Why this list exists
We are an agency, so read this knowing that. It is the list we would want a practice to use on us. The failures it guards against are common and expensive: a practice that cannot change its own website because the domain is registered to a former contractor, a booking form that emailed patient details to a marketing tool nobody vetted, a star rating that rose suspiciously fast and then disappeared.
Google’s own advice to site owners hiring an SEO is blunt: "You are ultimately responsible for the actions of any companies you hire."1 The same is true under the FTC and HIPAA. The agency does the work; the practice carries the consequences.
Question 1: what results do you promise, and by when?
Google suggests asking a prospective SEO what results they expect and in what timeframe, whether they follow Google Search Essentials, and for examples of previous work.1 Listen for the shape of the answer. A good one talks about what will be done, how progress will be measured, and what is outside anyone’s control.
A bad one guarantees positions. Google’s page says "No one can guarantee a #1 ranking on Google" and warns against anyone who claims a special relationship with Google or a priority submission service.1 The same applies, even more so, to anyone guaranteeing that ChatGPT or another AI assistant will recommend you. Those answers change by phrasing, by day and by model version, as covered in becoming the practice AI recommends.
Question 2: how will you get links and reviews?
Google’s spam policies name buying or selling links for ranking purposes, including exchanging money for links or for posts that contain links, as link spam.2 They also define scaled content abuse as generating many pages mainly to manipulate rankings rather than help users.2 If the plan includes a hundred city pages or a monthly bundle of purchased guest posts, it is a plan Google has written a policy against.
Reviews are where the legal exposure sits. The FTC’s Consumer Review Rule makes it a violation for a business to write, create or sell a review that misrepresents whether the reviewer exists or had any experience with the business, and to buy such a review or cause it to be disseminated when it knew or should have known it was fake.4 An agency that "handles reviews" for you by buying them puts your practice in that sentence. How to ask patients for reviews the right way is in the FTC Consumer Review Rule for practices.
Question 3: will you touch patient information?
HHS describes a business associate as a person or organization that performs functions or services for a covered entity that involve the use or disclosure of protected health information. A covered practice may share PHI with one only after getting satisfactory assurances in a written contract, the Business Associate Agreement, that it will safeguard the information.3 HHS lists data analysis and practice management among the activities that can make a vendor a business associate.3
For a marketing agency the usual routes to PHI are: contact and booking forms whose submissions pass through the agency’s tools, call recordings, uploading patient email lists to build ad audiences, and review-request systems that pull names and visit dates from your practice software. Ask the agency to list every one of these it will use. If any apply, you need a BAA before work starts. If the agency says it does not sign them, it should be able to show that none of that data reaches it. How analytics and call tracking can stay clear of PHI is in measuring marketing without leaking patient data.
Question 4: who will own the accounts?
This is the one that costs the most when it goes wrong, and the easiest to get right on day one. ICANN’s statement of registrant rights and responsibilities says the registrant assumes sole responsibility for the registration and use of the domain name, and must keep accurate contact details on file.6 The registrant should be the practice, with the owner’s email, not the agency’s.
The same applies to the Google Business Profile. Google lets a profile have several owners but only one primary owner, and managers have nearly the same access except that they cannot add or remove users or remove the profile.5 The practice should be the primary owner. The agency gets manager access, which is enough to do the work and easy to remove when the contract ends.
| You ask | Warning answer | Why it matters |
|---|---|---|
| What rankings can you get us? | "We guarantee page one" | Google says no one can guarantee a number one ranking |
| How do you build links? | "We buy placements monthly" | Buying links for ranking is link spam under Google’s policies |
| How do you get reviews? | "We post them for you" | Fake reviews are banned under the FTC rule |
| Will you sign a BAA? | "We never do" (while running your forms) | A vendor handling PHI for a covered practice needs one |
| Whose name is the domain in? | "Ours, it is simpler" | The registrant carries responsibility for the domain |
| What access do you need to our profile? | "Primary owner" | Manager access is enough to do the work |
The checklist to take into the meeting
- Ask what results they expect, in what timeframe, and how they will measure them. Reject guarantees.
- Ask how they earn links and reviews. Reject anything bought.
- Ask them to list every way patient information could reach their tools. Get a BAA if any apply.
- Keep the domain, hosting, Google Business Profile, analytics and ad accounts in the practice’s name. Grant the agency user access.
- Ask who writes health claims, and who at your practice approves them before publishing.
- Ask what you receive when the contract ends: files, logins, and a list of everything they set up.
If you want an independent look at what your current agency has set up, including who owns what, that is what the credibility audit is for. This post explains the published rules. It is not legal advice, and a BAA or agency contract should be reviewed by a healthcare attorney.