The challenge
Cascade ran 14 outpatient clinics across three states. They came to us wanting more patient bookings. Within the first week of the audit we found something more urgent: their marketing site had a standard Meta pixel and a Google Ads tag firing on condition-specific pages and on the appointment confirmation screen — meaning URL paths and page titles containing diagnosis information had been transmitted to ad platforms for roughly two years. Nobody had done anything reckless; the tags had been added by a previous vendor and the compliance team had never been shown the tracking architecture.
What we did
Stopped the exposure before anything else
We disabled the offending tags within 48 hours and documented the scope for their compliance counsel — which pages, which parameters, what date range. That documentation mattered more to them than any marketing deliverable we produced all year.
Rebuilt measurement privacy-safe
Server-side tracking with condition context and identifiers stripped before transmission, BAA-covered vendors only, and aggregate conversion modelling for campaign optimization. Retargeting was restricted to non-condition-specific pages, with the boundary written down so future vendors inherit the rule rather than rediscovering it.
Rebuilt intake around anxiety, not efficiency
The old form asked 14 questions on one screen including insurance details up front. We split it into three steps, moved insurance to after the slot was held, added saved progress, and explained why each sensitive field was needed. Completion rose 147% without removing a single required field.
Made clinical authority visible
Every condition page was rebuilt with a named clinician author, credentials, a visible medical review date, and cited sources. Their clinicians had the expertise all along — it simply wasn't on the page in any form Google could assess.
The result
Online bookings grew 218% over thirteen months and organic traffic to condition pages grew 312%. The compliance remediation is the outcome their board cared about most: a documented architecture, zero PHI events reaching ad platforms, and a written policy their next vendor inherits.
“We hired a marketing agency and got told, in week one, that we had a privacy problem nobody had spotted in two years. That conversation was not what we expected and it was the most valuable thing anyone has done for us.”