Name: 1nessAgency
Address: West 43rd Street, New York, NY, 10036, US
Telephone: +1-518-671-8090
Price range: $$

A

AEO (Answer Engine Optimization): Structuring content so AI assistants and voice interfaces return it as the direct answer to a question. AEO overlaps with GEO but focuses on question-format queries: 40-60 word answer blocks, question headings, and FAQ structure. For a practice, AEO is whether an assistant answers "who is the best psychiatrist near me" with your name or a competitor's.
AI Overviews: Google's AI-generated summaries that appear above traditional results, launched in the US in May 2024. They synthesize answers from multiple sources and cite the pages they draw from. Cited sources overlap heavily with top-10 organic results, so healthcare brands earn citations with E-E-A-T signals, structured data, and pages that answer the question in the first screen.
AIO (AI Overview Optimization): The work of earning citations inside AI Overviews. Treat it as a GEO tactic, not a third discipline: same structured data, same E-E-A-T, same direct answers. If GEO is the system, AIO is the Google-shaped outcome.
Attribution Modeling: How you assign conversion credit across the touchpoints a patient hits before booking. Models range from last-click to data-driven multi-touch. Healthcare attribution is harder than e-commerce: bookings often happen by phone, decision cycles span weeks, and HIPAA limits the user-level tracking that powers attribution in other industries.

B

Brand Capital: The quantifiable economic value of a brand's market positioning, revenue predictability, and narrative strength. In M&A, acquirers pay premiums for businesses with defensible brand equity. Marketing due diligence now prices whether patient demand survives the transaction, not just last quarter's ROAS.
Business Associate Agreement (BAA): A legally required contract between a covered entity and any vendor that handles Protected Health Information. A marketing agency must sign a BAA if its tools or processes touch patient data. Without one, both parties carry HIPAA violation liability. Google does not sign a BAA for GA4. Most call-tracking and form vendors will, if you ask before you install them.

C

42 CFR Part 2: The federal regulation that protects the confidentiality of substance use disorder (SUD) treatment records, with stricter consent requirements than HIPAA. A 2024 final rule aligned Part 2 more closely with HIPAA, but marketing for addiction treatment still demands heightened care. Patient lists, remarketing audiences, and CRM segments built from SUD treatment data face tighter restrictions than general health data.
CAC (Customer Acquisition Cost): Total marketing and sales spend divided by new patients acquired in the period. In healthcare, CAC varies widely by specialty. Behavioral health CAC is typically two to four times higher than primary care because of longer decision cycles and stigma. Pair it with PLTV. CAC alone is a spend number, not a business case.
Call Tracking: Unique phone numbers assigned to marketing channels (dynamic number insertion) so inbound calls can be attributed to the campaign that drove them. Recordings and caller IDs can contain PHI, so healthcare practices must use vendors that sign a BAA and configure compliant recording and storage.
Compliance-First Marketing: Regulatory compliance built into every layer of marketing infrastructure from the start, not bolted on after a pixel audit. That means HIPAA-conscious tracking, LegitScript-certified ad accounts, encrypted forms, and audit-ready documentation. The point is not paperwork. It is being able to keep running ads when a competitor gets shut off.
Consent Mode: Google's framework for modeling conversions when a user declines cookies. In healthcare it is necessary and not sufficient: Consent Mode still sends pings to Google, and Google still does not sign a BAA for GA4. Use it with server-side filtering so no PHI, including IP-plus-health-page combinations, ever reaches the tag.
Conversion API (CAPI): A server-to-server conversion feed (Meta CAPI, Google Enhanced Conversions / offline imports) that sends hashed, consented events without putting a browser pixel on a patient page. This is how you measure booked appointments after you pull the tracking pixel off condition and portal URLs.
Conversion Rate Optimization (CRO): Increasing the share of visitors who book or complete intake. In healthcare, CRO is constrained by trust and regulation: shorter forms, faster pages, clearer next steps, never dark patterns that collect more PHI than the visit requires.
Conversion Tracking: Measuring completed actions (booked appointments, intake submissions, phone calls) and attributing them to the channel that produced them. Healthcare setups must send only de-identified conversion events. Diagnosis, treatment, and identity data stay out of ad platforms, usually by routing through server-side tagging.
Cost Per Acquisition (CPA): What you pay to convert one prospect into a booked patient on a given channel. CPA is channel-level. CAC is blended. A practice can have a $70 Google Ads CPA and a $220 blended CAC once agency time, tools, and untracked referrals sit in the denominator.
Cost Per Click (CPC): What you pay for one paid click. Healthcare CPCs vary enormously by intent: general wellness terms may cost $2-$5, high-intent behavioral health and specialty treatment keywords $15-$40. CPC is a function of competition and Quality Score. Relevance and landing-page experience lower it.
Cost Per Lead (CPL): What you pay for a form fill, call, or chat before qualification. CPL sits upstream of CPA. A practice may pay $40 per lead and $200 per booked patient once no-shows, insurance mismatches, and out-of-area inquiries are filtered out. The gap is the intake leak.
Covered Entity: HIPAA's term for healthcare providers, health plans, and healthcare clearinghouses. Covered entities carry primary HIPAA obligations and must execute a BAA with any vendor, including a marketing agency, that creates, receives, maintains, or transmits PHI on their behalf.

D

De-identification: HIPAA's two methods for stripping identifiers so a dataset is no longer PHI: Safe Harbor (remove 18 specified identifiers) and Expert Determination (a qualified statistician documents low re-identification risk). Marketing events should be de-identified before they leave your server. Hashing an email is not automatically Safe Harbor.
Digital Front Door: The website, GBP, booking path, and intake a patient hits before they ever meet a clinician. If that path is slow, confusing, or leaky, paid media just buys more abandoned sessions. A working front door is mobile-first, encrypted, and built so the next available appointment is obvious.

E

E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness): Google's quality framework, especially strict for YMYL topics like healthcare. Content written or reviewed by clinicians, with credentials, citations, and a real practice behind it, signals E-E-A-T. That affects organic rankings and whether AI Overviews will cite you.
EHR / EMR: The clinical system of record. Marketing platforms almost never speak it natively. The compliant pattern is a one-way, de-identified event out (appointment booked, visit completed) and no diagnosis or chart data back into ads. Identifying signals stay on the EHR side.
Email Authentication (SPF, DKIM, DMARC): The three DNS records that prove your domain sent the message and tell receivers what to do with spoofs. Google and Yahoo have required DMARC for bulk senders since February 2024. For a practice this is how appointment reminders and intake follow-ups reach the inbox, and how patients avoid phishing that impersonates you.
Enhanced Conversions: Google's hashed first-party conversion match (email, phone, address) used to recover attribution after cookie loss. In healthcare it must be populated from consented, non-clinical fields and sent server-side. Never hash a patient ID, diagnosis, or anything collected on a condition page.

F

First-Party Data: Information you collect directly with consent: intake forms, appointment history, email engagement, portal behavior. As third-party cookies disappear, it is the foundation of compliant personalization. Under HIPAA it is still patient data. It is also an asset a competitor cannot buy.
FTC Health Breach Notification Rule: The FTC rule requiring vendors of personal health records and health apps not covered by HIPAA to notify consumers when health data is breached, including unauthorized sharing with advertising platforms. The 2023 GoodRx action ($1.5 million) established that sending health data to ad pixels can constitute a breach even outside HIPAA.

G

GA4 (Google Analytics 4): Google's event-based analytics platform, which replaced Universal Analytics on July 1, 2023. Google does not sign a BAA for GA4. Healthcare organizations must prevent PHI, including the IP-address-plus-health-page combinations flagged in HHS guidance, from reaching it. Filter server-side, or use a HIPAA-capable analytics tool that will sign a BAA.
GEO (Generative Engine Optimization): Optimizing content to be surfaced, cited, and recommended by AI search engines and large language models. Unlike SEO, which targets ranked links, GEO targets being the source the model names. For providers that means structured service pages, credentials, reviews, and llms.txt so an assistant can recommend the practice by name.
Geo-Targeting: Restricting ad delivery to radii, ZIP codes, or drive-time boundaries around clinic locations. For multi-location groups it stops offices from bidding against each other and keeps spend where a patient can actually travel. Exclusion zones stop leakage outside the service area.
Google Ads Healthcare and Medicines Policy: Google's restricted-ad policy covering healthcare, medicines, and related services. Addiction treatment and some mental-health categories require LegitScript certification before ads will serve. Claims about outcomes, before/after imagery, and targeting on health conditions are limited. Certification is the gate. The policy is why the gate exists.
Google Business Profile (GBP): The free Google listing that appears in Search and Maps. For most practices it is the single most important local asset: map pack, reviews, click-to-call. Multi-location groups need one GBP per site, with NAP that matches the website and citations.
Google Tag Manager (GTM): A tag container. The browser version is how most pixels get onto healthcare sites, and how most PHI leaks start. The useful pattern is a server-side GTM container you control: tags fire from your server, identifiers get stripped, and ad platforms only see de-identified events.

H

HealthVerse: 1nessAgency's client portal for real-time dashboards, compliance reporting, and campaign visibility. It is how senior-led accounts stay in one place instead of a slide deck once a quarter.
HIPAA (Health Insurance Portability and Accountability Act): The federal law that sets standards for protecting patient health information. In digital marketing it governs tracking pixels, forms, CRM, email, and any system that may touch PHI. Civil penalties are tiered. HITECH raised the ceiling and extended liability to business associates. The operational question is not "are we HIPAA." It is whether PHI ever enters the marketing stack.
HIPAA-Compliant Marketing: A covered entity or business associate has signed a BAA and meets HIPAA's administrative, physical, and technical safeguards for any PHI it actually handles. It is a legal status, not a vibe. If your ads stack never receives PHI, you still need HIPAA-conscious design so it stays that way.
HIPAA-Conscious Marketing: Systems designed so PHI never enters the marketing layer: no identifiable health information in form fields sent to ad platforms, no pixels on portals or condition pages, no diagnosis in UTMs or CRM campaign names. Most practices need both this and HIPAA-compliant handling for the systems that do hold PHI (intake, EHR, call recording).
HITECH Act: The Health Information Technology for Economic and Clinical Health Act, which expanded HIPAA enforcement, mandated breach notification, and extended obligations to business associates, including marketing agencies that handle PHI. Penalties can reach $1.5 million per violation category per year.

I

Intake Completion Rate: The share of started intakes that become a completed form or booked visit. In behavioral health, completion often sits under 60%. The rest is abandoned tabs, insurance confusion, and no follow-up after an 11pm search. Encrypted short forms and automated reminders move this number more than another ad dollar.
Intake Flow Optimization: Reducing friction from first visit to completed intake and booked appointment. Tactics: fewer fields, mobile-first, progress indicators, encrypted submission, automated follow-up on abandon. The average behavioral health intake completion rate is under 60%. That is the leak paid media cannot outspend.

K

Keyword Cannibalization: When multiple pages on the same site compete for the same query, splitting ranking signals so neither page ranks. Multi-location groups are especially prone: dozens of near-identical location pages targeting "[specialty] near me" can suppress the whole network. The fix is differentiated, locally unique content on every page.

L

Landing Page Optimization: Dedicated pages built for one campaign or one patient segment. Healthcare landing pages have to persuade and stay clean: credentials, a single action, HIPAA-conscious forms that do not dump PHI into the ad account.
LegitScript Certification: Third-party certification Google and Meta require before ads will run for addiction treatment, substance use, and certain mental health categories. It verifies licensing, accreditation, and compliance. Without it, ads in those categories are rejected. The process includes facility review and ongoing monitoring. Practices that complete it face less paid-search competition, not more.
Limited Data Use: Meta's setting that restricts how advertiser data can be used for tracking and optimization, intended for regulated regions and sensitive categories. For health and wellness advertisers it is a control, not a BAA. Combine it with CAPI and a pixel-free condition page. Do not treat a checkbox as a HIPAA program.
llms.txt: A plain-text file at the site root that gives large language models a curated map of the most important pages. Adoption is still uneven, but it is cheap insurance next to schema and service pages. 1nessAgency publishes one as part of a GEO implementation.
Local SEO: Visibility for location-specific searches like "therapist near me." It is GBP, citations, reviews, location pages, and geographic schema, not just blog posts. For multi-location groups, local SEO is also how you stop offices from cannibalizing each other.
LTV:CAC Ratio: Patient lifetime value divided by customer acquisition cost. 3:1 or higher is the usual bar for sustainable growth. PE diligence teams read this ratio because it says whether marketing spend creates or destroys enterprise value as a platform scales.

M

Map Pack (Local Pack): The block of three local listings with a map at the top of Google results for local-intent queries. Placement is driven by GBP completeness, review volume and rating, proximity, and citations, not website SEO alone. For most practices it outperforms organic listings in clicks.
Marketing Due Diligence: The buyer's read of a marketing engine in a transaction: channel mix, concentration risk, CAC trends, attribution quality, brand strength, and whether patient demand is durable. Diversified channels, clean tracking, and documented unit economics support higher multiples.
Marketing Qualified Lead (MQL): A prospective patient who has done enough (form, chat, call) to warrant follow-up. In healthcare, MQL criteria should include insurance fit, geography, and condition relevance, not just engagement. Qualified leads convert at three to five times the rate of unqualified contacts.
Meta Health and Wellness Data Restrictions: Meta's restrictions, expanded in January 2025, that limit health and wellness advertisers from optimizing on lower-funnel conversion events. Affected practices shift optimization to mid-funnel events and lean on first-party measurement. Event architecture is a prerequisite, not a nice-to-have.

N

NAP Consistency: Uniform Name, Address, and Phone across the website, GBP, directories, and citations. Inconsistent NAP splits review equity and weakens local ranking. Multi-location groups and practices that have rebranded or moved should audit citations on a schedule.
Negative Keywords: Search terms you exclude so ads never show. Healthcare campaigns bleed without them: "free," "jobs," "salary," research queries, adjacent specialties. Review search-term reports weekly during ramp-up.
No-Show Rate: The share of booked initial appointments that do not attend. In psychiatry, 20-30% is common. Each no-show is paid media you already bought. Reminders, confirmation texts, and a short gap between book and visit cut this more reliably than raising budget.

O

OCR (Office for Civil Rights): The HHS office that enforces HIPAA. OCR bulletins on tracking technologies (first in December 2022, updated since) are why pixels on patient portals became an enforcement and class-action problem. If you are writing a marketing BAA or a pixel policy, you are writing it for OCR, not for Google.
Online Reputation Management (ORM): Monitoring and improving how a practice appears in reviews and search. HIPAA is the constraint: a response must never confirm the reviewer was a patient. Compliant programs use neutral templates, systematic review generation, and a path for clinical complaints that is not the public reply box.

P

Patient Acquisition: Attracting, engaging, and converting prospective patients through digital channels. It is not generic lead gen. Insurance, clinical fit, stigma, and regulation all sit between click and calendar. The useful number is booked, appropriate patients, not form fills.
Patient Journey: The path from first symptom awareness through research, comparison, booking, treatment, and ongoing care. Healthcare journeys run longer and heavier than consumer purchases, often with more than one decision-maker. Mapping it shows where people drop and which page earns trust at each step.
Patient Lifetime Value (PLTV): Revenue a patient generates over the whole relationship. It sets the ceiling on what you can pay to acquire them. In psychiatry, recurring medication management supports a higher CAC than episodic specialties. ROAS that uses first-visit revenue only will kill good campaigns.
Pay-Per-Click (PPC): You pay when someone clicks. Google Ads is the main healthcare PPC surface. Effective accounts are built on negatives, Quality Score, compliant landing pages, and a conversion feed that does not include PHI. SEM as a label just means this plus organic. We keep them separate because the buying motion is different.
Performance Max: Google's automated campaign type that serves across Search, Display, YouTube, Gmail, Maps, and Discover from one asset set. You trade control for reach. Healthcare advertisers should weigh that opacity against brand safety and policy before moving budget out of standard Search.
Protected Health Information (PHI): Individually identifiable health information about a person's condition, care, or payment. In marketing it leaks through forms, pixels, IP addresses combined with health-page visits, call recordings, and CRM fields. Any system that touches PHI needs HIPAA safeguards and a BAA. The design goal is that the ads stack never becomes one of those systems.

Q

Quality Score: Google Ads' 1-10 rating of keyword, ad, and landing-page relevance. Higher scores lower CPC and improve position. Healthcare accounts raise it with clinically accurate copy, a matching landing page, and a fast load. They lose it with a homepage dump and a generic "book now."

R

Remarketing: Ads to people who already visited the site. Google and Meta prohibit remarketing based on health conditions, so pixel-based remarketing off clinical pages is largely off-limits. Compliant leftovers: brand visitors, careers pages, or upper-funnel prospecting that does not use a health-page audience.
Responsive Search Ads (RSA): Google's default search ad: up to 15 headlines and 4 descriptions, mixed per auction. Strong healthcare RSAs pair accurate claims with distinct value (insurance, availability, credentials) and pin compliance-critical copy so it always shows.
Review Gating: Asking only happy patients to post publicly, and routing the rest elsewhere. Google forbids it. A compliant program asks every patient the same way, after the visit, and handles clinical complaints in private. Gating is how practices lose the GBP they spent years building.
Review Management: Generating, monitoring, and responding to reviews on Google, Healthgrades, Zocdoc, Yelp, and specialty directories. Volume, recency, and rating drive map pack and patient choice. HIPAA-compliant replies never reference a visit or condition.
ROAS (Return on Ad Spend): Revenue attributed to ads divided by ad spend. A 4x ROAS means $4 recognized for $1 spent. In healthcare the useful version uses PLTV, not first-visit cash. Channel ROAS and cash-collected ROAS are different numbers. Mixing them is how 119:1 and 4x end up in the same deck.

S

Schema Markup: JSON-LD on the page that tells search engines and models what the content is. Healthcare-relevant types include MedicalOrganization, Physician, MedicalCondition, FAQPage, and LocalBusiness. Schema is how you get rich results and how AI systems parse a practice. "Structured data" is the same thing.
Search Engine Optimization (SEO): Earning unpaid visibility through technical quality, content, and authority. Healthcare SEO is E-E-A-T, medical accuracy, YMYL standards, and local pages. Unlike paid, it does not go to zero when you pause spend. It also does not replace a certified ads account in restricted categories.
SERP (Search Engine Results Page): What Google returns for a query: ads, map pack, AI Overviews, featured snippets, People Also Ask, and organic links. Healthcare SERPs are crowded. Owning meaningful real estate for one query usually means paid, local, and organic running together.
Server-Side Tagging: Tracking data flows through a server you control (often a GTM server container) before it reaches ad and analytics platforms. That layer strips identifiers and health information. It is the backbone of HIPAA-conscious conversion tracking.
SOC 2: An attestation of security controls (availability, confidentiality, processing integrity, privacy) issued against the AICPA Trust Services Criteria. It is not a HIPAA certificate. Buyers and health systems ask for it because it is a readable proxy for whether a vendor runs a grown-up operation. 1nessAgency uses SOC 2-aligned workflows alongside BAAs.
Special Ad Categories: Meta's restricted campaign type for credit, housing, employment, and social issues. Health and wellness advertisers often land in adjacent restrictions that limit targeting, lookalikes, and optimization events. Combined with LegitScript on Google, this is why a "normal" e-commerce ads playbook fails in behavioral health.

T

Tracking Pixel: A snippet or invisible image that reports visitor behavior to Meta, Google, or similar. HHS OCR guidance (December 2022, updated since) warned that pixels on portals and condition pages can transmit PHI. Pixel use has driven enforcement and class actions against health systems. Every healthcare site needs a pixel audit before another tag is added.

U

UTM Parameters: Tags on a URL (utm_source, utm_medium, utm_campaign) that tell analytics where a visit came from. Disciplined UTMs are the difference between knowing which campaign booked a patient and guessing. They are also a compliance surface: never encode condition or treatment in a UTM.

W

WCAG / Section 1557: WCAG 2.1 AA is the accessibility standard. Section 1557 of the Affordable Care Act is why it is also a healthcare civil-rights issue, not just a UX preference. Forms, contrast, keyboard access, and screen-reader labels belong in the same audit trail as HIPAA work.
Web-to-Lead: A website form that creates a lead in the CRM or practice-management system. Healthcare implementations need encrypted transit, a BAA with the CRM, consent language, and fields that do not ask for a diagnosis before a clinician is in the loop.

Y

YMYL (Your Money or Your Life): Google's class for content that can affect health, finances, or safety. Healthcare is the canonical YMYL category and is held to the highest E-E-A-T bar: clinical review, author credentials, citations, accuracy. Thin or anonymous health content is suppressed regardless of technical SEO.

Healthcare marketing glossary

A

B

C

D

E

F

G

H

I

K

L

M

N

O

P

Q

R

S

T

U

W

Y