Running the pre-launch marketing compliance review

The campaign is built. Media books Monday, the testimonial video is rendered at three aspect ratios, and the review request landed in three inboxes at 4pm Thursday. Someone has to sign. Who signs first, what they sign against, and what happens when a signature is skipped or given on a version that later changes: that is the machinery this lesson covers.

Everything the gate tests has been set up elsewhere in this module. The advertising-law standards the copy must clear, the proof file behind each outcome claim, the exclusion test on targeting, and the limits on patient data and outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.View full definition → contact each belong to a sibling lesson. Assume all four. Build the sign-off.

The gate: three signatures in sequence

No asset goes live until three reviewers sign, in this order:

1. Medical reviewer, a practicing clinician in the service line: is every clinical statement accurate and supportable?
2. Legal and compliance: does this asset, in each placement, meet the standards the earlier lessons set out?
3. Marketing owner: after the edits, does the message still sell anything?

Sequence is not cosmetic. Clinician first, because a claim that fails on the medicine is dead, and every hour legal spends wording its disclosure is wasted. Marketing last, because the owner has to accept the edited version as the thing they will spend against, instead of relitigating it two days after launch.

Name the tiebreaker before you need one. In most systems general counsel holds the veto and the CMO holds the delay-or-kill call on media already booked. Ambiguity there produces the "legal never actually said no" launch. The gate also needs teeth outside marketing: put an approval ID field on the agency's insertion order, and no ID means no placement.

Tier it, or the gate gets routed around

A mid-size system produces hundreds of assets a month. A gate that treats a service-line billboard and a recruitment social tile identically will be bypassed, quietly, by people under deadline. Tier one (outcome or comparative claims, prices, patient stories, anything targeted by condition) runs the full three signatures. Tier two (awareness copy with no objective claim) needs one legal reviewer working from a pre-cleared copy bank. Tier three (pre-approved templates) lets marketing self-certify against the checklist and log the ID. Volume moves down; clinician hours go to the fraction that carries real exposure.

Check 1: the evidence file, and word drift

Each objective claim arrives with the proof file the substantiation lesson describes. The gate does not build that file. It refuses assets that arrive without one. What the gate adds is what the proof file cannot contain:

• The shipped wording matches the wording the clinician approved. "Most patients go home the same day" and "you'll go home the same day" are different claims, and the second appears when a copywriter squeezes a headline into a character limit.
• Every source carries a date, an owner and a re-run path. Outcome figures pulled from the EHR reporting layer (Epic and its competitors sell that layer, and a report is only as stable as its filters) should cite the report name and run date, so a reviewer can reproduce the number in two years.
• Every claim carries an expiry. A same-day-discharge rate true of a 2024 cohort moves when the 2025 case mix shifts toward revisions. If the claim expires mid-flight, re-verify or drop it.

Keep the regulator's own text in the file rather than someone's summary of it: FTC Health Products Compliance Guidance.

Check 2: disclosures have to survive the cut-down

The master creative almost always clears. Violations happen in the derivatives: the 6-second pre-roll, the square tile, a search headline with 30 characters, an audio spot where an on-screen super does not exist.

• Paid testimonial: the compensation disclosure has to be readable in the placement it actually runs in, and audible where there is no screen. A four-second trim to hit a platform spec is the most common way it vanishes.
• Atypical results: if the featured patient recovered faster than most, "results vary" is the floor and a realistic range is better.
• Risk balance on elective surgery: omitting that it carries risk can itself mislead. One line, every placement.

So the gate approves placements and files, not concepts. An approval reading "knee campaign, approved" is worth nothing when a regulator names asset 27 of 40.

Check 3: what gets added after approval

Consent and outbound-contact limits belong to the HIPAA and TCPA lesson. The failure this gate exists to catch is the change made after sign-off.

Novant Health: in 2020 its marketing team added a Meta tracking pixel to a campaign promoting patient-portal signup. The creative was never the problem. The pixel transmitted data on more than a million patients, and the resulting class action settled for roughly $6.6 million, with notification, forensics and legal cost on top. Nobody re-opened the review when the tag went on.

Cerebral: in March 2023 the telehealth company notified around 3.1 million people that tracking technologies had shared their information with advertising platforms. The FTC's 2024 order required more than $7 million and restricted the company's use of health data for advertising. In July 2023 the FTC and HHS OCR had already sent joint warning letters to roughly 130 hospital systems and telehealth providers about the same class of tracking.

One edge case worth dating in your files: in June 2024 a federal court vacated part of OCR's online tracking guidance in a challenge brought by the American Hospital Association, narrowing one theory of HIPAA exposure while leaving the FTC's separate authority intact. Record which interpretation each approval relied on, and when. When the ground shifts, you know which approvals to re-open rather than guessing across three years of campaigns.

🎬 [VIDEO: "HIPAA and Marketing: What Providers Can and Can't Do" - youtube.com - a plain-language walkthrough of patient authorization and testimonial rules]

Fair-treatment and consumer-protection overlay

The exclusion test from the fair-treatment lesson runs inside this gate as well. What the gate contributes is procedural: require the targeting spec as an attached file (audiences, exclusions, geos, lookalike seeds), not a verbal summary in a stand-up. Reviewers cannot approve what they never saw, and "we assumed marketing had excluded that" reads badly in a deposition.

Also on the checklist:

• No manufactured urgency. "Only 3 slots left this month" on an elective procedure is a flag under unfair-practices standards.
• Advertised prices have to be real and reasonably complete. A "starting at" figure few patients pay draws a regulator and a plaintiff at the same time.
• If the campaign drives to a recurring-payment program (subscription telehealth, membership primary care), the cancellation path is part of the ad review. Cerebral's FTC order covered its cancellation practices as much as its data handling.

Running the gate in practice

One intake form. Claims matrix, source documents, disclosures listed by placement, consent files, targeting spec. Missing attachments get rejected on sight, no debate. That single rule reclaims more reviewer hours than anything else on this list.

Service levels, including nights. Three business days for standard review, one for minor edits, and a named on-call approver for reactive or news-driven posts. Without that name, the fastest-moving content is exactly the content that skips the gate.

Version-lock. Approval attaches to a specific file version. Swap the testimonial, trim a super, change the landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition →, add a tag: approval void, back in the gate. Most violations start with an approved version that was fine.

Build the file a plaintiff's attorney will ask for. Named approvers with timestamps, dated sources, the targeting spec, signed authorizations, and screenshots of the live placement. Ad platforms do not archive your creative for you, and "we believe the disclosure was present" is not evidence. Keep it for years: state consumer-protection claims arrive long after the flight ends.

Re-review on a calendar. Claims expire, surgeons leave, rankings get restated, and a page nobody has opened since 2024 is still live.

The knee campaign, cleared

The campaign from the opening cleared four days late. The superlative is gone. The robotic claim describes mechanism instead of outcome. The compensation disclosure survives in all nine placements including the pre-roll cut-down, the marketing authorization is signed and filed, the pixel configuration is documented with the date it was checked, and a risk line runs everywhere. Four days of slipped media is the price of the gate. The price of skipping it sits on Novant's settlement docket.

Key takeaways

• Three signatures in a fixed order: clinician, then legal, then the marketing owner who has to live with the edit. Name the tiebreaker before a launch date forces the question.
• Tier the gate by risk. Otherwise volume routes around it and clinician review time gets spent on social tiles instead of outcome claims.
• Approve placements and file versions, never concepts. Approval dies on any edit, including a four-second trim or a tag added after sign-off.
• The record is the defense: named approvers, dated sources, targeting spec, consent files, and screenshots of what actually ran.
• A skipped review is rarely priced in delayed launch. Novant Health's pixel settled for roughly $6.6 million; Cerebral notified about 3.1 million people and paid more than $7 million under the FTC's order.