NEMT marketing agency: what to pay for, who owns the accounts, and the agreements to sign first

A marketing agency can do real work for a ride company, and the three decisions that matter come before the first invoice. Pay a fixed fee for listed work. Keep every account in your own name. Sign a business associate agreement if the agency will see rider information. Those three keep the agency from becoming a legal problem or the holder of your website and phone calls.

This guide covers what agencies sell, how to pay one, who should own what, and what the contract should say. The marketing itself is in how to market a NEMT business, and the payment rules behind the fee advice are in the Anti-Kickback guide.

What do marketing agencies sell to ride companies?

The work agencies offer falls into six groups, and each carries something different to check.

• A website and booking forms. Check what the booking form asks. A form that asks about a condition or a diagnosis raises HIPAA questions, which the website guide covers.
• Local search and Business Profile work. Ask for a plan you can read against Google’s own advice on hiring an SEO, which the SEO guide summarizes, and keep the Business Profile in your name.
• Paid search and social ads. Check which account the ads run in, who pays the platform and whether you can see every campaign. Google Ads for NEMT covers what the ads should do.
• Review requests. The agency may ask your riders for reviews but may not write them or pay for them, as the FTC section below shows.
• Outreach to facilities and case managers. This is where the payment risk sits, because it is a conversation with the people who choose a ride company for a patient.
• Call tracking and reporting. Recordings of booking calls can hold health information, which the agreement section covers.

How should you pay a marketing agency?

Pay a fixed monthly fee for work listed in the contract. The structures an agency may offer differ in what the fee follows, and that decides whether the Anti-Kickback Statute comes into it.

Two sources give the table its footing.

OIG Advisory Opinion 98-4 (April 15, 1998) concerned a management company paid a percentage of a practice’s net revenue that included marketing. OIG wrote that “percentage compensation arrangements for marketing services may implicate the anti-kickback statute,” and that the statute reaches payment made to induce referral of business payable by a federal health care program. The conditions that protect a contractor’s pay under 42 CFR 1001.952(d) are listed in the Anti-Kickback guide. Two decide an agency fee: a term of at least one year, and a method of pay set in advance that ignores the volume or value of federal program business.

The Seventh Circuit gave marketers more room in United States v. Sorensen (April 14, 2025). The court reversed a conviction for payments to advertising companies, finding they were neither doctors in a position to refer patients nor other decisionmakers with “fluid, informal power and influence” over health care choices. It set those payees apart from people who use existing relationships with patients or providers. That decision binds only federal courts in the Seventh Circuit, which covers Illinois, Indiana and Wisconsin. An agency that phones discharge planners and case managers on your behalf looks more like a payee with relationships than an ad buyer. A per-lead fee for that outreach is a question for a health care lawyer, and a fixed fee for listed work avoids the question.

Who should own the domain and the ad accounts?

You should own every account, and the agency should have limited access that you can remove. Each platform makes this possible in its own way.

• The domain. Register it yourself, with an email address at your company. ICANN’s registrant rules say the registrant takes sole responsibility for the registration and its use and must keep the published registration details accurate and up to date.
• Google Business Profile. Owners can add and remove users and delete the profile. Managers have nearly the same access but cannot add or remove users or remove the profile. Only the primary owner can transfer primary ownership, and the primary owner cannot leave until someone else holds it. Keep primary ownership and make the agency a manager.
• Google Ads. The access levels are Email-only, Billing, Read-only, Standard and Admin, and only Admin can change other users’ access or accept a manager link request. A manager account that holds ownership can edit user access, managers and product links in your account, and an Admin of the client account can end the relationship at any time by unlinking. Keep at least one Admin from your company and do not hand ownership of your account to the agency.
• Meta. Create your own business portfolio and share your Page and ad account with the agency as a partner, with full control or partial access limited to tasks. Meta says only the organization that owns an asset can share it with another business portfolio, and it asks you to turn on two-factor authentication for your portfolio first.
• Everything else the agency sets up. Analytics, call tracking numbers, email lists and creative files should sit in accounts in your name or be handed over on request.

The test is simple. If the agency vanished tomorrow, you should be able to sign in to every one of these without its help.

When do you need a business associate agreement with the agency?

You need one when HIPAA covers your company and the agency will create, receive, maintain or transmit protected health information on your behalf. A business associate is a person who does that for a covered entity, and the definition also covers a person who provides services such as consulting, management or administration where the service involves disclosure of that information to the person. Whether your company is a covered entity or a business associate itself is the question in the HIPAA guide for NEMT.

If it is, these agency tasks usually count: a lead form where a rider describes a condition or appointment, a CRM with ride details, recordings of booking calls and reminder lists. Under 45 CFR 164.504(e) the contract must:

1. Set what the agency may do with the information and bar any other use.
2. Require safeguards and a report of any use or disclosure the contract does not allow, including a breach.
3. Bind any subcontractor that handles the information to the same terms, so a freelancer on the agency’s side needs one too.
4. Require the agency to return or destroy the information when the work ends, where that is feasible, and let you terminate if it breaks a material term.

The business associate agreement template has the fill-in version.

Tracking tools on your site are a separate question. In American Hospital Association v. Becerra (N.D. Tex. June 20, 2024), a federal court declared unlawful and vacated one part of HHS’s March 18, 2024 bulletin: the position that a tool linking a visitor’s IP address to a visit on a public webpage about a health condition or provider handles protected information. The court wrote that its order does not limit the other guidance in the bulletin. That leaves a tracking tool on a booking form, where riders type health details, as a question for your privacy officer and your lawyer.

What does the FTC rule mean for reviews an agency collects?

It means the agency may ask but may not write, buy or fake. Under 16 CFR 465.2(a), a business may not write or sell a review or testimonial that materially misrepresents whether the reviewer exists, had the experience or what it was. Section 465.4 bars paying or rewarding a review conditioned on its being positive or negative. Section 465.8 reaches fake followers, views and likes bought to inflate influence. The marketing guide has the rest of the review rules, and the agency contract should repeat these three.

What should the agency contract say?

Put these in writing before work starts:

1. The work. A list of deliverables by month, so the fee buys something you can check.
2. The fee. A fixed amount. No commission, bonus or share tied to rides, riders or referrals.
3. The term. The safe harbor asks for at least one year, and it matters most when the agency’s outreach could steer Medicaid or Medicare riders to you. For a shorter first period, ask a health care lawyer what that does to the safe harbor before you sign.
4. Ownership and handover. The domain, accounts, logins, content, creative files and data are yours. On exit, the agency removes its access and hands over anything it holds within a stated number of days.
5. Reporting. A monthly report from accounts you can open yourself, with call and form counts and no rider details in the email.
6. Business associate terms. The agreement above, when it applies.
7. Reviews. The agency does not write, buy or filter reviews, and does not pay or give gifts to facility staff, case managers or broker staff on your behalf.

Checking what the agency brings in with HealthRide

An agency reports leads. You can check rides. HealthRide’s payer summary shows completed trips, cancellations and revenue billed per payer over any period, so you can compare the private-pay rides you actually completed in a month with what the agency says it booked. See reports.