Start with the three that cost only time: a complete Business Profile per location with reviews answered, a page per service line and clinician, and a website whose patient forms carry no ad tags. Then add recall and email within the rules, referral relationships, patient-question content, paid search by service and location, and a monthly count of booked patients.
The rules are the floor. No promised outcomes, no patient story without written authorization, no incentive for a review, no ad pixel on an appointment form, and no patient list handed to an ad platform or a partner. Everything here fits inside them.
Strategy 1: The Business Profile, per location
Most new patients find a practice on the map, and Google's guidance on local ranking says local results rest on relevance, distance and prominence, that a complete and accurate profile is more likely to show, that replying to reviews helps a business stand out, and that there is no way to pay for a better local ranking. Each location gets a verified profile with the practice's real name, the right category for the specialty, hours including walk-in and holiday hours, the services listed by name, insurance accepted where you choose to show it, photos of the real waiting room, rooms and team, and a link to a booking page built as strategy 3 requires. Clinicians may hold their own profiles where Google's guidelines allow, each naming the practice. Update the profile the day hours or clinicians change.
Strategy 2: Reviews, asked for from every patient within the rules
Reviews decide which practice a new patient calls. BrightLocal's 2026 survey of 1,002 US adults, summarized by PinMeTo, found that 41% always read reviews when choosing a local business, that 31% will only use a business rated 4.5 stars or higher, that 74% look for reviews from the last three months, that 80% are more likely to use a business that replies to all its reviews, and that templated replies put off 50%.
Three rules govern how a practice earns them. Google's Maps content policy forbids any incentive for a review and forbids asking only happy patients or discouraging critical ones, and the FTC's 2024 rule bans bought and fake reviews. HIPAA means a reply must never confirm that the reviewer is a patient or say anything about their care, even to correct them; thank them, speak generally about how the practice handles concerns, and invite them to call. And a patient's story, name or photo in your own marketing needs the patient's written authorization. Ask every patient after the visit, by text or email with a direct link, offer nothing, and reply to every review within the week.
Strategy 3: A website with a page per service and per clinician, and no ad tags on patient forms
The website turns a found practice into a booked one. Build a page per service line, in the patient's words, that explains what the visit involves, who it is for, what to bring, what it costs or how billing works where you choose to publish it, and how to book; a page per clinician with credentials, training, languages and a photo; a page per location; and a booking path that works on a phone. Google's helpful content guidance asks whether a page shows first-hand expertise and is written or reviewed by someone who knows the topic, and names trust as the most important quality, so each service page is written or reviewed by the clinician who provides it and says so.
The patient side of the site follows HHS's tracking guidance: no ad pixels, retargeting or session recording on appointment forms, symptom tools, portal login or registration pages without a business associate agreement, and no cookie banner mistaken for an authorization. Our guides to HIPAA-compliant website design and medical website design cover the two halves.
Strategy 4: Recall, reminders and email, within HIPAA and the email laws
The patients you already have are the cheapest appointments you will book. HHS's marketing guidance treats refill and appointment reminders as treatment communications that are not marketing, and treats a covered entity's communications about its own health-related products and services as outside the definition of marketing that needs authorization; marketing a third party's product or sharing a patient list requires each patient's written authorization, with any payment stated. So recall campaigns for overdue checkups, reminders, and a note about a new clinician or service at your own practice are generally within the exceptions; a partner's offer or an upload of your patient list to an ad platform is not. Email also sits under the FTC's CAN-SPAM guide in the USA, which requires accurate headers, identification as an advertisement where the message is one, a postal address and an opt-out honored within 10 business days, with penalties up to $53,088 per email, and under CASL in Canada, which requires consent before a commercial electronic message. Keep treatment messages and promotional messages separate, and ask counsel before any campaign that touches the patient record.
Strategy 5: Referral relationships, kept warm
For specialists, referring physicians are the main source of new patients, and for primary care, other clinicians, pharmacies, schools and employers refer. Keep a referrer list by name, make referring easy with a direct line and a fast report back, visit or call on a schedule with something useful, and track referrals as a source in the monthly count. Reward nothing; the anti-kickback and fee-splitting rules in your jurisdiction make gifts for referrals a legal question, not a marketing one, and counsel should see any arrangement before it starts.
Strategy 6: Content that answers what patients ask
Patients search for their symptoms, their condition, their procedure and their insurance before they search for a practice. A short page per question patients ask at the front desk and in the room, written or reviewed by a named clinician with credentials, dated and sourced, brings people who will need an appointment and earns trust before the first visit. The FTC's Health Products Compliance Guidance is the limit: health benefit claims need competent and reliable scientific evidence, before-and-after images and testimonials convey claims, and “results not typical” does not cure a misleading impression. Describe conditions, options and risks; promise nothing. Our content marketing page covers how we draft with a clinical team.
Strategy 7: Paid search by service and location
Paid search on service and location terms brings patients who need an appointment now, and it is run by service line and location with a landing page and budget each, so spend moves to the locations with capacity. The audiences are built from search terms and geography, never from patient data without authorization; the landing pages are the patient-side pages built as strategy 3 requires; the conversion count comes from a method your compliance review has approved, with no pixel reading form fields; and the ad copy follows strategy 6's limits. Count booked appointments per campaign. Clicks are context only.
Strategy 8: Count booked patients by source, monthly
The habit that makes the other seven worth doing: a monthly count of booked and kept appointments by source (profile, website, referral, email, paid search, walk-in), by location and by service line, from the practice management system and a question at check-in, counted through a method your compliance review has approved and never by sending patient details to an ad platform. After three months the count shows which strategies fill the schedule at which location; keep those. The kept guide to digital marketing for dentists applies the same count to a dental practice.
If you want it run with you
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. Our local SEO page covers the Business Profile, reviews and location pages, our content planning and writing page covers patient-question content with your clinicians, and our healthcare industry page list the sectors we work with. We are a marketing company: we do not certify compliance and we do not call ourselves HIPAA compliant, and we sign HIPAA business associate agreements where our work touches patient data. This guide is general information, not legal advice.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.