Healthcare Marketing Compliance

Healthcare Marketing Compliance

Cardinal Rule

Marketing review without licensed-clinician + regulatory + legal sign-off is publication, not approval; publication of unapproved claims is regulator-attention waiting to happen. No promotional asset — digital, print, broadcast, social, or verbal — leaves internal review and reaches any external audience without a documented, three-party MLR (Medical / Legal / Regulatory) sign-off on record. Review is not a ceremony; it is the chain of custody that determines whether a regulator inquiry becomes a warning letter or a consent decree.

Fail-Fast Rule

Stop and return a structured rejection when any of the following is true:

• The asset contains an off-label indication, dosing route, or patient population not reflected in the current product labelling or package insert.
• A comparative efficacy claim (superiority, non-inferiority, or parity) lacks a head-to-head, adequately-powered, peer-reviewed trial as the primary supporting reference.
• The asset uses patient testimonial, case study, or before-and-after imagery without a verified HIPAA authorisation, minor consent, or model release on file.
• A superlative claim ("most effective," "leading," "first-line") cannot be supported by independently auditable, current evidence.
• Fair-balance risk information is absent, buried below the primary benefit message, or rendered in font size, contrast, or duration that fails readability standards for the medium.
• The asset names an investigational product in a promotional context before regulatory approval in the target jurisdiction.

When to Apply

Apply this skill when:

• Authoring or reviewing any promotional material referencing a drug, biologic, medical device, or diagnostic for any jurisdiction (US, BR, EU, or multi-jurisdiction bundle).
• Assessing a content marketing plan (social calendar, influencer brief, patient-community programme) for regulatory exposure before activation.
• Evaluating a testimonial contract, speaker-bureau agreement, or HCP advisory-board engagement for Sunshine Act / EFPIA Disclosure Code / Anvisa CMED transparency compliance.
• Designing campaign analytics architecture where patient or HCP data is collected, segmented, or used for targeting.
• Preparing corrective-action responses to regulator letters (FDA Untitled Letter, FDA Warning Letter, Anvisa notificação, OCR resolution agreement).

Do not apply this skill to clinical-trial protocol design, regulatory submission strategy, or pharmacovigilance signal management; route those to the relevant clinical-regulatory skill.

PII / PHI in Campaigns

Patient and HCP data in marketing contexts carries an elevated regulatory burden that standard PII rules do not fully cover.

Patient testimonials:

• Every testimonial from a patient requires a signed, condition-specific HIPAA authorisation that explicitly authorises promotional use. A generic research-consent or treatment-consent form is insufficient.
• Testimonials involving a minor require additional parental or guardian consent and, depending on jurisdiction, court approval.
• Where the patient's image, voice, or identifiable story is used, a model release covering commercial promotional use must accompany the HIPAA authorisation.
• LGPD Art. 11 classifies health data as sensitive personal data; processing for marketing purposes requires explicit, specific consent beyond the standard Art. 7 bases. The consent instrument must identify the promotional purpose by name and medium.

Campaign analytics and tracking:

• Campaign analytics systems must be configured to exclude PHI. Patient identifiers — name, MRN, date of birth, diagnosis codes, prescription history — must not enter CRM, DSP, or ad-platform audiences directly or via hashed match-keys applied to health-context data.
• The Office for Civil Rights (OCR) has issued enforcement guidance confirming that tracking pixel technologies (Meta Pixel, Google Tag) on authenticated patient-portal pages, symptom checkers, or prescription-refill flows constitute HIPAA-covered disclosures to third parties absent a Business Associate Agreement (BAA) covering the pixel vendor and a valid authorisation from the individual.
• Conduct a pixel audit before any campaign launch. Authenticated pages and health-context landing pages require pixel removal or BAA coverage; non-authenticated general-awareness pages require documented risk assessment.
• Aggregate or cohort-level analytics derived from PHI require a formal de-identification analysis (Safe Harbor or Expert Determination method per 45 CFR § 164.514) before the derived dataset enters campaign measurement.

Claim Substantiation

Every promotional claim requires a pre-submission substantiation package that travels with the asset through the MLR review cycle.

Clinical-evidence hierarchy for claims:

Rules:

• Claims derived from Tier 3 or Tier 4 evidence alone must be labelled as such and may not be stated as established fact.
• Selective citation — citing a study's favourable endpoint while omitting a co-primary or key secondary endpoint with a negative result — is a per se violation in all covered jurisdictions.
• On-label vs. off-label is determined by the current, jurisdiction- specific approved labelling or package insert, not by clinical practice norms or emerging data.
• Comparative claims require head-to-head evidence. Indirect comparison across separate trials (network meta-analysis) must be explicitly labelled as an indirect comparison and cannot support superiority claims without direct confirmatory evidence.
• Superlative claims ("only," "fastest," "most studied") require documented evidence that no competing product meets or exceeds the dimension claimed, as of the publication date of the asset.

Fair Balance

Regulatory bodies across all covered jurisdictions require that risk information appear in fair proportion to benefit claims, not as a subordinate afterthought.

Core principle: The totality of information about a product's efficacy and its risk profile must be presented in a manner that enables the audience to form an accurate impression of the benefit-risk relationship.

Medium-specific requirements:

• Broadcast (TV/radio): Risk information must be presented in audio with adequate volume, pace, and duration relative to the benefit presentation. The major statement of risks must be prominent, not masked by competing audio or visual distraction.
• Print (journal, direct-mail, patient-facing): A brief summary of risk information (or, for DTC print, an adequate provision disclosing all important risk information) must accompany the promotional piece. Font size, contrast, and legibility must be equivalent to benefit claims.
• Digital (website, banner, video): Static pages must include the brief summary or a prominent link to prescribing information on every page where a claim appears. Video must carry audible and legible risk information; hyperlinked risk content does not substitute for on-page presence when a benefit claim is present.
• Social media: Single-product social posts that make a product claim must include risk information within the character or display limit of the post. The practice of placing risk information only in a bio-link or comment, separated from the benefit claim, does not satisfy fair balance requirements.

Readability: Risk information must be accessible to the intended audience. Patient-directed materials must target a Grade 6-8 reading level; HCP-directed materials follow professional-copy conventions but must not obscure clinical significance through typographic subordination.

Pre-Launch Review

The MLR triad is the minimum mandatory gate for every promotional asset.

MLR participants and accountabilities:

Process rules:

• All three parties must provide a documented approval — electronic signature with timestamp — before an asset is released to any channel.
• A two-of-three approval is not a valid release gate; unanimous MLR sign-off is required.
• Revision after any MLR sign-off restarts the review cycle for the revised sections; a minor-change waiver may be granted by regulatory only for corrections that do not alter a claim, risk statement, or visual presentation of data.
• All review versions, comments, and approvals must be retained in the promotional review system of record for a minimum of three years (US FDA 21 CFR § 314.81(b)(3)(i)) or the jurisdiction-specific retention minimum, whichever is longer.
• Turnaround SLA for standard review: five business days. For expedited launch materials: forty-eight hours with explicit regulatory-director sponsorship. For corrective actions: twenty-four hours maximum.

Off-Label / Investigational

The prohibition on promotional pre-approval use is near-absolute in all covered jurisdictions.

• Promotional communications — including disease-awareness campaigns structured to favour a product not yet approved for a condition — are prohibited before regulatory approval in each target jurisdiction.
• The medical-information response exception permits unsolicited requests from HCPs for off-label information to be answered by a medical- information function operating independently from marketing; the response must be non-promotional, balanced, and documented.
• The scientific-exchange exception (presentations at scientific conferences, peer-reviewed publication activity) is narrow: it covers bona fide scientific discourse by medical affairs, not commercially motivated communications routed through medical affairs to avoid promotional review.
• Investigational products in clinical trials must not be characterised in promotional materials with efficacy language, outcome predictions, or patient-segment targeting that pre-supposes approval.

Testimonial / HCP Engagement

Aggregate spend transparency and anti-kickback compliance apply across all HCP engagement types.

Disclosure frameworks by jurisdiction:

Operational rules:

• Speaker fees, honoraria, advisory-board fees, and consulting fees must reflect fair market value (FMV) established by an independent, documented FMV analysis. Rates that exceed the FMV ceiling are presumptive anti-kickback exposures.
• Any transfer of value to an HCP — meals, travel, gifts, educational materials — must be tracked, documented, and reportable on demand. De minimis thresholds (US: $10 per item, $25 aggregate per year for non-educational items) apply but do not eliminate the record-keeping requirement.
• HCPs must not be engaged in speaker or advisory roles where their audience or influence is primarily attributable to patient-prescribing behaviour for the sponsoring company's products; such arrangements attract enhanced Anti-Kickback Statute scrutiny.
• Testimonial and endorsement arrangements with HCPs are subject to FTC Endorsement Guides disclosure requirements in US consumer-directed materials; the material connection must be clearly and conspicuously disclosed.

Multi-Jurisdiction Compliance

Simultaneous or sequential market entry requires a jurisdiction matrix before assets are finalised.

Multi-jurisdiction assets must satisfy the most restrictive applicable requirement on each dimension unless a jurisdiction-specific version is produced and geo-fenced to its target market.

Audit Readiness

Regulatory inspection readiness is a continuous state, not a pre- inspection sprint.

Document retention minimum:

• Promotional review files (all versions, all MLR sign-offs, all supporting substantiation): three years post-last-distribution or jurisdiction minimum, whichever is longer.
• HCP transfer-of-value records: five years for US Anti-Kickback Statute purposes; seven years for Anvisa; follow the longest applicable period for global programmes.
• HIPAA marketing authorisations and consent instruments: six years from date of creation or last effective date per 45 CFR § 164.530(j).

Corrective-action protocol:

• Regulator letter received: acknowledge within forty-eight hours; convene MLR + legal crisis team within twenty-four hours of receipt.
• Asset takedown: immediate upon confirmed material violation; no asset remains live pending legal assessment when a material violation is identified.
• Corrective communication (where required by regulator): draft within ten business days; submit for MLR review under expedited SLA before regulator deadline.
• Root-cause analysis: complete within thirty days of corrective-action submission; update review checklist and training programme to address systemic gap.

Anti-Patterns

Cross-References

• core/compliance-lgpd — LGPD legal bases (Art. 7, Art. 11), data subject rights, breach notification, and ANPD obligations that apply to PHI in Brazilian healthcare marketing contexts.
• domains/healthcare/skills/healthcare-customer-service — patient communication protocols, consent documentation, and service-interaction compliance requirements that intersect with promotional activities.
• domains/marketing-global/skills/content-creator — general content creation standards, editorial workflow, and brand-voice guidelines; healthcare marketing compliance rules layer on top of and supersede any general marketing guidance where a conflict exists.

ADR Anchors

• ADR-058: Two-pass review gate — all outputs produced under this skill are subject to the two-pass review protocol: a first pass for regulatory accuracy and a second pass for completeness and internal consistency before delivery.