How ClinicRankPro handles compliance for clinics in Texas
ClinicRankPro is a marketer, not a covered entity, and the rules below keep it that way. We never handle patient information, we sign a Business Associate Agreement when work requires one, we follow Google and FTC review rules, we write within Texas dental and medical advertising rules, and we build sites to accessibility standards.
Reviewed by [OWNER NAME], last reviewed 15 September 2026. This page describes our working practices. It is not legal advice; rules change, so check current board rules and ask your own counsel for anything specific to your practice.
How do you handle HIPAA and patient information?
By never receiving it. Marketing needs your name, address, hours, services, providers and insurance list, and nothing about any patient. The specific rules we work to:
- No PHI, ever. We do not accept patient records, appointment details, or anything that identifies a person as a patient. If it arrives by mistake, we delete it and tell you.
- Business Associate Agreement available. If you want call recordings reviewed, or any work that could touch patient data, we sign a BAA first, and the vendor involved signs one too. A template is ready.
- Review replies stay generic. A reply that confirms someone is a patient, or names their procedure, can be a disclosure. Ours say thank you and offer to help offline.
- Website forms collect the minimum. Name, phone, email, preferred time. No “reason for visit” free-text field.
- Call tracking. Recording is either off, or covered by a BAA with us and the call-tracking vendor.
- Analytics. No form contents or patient identifiers are sent to GA4 or any other tool.
- Photos. No patient photos or before-and-after images without specific written consent held by the practice.
What are your rules for reviews?
Ask everyone, offer nothing, fake nothing. These are Google’s policies and the FTC’s rules, and breaking them costs more than any review is worth.
| Rule | What it means | What we do instead |
|---|---|---|
| No review gating | Do not screen for happy patients before asking for a public review | Every patient gets the same request, by SMS or email within 24 hours, with a direct link |
| No incentives | No discounts, gifts, entries or credits for leaving a review | The request explains that a review helps other patients find care; that is the only ask |
| No fake or employee reviews | No staff, family, purchased or AI-written reviews | We flag any sign of it in an audit and will not work on a profile that relies on it |
| Attribute prompting is fine | Suggesting topics a patient might mention is allowed; suggesting sentiment is not | Requests mention topics: the treatment, how the team helped, how costs were explained |
| Respond to every review | Replies within 48 hours, calm, never arguing, never confirming anyone is a patient | Drafted by us, in your voice, for approval or auto-posted after month one if you prefer |
What medical advertising rules do you write within?
The rules of the board that licenses your providers, plus the general rule that nothing we publish may be false, misleading or unsubstantiated. The words we do not use, on any clinic’s site or profile: “guaranteed”, “painless”, “permanent”, “cure”, “best”, “#1”, or any superlative that a named award does not support. The Texas boards that apply most often:
- Texas State Board of Dental Examiners. Governs dental advertising under the Texas Dental Practice Act and the board’s rules. In our work the points that matter are: no false or misleading statements; restrictions on how “specialist” and specialty areas may be advertised, with requirements for how a general dentist describes specialty services; and requirements for identifying the dentist responsible when advertising under a practice or trade name. The specifics have changed in recent years, so we confirm current board rules with you at onboarding.
- Texas Medical Board. Has rules on physician advertising, including restrictions on which certifying bodies may be cited for a “board certified” claim, and on testimonials and claims that could mislead. Non-surgical cosmetic procedures performed under physician delegation, as in most med spas, fall under these rules too. Check current board rules for your specialty.
- Texas Board of Chiropractic Examiners and Texas Board of Physical Therapy Examiners. Each has its own advertising rules. Across Texas healing-arts licence types, a practitioner who uses “Dr.” in advertising is expected to identify the type of licence held. We use full credentials everywhere.
- Federal. FTC rules on endorsements, testimonials and undisclosed promotion apply to every practice. Nobody at ClinicRankPro or at your clinic posts recommendations for the clinic in forums or groups without saying who they are.
- Google Ads. Google’s healthcare and medicines policy restricts certain treatments and remarketing to health conditions, and requires certification for some categories. Checked per treatment before any ad runs.
Beyond the rules, every clinical page gets four things: a licensed provider at your practice credited as reviewer with a date; each sentence written to be accurate on its own, because AI assistants quote passages without their context; prices stated as ranges or “from” figures with a date; and your written approval before it goes live. The contract makes the practice responsible for the legality of claims it approves, and makes us responsible for flagging risks.
How do you handle accessibility on sites you build?
We aim for WCAG 2.1 AA on every site we build, check it at launch, and recommend an accessibility statement page. We do not sell “ADA compliance”, because no vendor can promise a lawsuit will not come; we sell reduced risk and a site more people can use. Healthcare sites are a frequent target of accessibility claims in the US, so the check happens at onboarding for existing sites as well:
- Automated check with Lighthouse and axe, then a manual pass
- Colour contrast, alt text on every meaningful image, labelled form fields, keyboard navigation, focus states, skip links
- No text in images for key information such as hours or phone numbers
- Clickable phone numbers and readable font sizes on mobile
- An accessibility statement with a contact for problems
What about tracking pixels on healthcare websites?
Keep them off any page after login and never send them health information. US regulators have taken action over tracking pixels on healthcare sites that passed appointment or condition details to advertising platforms. Our setup on every client site:
- GA4 and call tracking on public marketing pages, configured so no form contents, URLs with identifiers, or health details are sent
- No pixels of any kind on patient-portal, booking-confirmation or post-login pages
- Advertising pixels (Google Ads, Meta) only with a privacy notice, only on marketing pages, and reviewed against the platform’s healthcare policy
- A privacy policy that lists what is collected and why; see ours as an example
How do you keep records?
Every approval in writing and a change log per client. Content approvals, profile changes and review replies are kept by email. The change log records what changed and when. Both protect you if a question comes up and both make a handover simple if you ever leave. Your ownership of every account is written into the terms.
Frequently asked questions
Are you a HIPAA covered entity or a business associate?
Neither, by design. Marketing does not need patient information and we do not accept it. If a client wants call recordings reviewed or any other work that could touch patient data, we sign a Business Associate Agreement first. A template is ready.
Will you sign a BAA?
Yes, when the work requires one. Most of our work does not, because we never receive patient information. Call recording review is the usual trigger, and the call-tracking vendor must sign one too.
Can you help us get more five-star reviews by asking only happy patients?
No. That is review gating, which Google prohibits and the FTC has fined. We ask every patient, make it easy, and never offer anything in return. Reviews that mention the treatment and the experience are what rank and what AI assistants match against, so the method works without filtering.
Who is responsible if a claim on our website breaks a board rule?
The practice is responsible for the legality of medical claims in content it approves, and the contract says so. Our job is to write conservatively, credit a licensed provider as reviewer, flag anything we think is a risk, and never publish without your approval. We are not your regulator or your lawyer.
Do you make websites ADA compliant?
We do not sell compliance, because no vendor can promise it. On every site we build we run an accessibility check at launch, fix contrast, alt text, form labels and keyboard navigation, aim for WCAG 2.1 AA, and recommend an accessibility statement page. That reduces risk and makes the site easier to use.
Can we keep our Facebook pixel and Google Ads tag on the site?
On public marketing pages, usually yes, with a privacy notice. Not on any page after a patient logs in, books, or submits health information, and never configured to send form contents or patient identifiers. Regulators have acted on tracking pixels on healthcare sites, so we keep them off those pages.
What happens to the AI llms.txt file if our services change?
We update it. It is a public factual statement about the practice, kept in sync with the site and profile, and never used for marketing claims. Assistants quote it, so it has to be right. See AI search visibility.
Related: SEO for med spas, SEO for medical practices, dental SEO.