Lead generation in healthcare: patient leads and B2B leads are two jobs, and the rules sit on the form

Lead generation in healthcare means one of two different jobs. A provider (a clinic, a hospital, a practice, a telehealth service) wants patients to book. A company that sells to providers (software, devices, staffing, billing services) wants meetings with the people who buy for a health system. The tactics overlap, but the rules do not. Patient lead generation runs into privacy rules on the website, consent rules on the phone, platform rules on ads, and in the US a federal law about paying for referrals. B2B lead generation in healthcare mostly runs into a long, committee-led buying cycle. Decide which job you have before you hire anyone, because an agency that is good at one is often weak at the other.

The two jobs side by side

	Patient lead generation	B2B lead generation in healthcare
Who the lead is	A person, or a family member, looking for care	A clinician, administrator, IT lead or buyer at a provider or payer
What counts as a lead	A booked appointment, a completed intake, a call that reaches the front desk	A meeting held with someone on the buying committee
Main channels	Google search and Maps, the practice website, paid search, referrals from other clinicians	Industry events, content, outbound email and calls, partner channels
Main legal pressure	Health privacy on the site, phone and text consent, ad platform health policies, referral payment law	Email and calling rules, plus whatever the buyer's procurement process demands
Sales cycle	Hours to weeks	Months, sometimes more than a year

Patient leads: where the rules sit on the form

The tracking on your website

The US Department of Health and Human Services (HHS) published guidance on online tracking technologies for HIPAA covered entities. It says tracking on logged-in pages, such as a patient portal, generally has access to protected health information, and that a tracking vendor that receives it can be a business associate that needs an agreement. It also says that a booking page or a symptom checker that sends a person's email address or reason for the visit to a vendor is disclosing protected health information.

One part of that guidance no longer stands. On 20 June 2024 a federal court in Texas vacated the part saying that HIPAA is triggered when a tracker connects an IP address with a visit to a public, logged-out page about a health condition or a provider. The guidance on portals, booking flows and symptom checkers was not part of that order. So the practical rule is simple: keep third party pixels off login pages, booking flows and intake forms unless your vendor will sign a business associate agreement, and send conversions from your own systems in a form that carries no health detail.

Calls and texts to the people who fill in the form

The US Telephone Consumer Protection Act rules sit in 47 CFR 64.1200, which we read on eCFR on 21 October 2026. Three parts matter most for a lead programme:

• Marketing calls or texts using an autodialer or a prerecorded voice need prior express written consent. The rule defines that as a signed agreement (an electronic signature counts) that authorizes the seller to send those messages to a stated number, with a clear statement that agreeing is not a condition of buying anything.
• There is a health care message exception. Calls that deliver a "health care" message, made by or for a HIPAA covered entity or its business associate, are carved out of the written consent requirement for marketing calls. To a residential line, those prerecorded calls are limited to one a day and three a week per patient. An appointment reminder is not the same thing as a promotion for a new service, so do not stretch this exception to cover marketing.
• People can withdraw consent in any reasonable way. A reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" counts, and so does other wording a reasonable person would read as a request to stop.

Telephone solicitations are also barred before 8 a.m. and after 9 p.m. in the called person's local time, and numbers on the national do-not-call registry are off limits unless an exception applies. If you buy leads, ask for the exact consent wording and check that it names your business.

Paying for leads, and the federal referral law

The federal Anti-Kickback Statute, 42 U.S.C. 1320a-7b(b), makes it a crime to knowingly and willfully offer or pay anything of value to induce a referral of someone for an item or service paid for by a federal health care program, such as Medicare or Medicaid. A price per booked patient is exactly the kind of arrangement that needs a lawyer's review before you sign it. The regulations at 42 CFR 1001.952(f) describe a safe harbor for referral services, and one of its conditions is that a participant's fee is based only on the cost of running the service, not on the volume or value of referrals. Many states have their own fee-splitting and patient brokering laws too.

Ad platform rules

Google's healthcare and medicines policy (answer 176031, read 21 October 2026) restricts several health categories. Recovery-oriented drug and alcohol addiction services need Google certification to advertise in the places that allow them. Online pharmacies and telemedicine providers need LegitScript certification as well as Google's. In the United States, health and medical insurance advertisers need Google certification. Speculative and experimental treatments are restricted.

Targeting is narrower too. Google lists health as a sensitive interest category in its personalized advertising policy. Advertisers promoting in those categories cannot use advertiser-curated audiences such as Customer Match, your own data segments or lookalike segments. Plan a patient campaign around search intent and location, not around a list of past patients.

B2B leads: selling into a health system

If you sell to providers, the lead is a meeting, and the buyer is a committee. Clinical, IT, security and finance each weigh in, and a programme that reaches only one of them produces meetings that stall.

• Write for each role. A clinical summary, a security and integration document, and a cost case: the pieces a champion forwards internally.
• Measure meetings held and opportunities opened, not form fills.
• Keep outbound clean. US commercial email has to follow the CAN-SPAM rules, including a working opt-out and a valid postal address, and the calling rules above still apply to mobile numbers.

Our guide to choosing a health care marketing agency covers the review chain an agency has to work inside, which applies to B2B healthcare content as much as to patient campaigns.

How to judge a healthcare lead generation agency

Ask these in writing before you sign.

1. What exactly is a lead? A form fill, a qualified call, a booked appointment, or an attended one. Price and report on the one that matters to you.
2. Where do your leads come from? Your own ads in your own account, or a network the agency runs and sells to several buyers. Shared leads are cheaper and reach competitors too.
3. Show us the consent language. For any lead you will call or text, see the exact words and confirm your business is named.
4. What tracking will you put on our site? Get a list of every pixel and tag, and where each one fires.
5. Will you sign a business associate agreement? It is required if the agency will handle patient information.
6. Who owns the accounts? The ad accounts, the call tracking numbers and the landing pages should be in your name.

Questions about lead generation in healthcare

Can a clinic pay a company per new patient?

For patients covered by Medicare, Medicaid or other federal programs, paying per referral can fall under the federal Anti-Kickback Statute, and many states have their own rules. Have a healthcare lawyer review any per-patient or per-lead price before you agree to it.

Can we use the Meta or Google pixel on a medical website?

On logged-in pages, booking flows and intake forms, only with a vendor that will sign a business associate agreement and a setup that keeps health detail out of what is sent. A court vacated the part of the HHS guidance about IP addresses on public, logged-out pages in June 2024, but the rest of the guidance stands.

Do we need consent to text a patient lead?

For marketing texts sent with an autodialer, yes: prior express written consent that names your business. Health care messages from a covered entity have their own exception under the TCPA rules, but promotional offers are not covered by it.

When can B2B lead generation in healthcare be judged?

Judge the targeting and the content first on meetings held, counted in your CRM each quarter, and closed deals on the buyer's own procurement cycle, which often runs for several months. How many meetings come depends on competition, your offer and your budget.

The referral that now starts in a chat window

Both kinds of healthcare buyer now ask an assistant before they search. A patient asks ChatGPT which clinics near them treat a condition. A practice manager asks Gemini which scheduling software suits a small group practice. The answer names two or three, with no lead form in between. Whether you are named depends on what the assistant can read about you: your own pages, directories, reviews and articles from other sites. That is a separate channel from paid lead generation, and AI Knows Us is built to measure it, by asking the questions your patients or buyers ask and showing which names come back and why.