Google Ads, CRO and SEO for chiropractic and physical therapy clinics

Where it leaks. Meta rejects ads that assert or imply a person’s physical health, so “Is back pain keeping you up?” won’t run, while “Back pain treatment, same-week visits” can. On Google, once the ads or site count as personal health content, such as treatment for a chronic condition like arthritis, remarketing lists and Customer Match can’t be used, and Google’s healthcare policy doesn’t let clinics promote PRP or stem cell therapy.

What we change. Ad copy describes the service and the first visit, never the person reading it. Search campaigns are split by service and by insured versus self-pay, and reach comes from what people search and where they live, not from remarketing lists.

Where it leaks. Patients want three answers before they book: can I come without a referral, do you take my insurance, and what will it cost. The referral answer depends on the state. All 50 states allow some direct access to a physical therapist, but 29 states and DC attach conditions, such as Texas’s 30 consecutive days without a referral or New York’s 10 visits or 30 days. Medicare needs no referral, but a physician or other practitioner must certify the plan of care.

What we change. The first screen answers all three for your state and your payers: the referral rule in plain words, the plans you’re in network with, and the self-pay price of a first visit. Self-pay patients who book three or more business days ahead are owed a good faith estimate, so it’s built into the self-pay booking path.

Where it leaks. HHS guidance still treats an email address or a reason for the visit typed into a covered clinic’s booking form as protected health information, so a Google or Meta tag on that page discloses it to the ad platform. Meta’s lead forms can’t ask about health conditions or insurance without Meta’s prior permission.

What we change. Ad and analytics tags come off booking, intake and portal pages. Ad forms ask for a name, a phone number and a preferred time, and insurance and the reason for the visit are collected in the clinic’s own intake. Calls from ads ring a line someone answers during clinic hours.

Where it leaks. A booked slot isn’t a patient until they walk in, and the revenue sits in the plan of care, which sets the type, amount, duration and frequency of visits. Campaigns judged on bookings keep paying for the sources with the most no-shows.

What we change. We report the booked-to-seen rate by campaign and move budget toward the sources whose patients show up and come back. A confirmation and a short “what to bring” page go out before every first visit.

Where it leaks. Ad platforms count clicks and form fills, the clinic’s software counts visits, and nothing joins the two. Uploading patient lists or visit records to Google or Meta to close the gap sends protected health information to a vendor, which HHS says needs a business associate agreement or each patient’s authorization, and Google offers no business associate agreement for Google Analytics.

What we change. Each booking carries its source, such as the campaign, keyword or call, into the clinic’s scheduling system, and new patients seen are counted there and reported by campaign as totals. If booking events need to reach the ad platforms, they go through a server-side setup run by a vendor that signs a business associate agreement and de-identifies the data first, the route HHS’s guidance describes.

Where it leaks. Google bans offering anything for a review and asking only happy patients, and the FTC’s reviews rule bars incentives tied to positive reviews. Replies carry a privacy risk too: HHS has settled with practices that disclosed patient details when answering reviews, and in September 2025 a group of Delaware rehabilitation and nursing providers paid $182,000 over patient “success stories” posted without written authorization.

What we change. Every patient gets the same review request at the same point, such as discharge, and replies thank the reviewer without confirming they were treated. Patient stories run only with a signed HIPAA authorization. Google Business Profiles follow Google’s practitioner rules: one profile for the clinic, and separate ones for public-facing practitioners under their own names.