A local agency signs a physical therapy clinic and sets up the usual marketing stack: analytics, ad pixels, conversion tracking on the appointment form. The confirmation page URL reads something like /request-received?service=post-surgery-knee. Every time a patient books, that URL, along with an IP address and browser identifiers, goes to an advertising platform.
For most clients, that’s routine conversion tracking. For a healthcare provider, it can be a disclosure of health information the clinic never authorized.
Privacy rules change the playbook
In 2022, the federal health privacy regulator issued guidance warning that tracking technologies on provider websites and apps could violate HIPAA. A federal court in 2024 struck down part of that guidance concerning public, unauthenticated pages, which gave agencies some room on general marketing pages. Pages behind a login, such as patient portals, remain clearly covered, and pages tied to booking specific services still carry risk.
Health apps that fall outside HIPAA aren’t off the hook either. The Federal Trade Commission’s Health Breach Notification Rule, updated in 2024, applies to many consumer health apps and treats unauthorized sharing with advertisers as a breach.
For an agency, the practical consequence is contractual. If the work involves protected health information, the clinic will likely need a business associate agreement with the agency, and the agency needs processes that live up to it. Many small agencies have never signed one.
Does the clinic actually need an app?
Clinic owners often ask for an app because a competitor has one. The question to answer first is what the app would do that the existing patient portal doesn’t. Most electronic health record systems already include a portal with scheduling, messages, and results.
Agencies offering healthcare mobile app development services do their best work on narrower use cases. A rehab clinic might want an app that delivers a patient’s home exercise program with videos and reminders, tracks completion, and shares adherence with the therapist. A multi-location dental group might want an app for appointment reminders and post-procedure care instructions.
Even these projects carry costs that small clinics underestimate. Pulling appointments or care plans from the health record system usually requires integration through standardized healthcare data interfaces, and access often needs vendor approval. App store review for health apps can be slow. Operating system updates force maintenance every year, and an app that stops working after an update generates calls to the front desk.
For many small practices, a well-built mobile web experience linked to the existing portal is the better investment.
Reporting without patient data
Clients still want to know whether marketing works. Agency reporting tools can answer that, provided the data feeding them is cleaned first.
Useful reports for a clinic look different from ecommerce reports. They count appointment requests by location and service line, track call volume from campaigns, and compare new patient numbers month to month. They don’t follow individual patients from ad click to diagnosis.
A few operational habits help. Use generic confirmation URLs that don’t reveal the service requested. Route tracking through a server-side setup that strips identifiers before data leaves the clinic’s environment. Choose call tracking that either skips recording or is covered by a business associate agreement, because callers routinely describe symptoms in the first thirty seconds.
There’s a tradeoff. Ad platforms optimize better with richer conversion data, and campaigns may perform somewhat worse once that data is limited. Clinics need to hear that before launch rather than after the first monthly report.
Less data, better questions
Healthcare clients force agencies to measure with fewer signals than they’re used to. The agencies that adapt well end up asking simpler questions: did more new patients book this month, at which location, and for which services? Those turn out to be the questions clinic owners cared about in the first place.
