Meta Ads for Healthcare: HIPAA, Pixels, and Rejections

Your medspa ad ran for six weeks. Then four ads got rejected in a single morning, the same creative you have used since spring, and the appeal came back declined with a link to a policy page that explains nothing. Meanwhile your compliance officer just asked whether the Meta pixel on your booking page is a HIPAA problem.

These are two different problems with two different fixes, and almost every agency conflates them. One is an ad-copy pattern. The other is a tracking-architecture problem that no amount of ad rewriting will solve. Here is how each one actually works, straight from Meta's published standards and the HHS guidance, with the copy rewrites and the tracking setup we would ship.

One caveat up front, stated plainly: this is an operator's guide to the policies, not legal advice. HIPAA exposure depends on facts we cannot see from here. Have your counsel or privacy officer sign off on the tracking design before you deploy it.

Why do healthcare ads keep getting rejected on Meta?

Three Meta policies catch almost all clinic rejections: Privacy Violations and Personal Attributes, Health and Wellness, and Drugs and Pharmaceuticals. The first is the one nobody expects, because the copy that trips it reads like normal, empathetic marketing.

Rejections arrive in waves because review is partly automated and models get re-tuned. An ad that ran clean for months can be re-reviewed and pulled without a single edit on your end. That is not a bug you can appeal your way out of — it is a signal that the creative was always sitting on the wrong side of a policy line and just had not been caught yet.

Notice what is not on that list: your landing page, your budget, your targeting. Those matter for performance. They are rarely why the ad got killed. If you are still guessing at the cause, the complete Meta ads guide for service businesses covers the delivery side; this post covers the compliance side.

What is the personal attributes policy, in plain English?

Meta's Advertising Standards state that ads must not contain content that asserts or implies personal attributes, and the listed attributes include a person's physical or mental health, including medical conditions (Meta Transparency Center, Privacy Violations and Personal Attributes). The policy also prohibits ads that imply the advertiser is aware of someone's medical information.

Read that twice. It is not about mentioning a condition. It is about implying you know the viewer has it. Meta's own overview says the point is that ads which make assumptions about people can feel intrusive, and that ads should focus on the benefits of the product or service instead.

Meta publishes the examples. Under the physical or mental health section, these are allowed: 'Bulimia counseling available', 'Depression counseling', 'New diabetes treatment available'. These are not: 'Do you have diabetes?', 'Depression getting you down? Get help now.' Under the age section, 'Our new lotion and creams fight wrinkles like never before!' is allowed and 'Ready to upgrade your skin to look younger?' is not.

That last pair is why medspa and dermatology accounts get hit hardest. The entire genre of second-person, pain-point ad copy that works in home services is a policy violation in healthcare.

How do you rewrite 'Struggling with X?' so it gets approved?

One rule covers roughly every rewrite: state the service, never the condition of the viewer. Meta's guidance explicitly allows using 'you' or 'your' without referencing a personal attribute — so the word is not banned, the assumption is.

The first two rows below are Meta's own published examples. The rest apply the same pattern to the offers clinics commonly run — they are our rewrites, not Meta's rulings, so treat them as a pattern to test, not a guarantee.

The pattern is boring and it works: name the service, name the city, name the price or the next step. It also happens to be better direct response than the pain-point hook, because it pre-qualifies. Someone who clicks 'Back pain treatment in Austin' is already looking for treatment. Someone who clicks 'Struggling with back pain?' might just be curious.

Rewrite the headline, the primary text, and the image overlay. Reviewers read the creative as a whole, and a clean headline over an image that says 'Feeling anxious?' still gets pulled.

Can you run before-and-after photos at all?

Sometimes — the rule turns on the category and the format, not on whether the photo is real. Meta's Health and Wellness standard prohibits side-by-side comparisons showing a transformation for weight loss, and prohibits side-by-side comparisons for wrinkle treatments such as Botox, dermal fillers, or any other anti-aging treatment (Meta Transparency Center, Health and Wellness).

But the same policy allows general cosmetic products, procedures, and surgeries to depict before-and-after transformation, as long as the ad does not employ negative self-perception tactics. It also says anti-aging treatments may show zoomed-in or close-up images of specific skin areas to demonstrate results, provided those depictions reflect realistic outcomes over time and are not side-by-side comparisons.

Two more constraints from the same page that people miss: ads promoting weight loss, dietary, or cosmetic products and procedures must be targeted to people at least 18 years or older, and no ad in this category may imply or attempt to generate negative self-perception. That second clause is a judgment call by a reviewer, which means the safe creative is a clinician talking, a facility tour, or a single treated result — not a shame-into-buying montage. Our medspa and cosmetic clinic playbook goes deeper on what actually converts in that vertical.

Is the Meta pixel on your patient-facing site a HIPAA liability?

It can be, and the risk is concentrated on exactly two kinds of pages. HHS Office for Civil Rights guidance states that tracking technologies on user-authenticated webpages — a patient portal, a telehealth platform — generally have access to protected health information, and that tracking vendors receiving PHI on a covered entity's behalf are business associates who require a signed business associate agreement (HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities).

The second risk area is unauthenticated pages that collect health-related input. OCR's example: tracking technologies might collect an individual's email address, or the reason for seeking health care that they typed or selected, when they book an appointment or enter symptoms in an online tool. In that case, the guidance says, the regulated entity is disclosing PHI to the tracking vendor. Portal login and registration pages are called out too — if the pixel captures login or registration information, OCR treats that as a PHI disclosure.

Three details from that guidance that change how you build:

• A cookie banner is not consent. OCR states that website banners asking users to accept or reject tracking technologies do not constitute a valid HIPAA authorization.
• A privacy-policy disclosure is not permission. The Privacy Rule does not permit disclosing PHI to a tracking vendor merely because you said so in your terms of use.
• A vendor promise to strip PHI is not enough. OCR states it is insufficient for a vendor to agree to remove or de-identify PHI after receiving it — disclosure without authorization still requires a signed BAA and a Privacy Rule permission.

One honest caveat, because you will hear it from your attorney: on June 20, 2024, a federal district court vacated part of this guidance — specifically the portion saying HIPAA obligations are triggered when a tracking technology connects an IP address with a visit to an unauthenticated public webpage addressing specific health conditions or providers (Am. Hosp. Ass'n v. Becerra, N.D. Tex.). HHS notes the vacatur on the bulletin itself and says it is evaluating next steps. The portal, appointment, and symptom-checker language above was not what the court struck.

How do you track conversions without sending protected health information?

You send the event, not the context — one generic conversion signal, no condition, no page path, no free-text field. Meta does not need to know why the patient booked in order to optimize; it needs to know that a booking happened and which ad click preceded it.

That means a browser pixel firing on every page of a patient-facing site is the wrong architecture, because the URL itself often carries the condition. A page path like /treatments/hepatitis-c/schedule, sent automatically with the visitor's IP, is the exact shape of disclosure OCR describes. Server-side tracking fixes this by letting you decide, field by field, what leaves your infrastructure — our Meta Pixel and CAPI setup guide covers the plumbing.

OCR also names the escape hatch directly: if a tracking vendor will not sign a BAA, a covered entity may contract with a vendor that will — for example a customer data platform — to de-identify the tracking information that includes PHI before any of it reaches the tracking vendor. That is the pattern behind every compliant healthcare CAPI stack sold today. It is not a workaround; it is the one route the guidance itself describes.

What should a clinic's Meta tracking setup actually look like?

Four layers, and the first one is deletion — get the pixel off every authenticated and health-specific page before you build anything new. Here is the architecture we would ship for a clinic, in order.

The trade-off is real and you should hear it: strip the context and Meta's optimization gets a coarser signal. You lose the ability to optimize toward high-value procedure types inside the ad platform. You get that back in the CRM, where you belong anyway — measuring booked and kept appointments, not form fills. Every clinic we would work with owns its own ad account, its own pixel, and its own data, so this is your call and your asset, not the agency's.

Which healthcare offers should never run on Meta?

Anything requiring certification you do not have, plus anything whose entire hook is the viewer's condition. Meta's Drugs and Pharmaceuticals policy requires advertisers promoting prescription drugs to be actively certified with LegitScript (or, for manufacturers, cleared through Meta's internal review), authorized by Meta, targeting only the United States, Canada, or New Zealand, and only people 18 or older (Meta Transparency Center, Drugs and Pharmaceuticals).

Telehealth providers and online pharmaceutical sellers fall under the same LegitScript requirement. Notably, the policy says advertisers do not need written authorization to run ads that promote telehealth services generally — the line is drawn at promoting the prescription drug itself.

• Prescription drug promotion without LegitScript certification and Meta authorization — this is the compounded-GLP-1 trap, and it is an account-level risk, not an ad-level one.
• THC products and cannabis products with psychoactive components — prohibited outright. CBD requires LegitScript certification plus written Meta authorization and is US-only.
• Any offer whose hook only works by naming the viewer's condition — if the ad stops making sense once you remove 'do you have', the offer is wrong for the channel.
• Crisis-intent behavioral health offers — the demand is real, but the compliant creative is weak, and search usually converts better. See our take on behavioral health lead generation.

There is a version of this that we would just not run. If your entire economics depend on interrupting a person with their own diagnosis, Meta is a hostile channel and no clever rewrite fixes that. Put the budget into search, where the patient names the condition first and you are answering, not asserting. Our healthcare SEO playbook is the compliance-aware version of that argument.

What should you do this week?

Two audits, in this order, and neither takes more than a day. First, export every active ad and flag any headline, primary text, or image overlay that asks the reader about themselves. Rewrite those to name the service. Second, load your booking page and your portal login with the browser network tab open and watch what fires to Meta. If a request leaves carrying a condition-specific URL or a form field, you have a tracking problem that copy edits will never fix.

If you want a second pair of eyes on both, that is what our paid ads program does — compliant creative, clean server-side measurement, month to month, no lock-in, and you keep the ad account. Get my free audit and we will tell you which of your ads are one review cycle away from a rejection wave.