerra) vacated one part: that HIPAA obligations apply when a tool connects a visitor's IP address with a visit to a public page, one that needs no login, about a health condition or a provider. The court added that the ruling should not be read as limiting the rest of the guidance (court opinion, checked 2026-10-04).
The rest, still on the HHS page, says tracking behind a patient login generally has access to PHI, that tracking on a booking page or symptom checker may collect it (an email address, the reason for the visit), that a cookie banner is not a HIPAA authorization, and that sending PHI to a tracking vendor for marketing without patients' authorization is an impermissible disclosure (HHS, checked 2026-10-04). So keep ad tags off the patient portal, the booking flow and intake forms. Have whoever handles HIPAA for your practice, or a healthcare attorney, approve the list of tagged pages. If an agency wants booked patients sent back to Google Ads, this is where I draw the line on what leaves the practice.
Patients in your ads are the other trap. Under HIPAA, marketing is a communication that encourages people to buy or use a product or service, and with limited exceptions it needs a patient's written authorization before their PHI is used for it (HHS, checked 2026-10-04). A message to your own patients about your own health services is not marketing unless a company whose product it describes pays you to send it (eCFR, checked 2026-10-04). A photo or story that identifies a patient is PHI, and OCR's New Jersey settlement names posting patient information on a website or social media as a use that needs authorization (HHS, checked 2026-10-04). A valid authorization states what will be shared, by whom, with whom, why and until when, carries the patient's signature and date, and says it can be revoked in writing (eCFR, checked 2026-10-04). Get it signed before the photo is taken and file it with the image.
What one number should you read every month?
New patients who came in last month, grouped by source. Pull it from your practice management system in the first week of the month, counting first visits marked arrived, not appointments booked. The other counts explain a change in it.
| What to count | Where to find it | How often |
|---|---|---|
| New patients who came in, by source | Practice management system: first visits marked arrived | Monthly |
| Calls that rang out or reached voicemail in open hours | Phone system call log | Weekly |
| Online bookings, and how many of those patients came in | Scheduling tool report, checked against the schedule | Monthly |
| New reviews, and replies posted | Google Business Profile | Weekly |
| Referrals by referring office | Practice management system, referral field | Monthly |
| Ad spend, and new patients from the ad-only line and page | Ad invoice and the source field | Monthly |
The sheet holds counts, never names, so it can go to an agency as is.
What should you ask an agency before you hire one?
- Will your monthly report show new patients by source from my practice software, or only clicks, calls and forms?
- Which pages will carry your tags, and will any of them be the patient portal, the booking flow or an intake form?
- Will patient information reach you, and if it does, will you sign a business associate agreement?
- Will the ads get a phone number and a landing page used only in the ads?
- Who owns the Google Ads account, the Business Profile and the website if I end the contract?
Tags
Frequently asked questions
What is the best way to advertise my medical practice?
Start where patients already search: a complete Google Business Profile with a booking link, a phone that gets answered, and reviews from every patient, asked the same way. Add paid search after that, for one service with open slots, and only while a new patient from the ads costs less than their first 90 days leave after the cost of their visits. Judge every channel by new patients who came in, by source, counted in your practice management system.
Can I respond to a patient's negative online review?
Yes, but keep out of the reply anything that confirms the reviewer is a patient: no visit, doctor, date, condition or insurance. In 2023 HHS's Office for Civil Rights settled for $30,000 with a New Jersey psychiatric practice that disclosed four patients' information in replies to their negative Google reviews. A short reply that invites the person to call the office manager moves the conversation off the public page.
Can I use patient photos or stories in my practice's marketing?
Only with the patient's signed HIPAA authorization, obtained before you use them. A photo or story that identifies a patient is protected health information, and OCR's 2023 settlement with a New Jersey practice names posting patient information on a website or social media as a use that needs authorization. The form must say what will be shared, by whom, with whom, for what purpose and until when, and that the patient can revoke it, so have whoever handles HIPAA for your practice, or a healthcare attorney, check it.
Is social media marketing worth it for a medical practice?
Only your own count can answer that. Add social media as a choice in the registration source field and read it next to Google, referrals and the rest each month. The HIPAA rules for reviews and patient photos apply there too, so no patient faces or stories without a signed authorization, and no comment replies that confirm someone is a patient. If you add the Meta pixel to measure social ads, it follows the same rule as any tag: keep it off the patient portal, the booking flow and intake forms.
What should a medical practice marketing plan include?
One page: being easy to find and book (Business Profile, phone, online booking), reviews, referral sources and paid search, each with a staff owner and one count to read. Over all of them sits one number, new patients who came in by source, read monthly from your practice management system. Size paid search from the calendar: open new-patient slots ÷ new patients per click × cost per click gives the month's budget.