Atlantic Health Strategies logo
LinkedIn icon
Contact Us

Atlantic Health Strategies

X-twitter Linkedin
Atlantic Health Strategies Logo

Behavioral Health Marketing Compliance in 2025: EKRA, LegitScript, Florida § 817.505, and the FTC

Table of Contents

Ready to See Results?

From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.

Contact Us

Answer First: Four Regulators Are Reading Your Homepage Right Now

If a treatment center advertises addiction services in the United States, four separate authorities regulate that marketing at the same time: the U.S. Department of Justice under the Eliminating Kickbacks in Recovery Act (EKRA, 18 U.S.C. § 220), the Federal Trade Commission under Section 5 of the FTC Act, LegitScript as the private gatekeeper for Google, Meta, and Microsoft Advertising, and the operator’s state patient-brokering statute. Most operators treat marketing compliance as a website disclaimer and a HIPAA badge. It is not. It is a federal criminal statute, a private ad-platform certification, a state felony statute, and an FTC substantiation standard, all pointed at the same intake funnel.

EKRA sits inside the SUPPORT Act, which Congress passed in 2018 to attack patient brokering in recovery. EKRA was novel because it was the first significant federal law to regulate payment for referrals of services billed to private insurance, not just Medicare and Medicaid. If your call center bonuses reps by admissions, your outreach vendor gets paid per intake, or your homepage promises outcomes you cannot substantiate, your CEO is not playing by the rules. Your CEO is betting the license.

EKRA Got Teeth: The 2025 Ninth Circuit Ruling in Schena

For years, defense counsel told operators EKRA was a laboratory statute with no appellate teeth. That excuse died on July 11, 2025. On that date, the Ninth Circuit Court of Appeals affirmed the criminal conviction of laboratory operator Mark Schena for EKRA violations based on compensation paid to marketers who sold testing on behalf of his laboratory. Schena was sentenced to 96 months in prison and ordered to pay more than $24 million in restitution.

Two things every behavioral health operator needs to internalize.

First, a commission arrangement is not automatically a per se EKRA violation. As Morgan Lewis reads the opinion, the court said: “We do not think the mere fact of a percentage-based marketing arrangement, without more, would constitute a per se violation of EKRA.” What tips it into a crime is undue influence or deception directed at the referring clinician. In Schena’s case, he directed his marketers to mislead physicians into making referrals, crossing the line from lawful promotion into illegal inducement.

Second, EKRA reaches marketing intermediaries, not just referring physicians. The Ninth Circuit held that EKRA extends to payments made to third-party marketers indirectly influencing referrals for medical testing services, expanding its scope beyond payments made directly to referring physicians. Morgan Lewis’s plain-English guidance to operators is worth reading twice: the safest path is fixed salaries or bonuses tied to non-referral metrics, and compliance programs should address EKRA directly rather than assume AKS compliance is enough. Read that again if your BDRs are paid on admissions.

DOJ is not slowing down either. On June 30, 2025, the Justice Department announced its 2025 National Health Care Fraud Takedown, which resulted in criminal charges against 324 defendants, including 96 doctors, nurse practitioners, pharmacists, and other licensed medical professionals, in 50 federal districts and 12 State Attorneys General’s Offices, for their alleged participation in health care fraud schemes involving over $14.6 billion in intended loss. HHS-OIG called it the largest health care fraud Takedown in U.S. Department of Justice history, doubling the previous record of $6 billion. The government also seized over $245 million in cash, luxury vehicles, cryptocurrency, and other assets. Operators in Florida, North Carolina, Texas, and Ohio should assume their commission structures are on the table if a whistleblower calls the FBI.

LegitScript Is a Private Regulator With Public Consequences

LegitScript is not a government agency. Operators still treat it as one because it functions as one. Per LegitScript’s own certification page, LegitScript Certification is required to run addiction treatment ads on platforms including Google, Meta, Microsoft Ads, and Nextdoor. Without it, the three largest patient-acquisition platforms on the internet disappear from your intake stack. For most treatment centers, that is not a marketing inconvenience. That is a census problem.

Meta’s own policy confirms the requirement. Meta requires advertisers who wish to run addiction treatment ads targeting people in the United States to be certified with LegitScript and apply to Meta for permission to advertise. Google adopted the same requirement in 2018.

The fee is not the issue. What kills operators is the eligibility bar underneath the fee. LegitScript’s addiction treatment standards require proper licensing, applicable registrations, and policies and procedures; disclosure of any legal or regulatory history including litigation from the past 10 years; qualifications of clinical staff; accurate website disclosures and privacy compliance; and compliant advertising aligned with laws and platform policies. Translation: if your Palm Beach County program has an open AHCA finding, a lapsed CARF, or a call-center vendor that pays per booked bed, your team will fail LegitScript before your team fails EKRA.

State Statutes Bite Harder Than Federal in Places Like Florida

Federal law is the ceiling. State law is often the floor, and in Florida the floor is a felony. Under the Florida Patient Brokering Act, § 817.505, it is unlawful to offer or pay a commission, benefit, bonus, rebate, kickback, or bribe, directly or indirectly, in cash or in kind, or engage in any split-fee arrangement, to induce the referral of a patient or patronage to or from a health care provider or health care facility.

The penalties escalate fast. A single-patient violation is a third-degree felony carrying a mandatory $50,000 fine. Where the prohibited conduct involves 10 or more patients but fewer than 20, it becomes a second-degree felony with a mandatory $100,000 fine. Where the prohibited conduct involves 20 or more patients, the offense becomes a felony of the first degree and the defendant shall be ordered to pay a fine of $500,000.

Florida also tightened the screws with HB 369 in 2019. House Bill 369 amended subsection 817.505(3)(a) to provide that the PBA does not apply to “any discount, payment, waiver of payment, or payment practice expressly authorized by [exceptions to the federal Anti-Kickback Statute] or regulations adopted thereunder,” i.e., the safe harbor regulations found at 42 C.F.R. § 1001.952. And here is the trap most operators miss: the PBA is a general intent statute, meaning that one need only have the intent to engage in the prohibited act to violate it, and “advice of counsel” is not a defense to a general intent statute. If your compliance memo says “AKS safe harbor” without pointing to a specific enumerated safe harbor, that memo no longer buys your defense counsel much in Broward County. Other high-volume treatment states are following, and operators should stop assuming Florida is the outlier.

The FTC Is Reading Your Website, Not Just Your Ads

Operators forget the FTC because the FTC does not run raids. The FTC writes orders. Two things about the FTC’s Health Products Compliance Guidance matter for behavioral health operators.

First, the FTC states directly: “Randomized, controlled human clinical trials (RCTs) are the most reliable form of evidence and are generally the type of substantiation that experts would require for health benefit claims.” Second, the FTC has stated that as a general matter, substantiation of health-related benefits will need to be in the form of randomized, controlled human clinical testing to meet the competent and reliable scientific standard. That includes your homepage “95% success rate” banner, your Google Business Profile testimonials, your alumni video, and the influencer you paid last quarter.

Here is what our AHS team reviews during a media audit, in order:

  • Every outcome claim on the website and its supporting evidence file
  • Every testimonial and its consent record
  • Every referral relationship and the compensation math behind it
  • Every LegitScript-covered domain and its accreditation status
  • Every intake script and the disclosures it makes
  • Every third-party vendor contract that touches leads

If any one of those breaks under EKRA, the FTC Act, Florida § 817.505, or LegitScript’s ethical marketing standard, your program is exposed on all four. Playing by the rules is not a slogan. It is a survey window that never closes.

Frequently asked questions

Does EKRA apply to my treatment center if we do not bill Medicare or Medicaid?

Yes. Unlike the federal Anti-Kickback Statute, EKRA applies to any healthcare benefit program, including services billed to private insurance and cash-pay patients, and it covers recovery homes, clinical treatment facilities, and laboratories. The Ninth Circuit’s July 11, 2025 decision in United States v. Schena confirmed that EKRA also reaches payments to marketing intermediaries, not just direct referral sources, and that Schena was sentenced to 96 months in prison with more than $24 million in restitution.

Can I pay my admissions or business development reps a commission on booked patients?

It is one of the highest-risk compensation structures in behavioral health. The Ninth Circuit in Schena held that percentage-based marketing arrangements are not per se unlawful under EKRA, but become unlawful when marketers are directed to mislead or unduly influence referral sources. Morgan Lewis’s guidance to operators is that the safest path is fixed salaries or bonuses tied to non-referral metrics. In Florida, the same commission arrangement can also trigger a first-degree felony under § 817.505 with a mandatory $500,000 fine when 20 or more patients are involved.

Do I need LegitScript certification if I only market through SEO and referrals?

Not strictly. Per LegitScript and Meta’s own advertising policies, LegitScript Addiction Treatment Certification is required specifically for paid advertising on Google, Meta, Microsoft Ads, and Nextdoor in the addiction treatment category. Organic SEO does not require it. But FTC truth-in-advertising rules and state anti-kickback statutes still apply to every page on your website, every testimonial, and every referral arrangement, whether or not you run paid ads.

What outcome claims can a behavioral health treatment center legally make on its website?

Only claims a marketer can substantiate with competent and reliable scientific evidence before the claim is disseminated. Under the FTC’s 2022 Health Products Compliance Guidance, randomized, controlled human clinical trials are generally the type of substantiation experts would require for health benefit claims, and substantiation of health-related benefits will generally need to be in the form of randomized, controlled human clinical testing. Anecdotal alumni testimonials, internal success-rate figures without published methodology, and comparative superiority claims without verifiable data are the three most common findings in an AHS media audit.

References

Request a Free Consultation

Scroll to Top