Most "Google Ads for doctors" guides skip the one thing that actually breaks campaigns: Google doesn't let healthcare advertisers run ads the way every other industry does, and the platform doesn't sign a HIPAA agreement to protect you if your tracking slips up. Here's the outline that accounts for both, plus the SEO half most guides bolt on as an afterthought.
In May 2025, Google quietly changed one of the more consequential rules in healthcare advertising: personalized-ad restrictions stopped applying to campaigns aimed at licensed healthcare professionals in their professional capacity. Almost nothing written about "Google Ads for doctors" since then has mentioned it, which tells you most of what's out there was written without checking the policy itself. That's the gap this outline is built to close.
A complete Google Ads strategy for doctors has to solve five problems most guides skip: Google's Healthcare and Medicines ad policy restricts what you can target and say, Google Ads doesn't sign a HIPAA Business Associate Agreement so compliant conversion tracking has to be engineered on your side, CPC runs $5-9+ depending on specialty, keyword strategy has to go beyond "[specialty] near me," and SEO has to run alongside paid from day one, not get added later once the ad budget runs out.
Two constraints shape everything else in this outline, and most content about this topic mentions neither. First, Google's Healthcare and Medicines policy bans personalized advertising based on physical or mental health conditions, chronic disease management, invasive procedures and anything tied to intimate body parts or functions, for ads shown to consumers. That rules out remarketing to "everyone who viewed the psoriasis treatment page," even though nothing technically stops you from building that audience.
Second, Google Ads does not offer a Business Associate Agreement, the contract HIPAA requires before a third party can touch protected health information. The default conversion tracking setup sends the page URL, cookies and IP address to Google the moment a patient books, and if that URL contains a condition or procedure name, you've just transmitted PHI to a vendor with no BAA in place. Compliance here isn't a settings checkbox, it's an architecture decision.
1. A campaign structure that respects the policy, and the certification list. Build campaigns around conditions and procedures, not around "everyone who might need a doctor." Skip condition-based remarketing audiences entirely for consumer-facing campaigns; if you also market to other clinicians, that audience can use the 2025 personalization carve-out, but it needs its own, separately managed campaign. Check the certification list before launch, too: addiction treatment, online pharmacies and telehealth prescribing all require LegitScript certification before Google approves the ads at all, and that process alone can take several weeks. Missing it is the single most common reason a healthcare account gets suspended before it spends a dollar.
2. HIPAA-safe conversion tracking. Route conversion events through server-side tracking, so PHI gets stripped on your own server before anything reaches Google, instead of firing a tag directly from the patient's browser. This is the single most commonly skipped step in every "Google Ads for doctors" guide we've reviewed, including the one most people find first.
3. Keywords built around real intent, with match types doing real work. "[Specialty] near me" converts worse than procedure and symptom-specific terms layered with insurance-accepted and "accepting new patients" modifiers. Run those terms on phrase and exact match, not broad, since broad match on medical terms burns budget on research queries and unrelated conditions fast; a shared negative keyword list (free, low-cost, symptoms of unrelated conditions) does more to control cost per lead than almost any bid adjustment.
4. Ad extensions, and Local Services Ads where they're eligible. Call extensions and location extensions carry the most weight since medical intent is high and frequently mobile. Sitelinks should point to individual procedure pages, not a generic services page, and structured snippets listing accepted insurance filter out mismatched clicks before they cost you money. For eligible specialties, Local Services Ads run alongside standard Search, on a pay-per-lead model with a Google Screened badge that requires background and license verification, sitting above regular Search ads in the results.
5. SEO running in parallel, not bolted on afterward. Schema markup (Physician or MedicalOrganization, plus the individual doctor's credentials), NPI number and state medical board references, and content written to survive Google's YMYL (Your Money or Your Life) scrutiny all compound slowly. Starting this the same month you launch ads means it's actually contributing by the time ad costs start to bite.
Treat these as a planning range, not a quote, since local competition and Quality Score move the real number in either direction. Industry benchmark reports put general practice and family medicine around $5.47 CPC, dermatology near $4.90, physical therapy around $4.95, and urology near $5.64. Procedure-heavy specialties run higher: cosmetic surgery and orthopedics have both been reported above $8. Conversion rates across healthcare campaigns have been reported in the 3-5% range on average, with cost per lead frequently landing somewhere in the $40-80 range for primary care and well past $100 for elective procedure specialties like cosmetic surgery, depending on specialty and market.
A Google Ads account for a medical practice that ignores HIPAA exposure isn't cutting a corner, it's running on borrowed time until someone notices.
Knowing that Google won't sign a BAA is step one. The actual fix is architectural, and it comes down to three pieces working together. Server-side tagging processes the conversion event on your own server first, strips anything tied to a specific condition or patient identity, and only then forwards a de-identified conversion signal to Google, instead of letting the patient's browser fire a tag directly at Google with the full page URL and IP address attached. Offline conversion import lets you upload booked-appointment or closed-patient data back into Google Ads on a delay, matched to an anonymized click ID rather than a name or diagnosis, which also fixes the attribution gap when the actual booking happens over the phone or inside a separate EHR or PMS system. Enhanced conversions, Google's own hashed first-party data matching, should only ever receive hashed contact fields (email, phone), never anything describing the visit itself. None of this is exotic; it's standard server-side analytics architecture, applied to a sector where getting it wrong has legal consequences most other advertisers don't face.
The SEO half of this outline isn't a separate project, it's the thing that determines whether your cost per patient goes down over time or stays flat. Physician and MedicalOrganization schema help Google understand who's behind a page and what they're qualified to say, which matters directly for YMYL content standards. Citing the doctor's NPI number and state medical board registration on the About page is a small, often-skipped detail that adds a verifiable authority signal most competitor pages don't bother with. A complete Google Business Profile, updated with real photos, accurate specialty categories and a consistent posting cadence, still drives the fastest visible movement of anything on this list, usually inside the first 60-90 days. Content written around the same procedure and symptom terms your ads target, rather than generic "our services" copy, lets the two channels reinforce each other instead of running as unrelated efforts.
Google Ads can put a compliant campaign in front of patients within days of launch, which is exactly why it's worth running even while SEO is still building. Google Business Profile visibility typically moves within 60-90 days. Procedure-page rankings and the content built around them take longer, often 6-9 months before they're carrying meaningful organic volume. The point of running both from day one isn't redundancy, it's that ads cover the gap while SEO is still compounding, and once a keyword starts ranking organically, that's the signal to pull it back out of the paid budget and let it convert for free.
DIY makes sense for a single-location practice willing to learn the policy restrictions in detail and set up server-side tracking correctly, in a specialty where CPC is still in the $4-5 range.
Hiring a dedicated team makes sense once you're managing multiple locations, competing in a specialty where CPC runs past $7, dealing with a LegitScript-restricted category, or you don't have someone in-house who can confidently say whether a given campaign setup is HIPAA-compliant.
It depends who the ad targets. As of May 2025, Google's personalized-advertising restrictions no longer apply to campaigns aimed at licensed healthcare professionals in their professional capacity, which opened up remarketing and Customer Match for B2B health advertisers. Consumer-facing ads are a different story: Google still bans personalization based on physical or mental health conditions, chronic disease management, procedures and anything tied to intimate body parts or functions.
No, and Google says so directly, it does not offer a Business Associate Agreement for Google Ads or standard Google Analytics. The default conversion tracking setup sends the page URL, cookies and IP address to Google the moment someone books an appointment, and if that URL contains a condition or procedure name, that combination is PHI. Compliance has to be engineered on your side through server-side tracking, not assumed from the platform.
It varies a lot by specialty. Industry benchmark reports put general practice and family medicine around $5.47, dermatology near $4.90, and more competitive specialties like cosmetic surgery or orthopedics well above $8. Treat any single number as a starting estimate, not a guarantee, since your actual CPC depends on local competition and Quality Score.
Both, run for different jobs. Google Ads buys immediate visibility for procedure keywords your site hasn't earned organic rankings for yet; SEO compounds over months and eventually brings in patients at a lower cost per acquisition. Practices that run only one tend to either overpay for every new patient indefinitely, or wait too long for traffic that ads could have brought in from week one.
Carefully, and only for signals that don't reveal a health condition. Remarketing to "everyone who visited the site" or "everyone who started the contact form" is generally fine. Remarketing to "everyone who viewed the psoriasis treatment page" infers a medical condition and falls inside Google's restricted personalization categories, even though technically possible to set up.
Call extensions and location extensions do the most work since medical searches are high-intent and often mobile. Sitelink extensions pointing to individual procedure or specialty pages, and structured snippets listing accepted insurance, round out an account that's actually built for how patients search, not a generic template.
Procedure and symptom-specific terms outperform generic "[specialty] near me" searches because they signal real intent. Layering in insurance-accepted modifiers and "accepting new patients" phrasing filters out tire-kickers before the click, which keeps cost per lead down even in expensive specialties.
One campaign per location (or per specialty, if locations overlap in specialty), each pointing to a location-specific landing page that matches the ad copy, with a shared negative keyword list across the account to stop locations competing against each other for the same clicks.
Most specialties don't, but a specific list does. Addiction treatment, online pharmacies and telehealth prescribing all require LegitScript certification before Google will approve the ads at all, and the certification process alone can take several weeks. Skipping this step is the most common reason a healthcare account gets suspended before it ever spends a dollar.
For many specialties, yes. Local Services Ads run on a pay-per-lead model instead of pay-per-click, include a Google Screened badge that requires background and license verification, and sit above standard Search ads in the results. They work best alongside a Search campaign rather than instead of one, since LSA has a narrower set of eligible categories and caps how much ad copy you control.
Book a 30-minute call. We'll look at your current Google Ads conversion tracking, campaign structure and keyword strategy and tell you honestly what's exposed versus what's already solid, no generic audit deck.
The call is with me, not a salesperson.
Tracking, structure and compliance, together.
What to fix first, and what it costs.