See Our Blogs

Removing the pixel stops one risky data flow, but it also removes the conversion signal Meta and Google use to decide who sees a practice’s ads. The practice also loses sight of which ads actually fill the schedule. A server-side relay can restore measurement with conversion counts that carry no names, contact details, or health information.

Why are behavioral health practices removing the pixel?

Behavioral health practices are removing the pixel because a browser pixel on booking, intake, or contact pages can send identifying details and health context straight to an ad platform. Federal regulators have warned health organizations about this directly, and practice owners are reading about FTC orders, settlements, and class actions involving website tracking on health sites.

Breach risk is another reason. A peer-reviewed study by Rutgers Business School researchers, published in December 2025, followed 1,201 US hospitals from 2012 to 2023 and found that pixel use “increases data breach probability by at least 1.4% points,” a 46% relative increase. For a practice owner, pulling the tag can feel like the fastest way to make that risk go away. Many owners pull it before anyone asks what will replace it.

What does a practice lose when the pixel comes out?

A practice loses its conversion data when the pixel comes out, and ad platforms depend on that data. Meta describes its Conversions API as feeding “Meta systems that optimize ad targeting, decrease cost per result and measure outcomes.” Without conversions, campaigns fall back to optimizing for clicks or page views, which says little about who books.

The reporting gap follows. For example, a practice that spends $3,000 a month and receives 60 inquiries is paying $50 per inquiry, but without conversion data it cannot tell which ads produced those 60. Budgets start to drift toward whatever looks busy. Regulators have acknowledged the value of tracking. Melanie Fontes Rainer, then director of the HHS Office for Civil Rights, said: “Although online tracking technologies can be used for beneficial purposes, patients and others should not have to sacrifice the privacy of their health information when using a hospital’s website.”

What restores measurement while sending less data?

A server-side relay restores measurement by changing what leaves the website. Events go to a server first, where names, contact details, and device identifiers are removed, along with condition and service detail, form content, and page addresses that name a condition. In Beacon’s setup, the visitor’s IP address is hashed. Only a generic conversion, such as “appointment request,” goes on to the ad platform. The relay provider signs a business associate agreement with the practice.

Beacon uses this approach for client paid media in place of client-side pixels, and tests changes on its own website and campaigns first. Campaigns are measured on stripped-down conversion counts, which keeps the signal that pulling the pixel alone would lose. The practice still checks results against its own records, as described in Which Marketing Actually Filled Your Schedule? The full mechanics are in What Is Server-Side Conversion Tracking and Why Does Healthcare Need It?

What does this answer not cover?

This answer explains the measurement trade-off of removing the pixel and how a server-side relay addresses it. It does not decide whether any specific tracking setup meets HIPAA, FTC rules, state privacy laws, or 42 CFR Part 2, and it does not cover call tracking, analytics tools, or email marketing.

This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

This answer also does not promise performance. Results after a switch depend on budget, offer, market, and how quickly the practice answers new inquiries. The practice remains responsible for its own obligations, and Beacon’s standard keeps tracking off booking, intake, and portal pages entirely.

Frequently asked questions

Is removing the pixel still a reasonable first step?

Yes. Pulling the pixel from booking, intake, and portal pages stops that data flow right away, and under Beacon’s standard those pages stay free of tracking for good. Plan the replacement measurement at the same time, so campaigns are not left running without conversion data for months.

Does the same trade-off apply to Google Ads?

Yes. Removing the Google tag cuts Google’s conversion signal the same way. Google also publishes its own restriction: its customer data policies say conversions related to sensitive categories, including health or medical information, “can’t be used for measurement in enhanced conversions.” Beacon’s standard of sending ad platforms only a generic event and a hashed IP address applies to Google too.

Will campaigns perform the same after switching to server-side tracking?

No one can guarantee that. Meta’s documentation says server events may be used in measurement, reporting, or optimization much like pixel events, and Beacon’s approach keeps campaigns optimizing on stripped-down conversion counts. Results depend on setup quality, budget, and how the practice follows up with new inquiries.

January momentum disappears by February when first sessions booked in January do not turn into ongoing care. Deductibles reset, some new clients stop after one or two visits, and a second appointment left unbooked at the first session is easy to lose. The fix is operational: book the next visit, talk about cost early, and follow up on every miss.

Why do so many new clients start in January?

Many new clients start in January because the new year prompts people to act on their mental health. The American Psychiatric Association’s Healthy Minds poll, conducted December 2 to 3, 2025, found that 38% of Americans planned a mental health-related New Year’s resolution, and 58% of adults ages 18 to 34 did.

APA President Theresa Miskimen Rivera, M.D., said in the January 2026 release: “It is encouraging to see more individuals planning to prioritize their mental health in 2026, particularly younger adults.” Among the strategies the APA listed was engaging in therapy.

For a practice, that intention shows up as a wave of inquiries and first appointments. Whether February looks as full depends on what happens after the first session, when the novelty of a resolution meets a busy schedule and a bill.

What pulls new clients away before February?

Cost and early dropout pull new clients away before February. Many insured clients start the year owing more out of pocket. The KFF 2025 Employer Health Benefits Survey, published October 22, 2025, found that 88% of workers with single coverage have a general annual deductible, averaging $1,886.

A client who paid a small copay in November may owe the full contracted session rate in January and not expect it. Early dropout is a separate, well-documented pattern. A meta-analysis published in the APA journal American Psychologist by Penix-Smith and colleagues estimated a 25.6% outpatient therapy dropout rate among U.S. service members and veterans, with higher dropout linked to younger age. The study describes one specific population, but the age finding is worth keeping in mind in a month when younger adults are the most likely to be making mental health resolutions.

How can a practice keep January clients engaged into February?

A practice keeps January clients engaged by treating the second appointment as the real conversion. Book the next session before the client leaves the first one, and confirm it in writing that day. Verify benefits before the first session and tell the client plainly what January visits are likely to cost while the deductible applies.

Follow up on every missed visit the same day with a phone call from a staff member, then a written message offering a new time. Reminders help attendance, and Do Appointment Reminders Actually Reduce No-Shows? covers what the research says about them. Beacon’s working standard is to track the share of January first sessions that reach a second and third visit, by marketing source. That number shows which campaigns produced clients and which produced single visits.

What does this answer not cover?

This answer covers scheduling, billing communication, and follow-up practices around new clients. It does not cover clinical decisions about treatment length, session frequency, or when ending care is appropriate. Some clients reach their goals quickly, and a short course of care can be a good outcome. Those judgments belong to clinicians, and nothing here is clinical advice.

The dropout research cited describes U.S. service members and veterans, and its rates should not be read as a benchmark for civilian practices. The APA poll describes intentions among U.S. adults, not people who book care. Deductible figures cover employer-sponsored single coverage; Medicaid, Medicare, marketplace, and self-pay clients face different costs. Specific billing rules, including estimate requirements for uninsured or self-pay clients, are outside this page.

Frequently asked questions

What is a second-appointment rate?

A second-appointment rate is the share of new clients who attend a second session after their first. A practice calculates it by dividing second sessions attended by first sessions attended over the same period. For example, 60 first sessions and 42 second sessions in January gives a 70% rate.

Should the front desk discuss deductibles before the first session?

Yes, when the client uses insurance. A short, plain conversation about what the plan is likely to cover in January can prevent a surprise bill after the second or third visit. Scripts should come from the billing team, and staff should avoid guessing when benefits have not been verified yet.

Which marketing number shows the February drop?

The clearest marketing number is second-appointment rate by lead source. Inquiry counts and first sessions both peak in January and look healthy. Comparing how many first sessions from each campaign reach a second visit shows which sources bring people who stay, which is the figure that should guide next year’s budget.

The full year-end readiness list lives in What Should a Practice Have in Place Before January?

Practices lose leads over the holidays because inquiries keep arriving while coverage drops. Staff take time off, offices close, voicemail has no callback plan, web forms land in an inbox nobody checks, and ads keep spending. A written holiday coverage plan that names who checks inquiries, when callbacks happen, and what ads do closes the gap.

When does the holiday coverage gap happen for a practice?

The holiday coverage gap usually runs from the days before Christmas through the first business day of January. In 2026, the OPM federal holiday schedule lists Christmas Day on Friday, December 25, and New Year’s Day on Friday, January 1, 2027. Two long weekends, with reduced staffing in between, can leave a practice without anyone watching inquiries for days.

Demand does not take the same break. In a poll conducted November 4 to 5, 2025, the American Psychiatric Association found that 41% of U.S. adults anticipated more holiday stress than the year before, up from 28% in 2024. APA President Theresa Miskimen Rivera, M.D., said the season “can be fraught with stress for some, driven by various circumstances such as finances, family relations, and grief.” A practice should expect some inquiries to arrive in late December, while staff are out.

What causes holiday inquiries to go unanswered?

Holiday inquiries go unanswered because the routing that works in a normal week depends on people who are out. A voicemail greeting says “we’ll call you back” with no date. Web forms go to a shared inbox that one person checks. Chat messages sit until someone logs in, and the paid campaigns keep sending new prospective clients into that quiet system.

Beacon has seen what this looks like in the data. An audit of one client’s inquiries found leads that were never returned at all. Beacon also sees a common pattern in which the first call to a new inquiry reaches voicemail and that single attempt gets logged as “contacted,” so the record looks handled when the person never heard from anyone. The holidays stretch both problems across more days.

What belongs in a holiday coverage plan?

A holiday coverage plan names a person for each closed or short-staffed day, sets fixed times to check voicemail, forms, and chat, and schedules callbacks for the first open morning. Every held inquiry goes into one list with an owner, so nothing depends on memory after the break. The plan also adjusts paid ads. Google Ads ad scheduling lets advertisers “specify certain hours or days of the week when you want your ads to show.”

The after-hours greeting and form auto-reply should give a specific return date. Both should also include whatever crisis resources the practice’s clinical leadership specifies. Record and test both messages before the office closes, so nobody discovers a broken greeting or a silent form on the first morning back.

What does this answer not cover?

This answer covers inquiry handling for prospective clients who have not started care. It does not cover clinical coverage for current clients, on-call arrangements, or crisis response protocols, which belong to the practice’s clinical leadership and its licensing and payer requirements. Nothing here is clinical advice or a substitute for a practice’s own after-hours clinical policy.

The page also leaves out staffing rules, holiday pay, and employment law, which vary by state. The APA figures describe U.S. adults generally, not people seeking behavioral health care, and they do not predict inquiry volume for any single practice. Holiday dates reflect the federal schedule; a practice’s own closures may differ. Ad scheduling details reflect Google’s help page as of September 2026, and other ad platforms use different settings.

Frequently asked questions

Should a practice pause its ads over the holidays?

A practice should pause or reduce ads for any day when nobody will respond to inquiries within the practice’s normal standard. If someone is covering calls and forms, ads can keep running. The decision belongs in the coverage plan and should be made before the office closes.

What should a holiday voicemail greeting say?

A holiday voicemail greeting should say when the office is closed and the exact day callbacks will happen, and include whatever crisis resources the practice’s clinical leadership specifies. It should also invite callers to leave a name and number, because a clear callback date keeps people from assuming they were ignored.

How fast should holiday inquiries be returned?

Holiday inquiries should be returned at the first scheduled check, with every held inquiry called back on the first open morning. Beacon’s standard for normal days appears in How Fast Should a Practice Respond to a New Inquiry?, and the holiday plan should get as close to it as staffing allows.

The rest of the year-end checklist is in What Should a Practice Have in Place Before January?

HIPAA vendor vetting means asking every vendor that could touch patient information the same set of questions before signing: whether it will sign a business associate agreement, whether it has a current SOC 2 Type II report, where data is hosted, which subprocessors see it, what reaches ad platforms, how fast it reports breaches, and how access ends.

Which marketing vendors does a practice need to vet?

A practice needs to vet any vendor whose tool collects, stores, or passes along information about patients or prospective patients. For a behavioral health practice, that list usually includes the marketing agency, the web developer, call tracking, the website chat widget, the CRM, online scheduling, and any form or intake tool embedded on the site. A chat widget alone can capture a name, a phone number, and a reason for reaching out.

Vendor breaches can be very large. The HHS Office for Civil Rights report to Congress on 2024 breaches found that business associates filed 106 of the large breach reports in calendar year 2024, 16% of the total, yet those reports affected 206,921,071 individuals, 85% of everyone affected that year. The report notes that the largest 2024 breach, a ransomware attack on a health care clearinghouse, affected about 192 million people on its own.

What questions should a practice ask a marketing vendor?

A practice should ask each vendor the same eight questions and get every answer in writing. Several track the terms in the HHS sample business associate agreement provisions, which cover breach reporting, subcontractors, and return or destruction of data at termination.

1. Will you sign a business associate agreement, and can we review it before signing?
2. Can you share your most recent SOC 2 Type II report, and what period does it cover?
3. Where is our data hosted, and does it stay in the United States?
4. Which subprocessors handle our data, and do they agree to the same restrictions?
5. What exactly does your tool send to ad platforms or analytics services, and what gets hashed or removed first?
6. How quickly will you notify us of a breach or security incident?
7. Does each of your staff members use a unique login to our accounts?
8. When we leave, how do you remove access and return or destroy our data?

Which vendor answers should concern a practice?

Vague answers on breach timing, subprocessors, or ad platform data should concern a practice most, because those are the areas a practice cannot inspect on its own. A vendor that will not name its subprocessors, cannot say what its script sends, or treats the business associate agreement as a formality is showing the practice how it will behave after signing. A vendor that says contact details are hashed before they reach an ad platform should concern a practice too. FTC technology staff wrote that hashes “can still be used to identify users.”

Breach timing has real consequences. In a March 2026 settlement with a patient communication software company whose 2020 incident affected about 15 million people, OCR Director Paula M. Stannard said: “When a breach occurs, business associates must notify affected covered entities without unreasonable delay and within 60 calendar days of discovery.” Beacon’s working standard is to get each vendor’s notification window in writing and to prefer one well inside that limit.

What does this vetting list not cover?

This vetting list does not cover whether a specific vendor, contract, or configuration meets HIPAA requirements. Compliance is the covered entity’s obligation, and a vendor’s agreement or audit report does not make a practice compliant. The list also does not replace the practice’s own HIPAA risk analysis, a technical review of what a vendor’s script sends, or a review of indemnity and liability terms. Substance use disorder programs under 42 CFR Part 2 and practices subject to state health data laws may need additional terms. Clinical software such as the EHR is outside this marketing-focused list.

This page is general information about vetting marketing vendors and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

What is a SOC 2 report?

A SOC 2 report comes from an independent CPA examination of a vendor’s controls. The AICPA describes it as an examination of controls at a service organization relevant to “security, availability, processing integrity, confidentiality, or privacy.” Ask for the Type II report and which period it covers.

Does a signed BAA mean a vendor is safe to use?

A signed business associate agreement sets obligations on paper. How a vendor actually handles data shows up in its answers on hosting, subprocessors, ad platform data, and breach timing. The agreement matters most when something goes wrong, which is why a practice should read its terms before signing.

How often should a practice re-vet its vendors?

Beacon’s working standard is at every renewal and whenever a vendor adds a feature that touches patient data, such as a new tracking script or AI tool. A yearly review of every vendor with account access also catches tools that were added without anyone running through these questions.

The questions an owner should ask about the vendor behind their contact form are covered in What’s Actually Behind Your Practice’s Contact Form?

Most health advertisers can’t run compliant retargeting because retargeting builds audiences from page visits, and a visit to an eating disorder page reveals health information. Google bars advertiser-curated audiences when promoting mental health services, and Meta restricts custom conversions that suggest health conditions. Beacon measures campaigns on conversion counts with no contact or health details and reaches broad or contextual audiences instead.

What makes standard retargeting a problem for behavioral health practices?

Standard retargeting is a problem because the audience carries health information. A pixel on a depression treatment page adds each visitor to a list defined by that page, and the ad platform learns who looked at it. The practice is telling the platform who showed interest in which condition.

The FTC has acted on similar data flows. It charged that BetterHelp revealed email addresses, IP addresses, and health questionnaire answers to advertising platforms, and BetterHelp agreed to pay $7.8 million in 2023. The FTC’s BetterHelp refund page reports a further round in April 2025: “payments totaling over $2.6 million to more than 534,000 people.”

In February 2023, the FTC also said GoodRx uploaded contact details of users who had bought particular medications to Facebook and targeted them with health-related ads. Samuel Levine, then Director of the FTC’s Bureau of Consumer Protection, said in the GoodRx announcement: “Digital health companies and mobile apps should not cash in on consumers’ extremely sensitive and personally identifiable health information.”

What do Google and Meta allow health advertisers to do?

Google and Meta both limit health-based targeting and tracking in their own policies. Google’s health in personalized advertising policy treats mental health conditions as a sensitive interest category and states that advertiser-curated audiences “can’t be used if promoting in sensitive interest categories, because they may inadvertently contain sensitive user signals.” That includes Google’s “Your data segments” and Customer Match.

Meta tightened its own rules in 2025. Meta’s pixel conversion tracking documentation states: “Beginning September 2, 2025, we will start to roll out more proactive restrictions on custom conversions that may suggest information not permitted under our terms.” Its examples include conversions suggesting “specific health conditions.” A conversion named for a condition page, such as anxiety or an eating disorder, is the kind of signal these rules describe.

What can a behavioral health practice run instead?

A behavioral health practice can run campaigns that reach broad or contextual audiences and are measured on conversion counts with no contact or health details, with no audience lists built from condition or service pages. Relevance comes from search keywords, content placements, and ad copy that speaks to the services a practice offers, in place of data about who visited which page.

Beacon’s standard is that no names, contact details, or health information are sent to an ad platform, and that tracking stays off booking, intake, and portal pages. Beacon uses server-side conversion tracking under a signed business associate agreement with the tracking provider to strip those details before a conversion reaches an ad platform. What arrives is a generic event, such as an appointment request, with a hashed IP address and no condition, service, page address, or form content. Beacon measures and optimizes campaigns on counts of those events.

What does this answer not cover?

This answer does not cover whether any particular campaign, tracking setup, or vendor meets HIPAA, FTC, or state law requirements. Compliance is the covered entity’s obligation, and no tracking tool makes a practice compliant. The page makes no claim that condition-based retargeting can be done compliantly, and it offers no performance guarantee for any approach.

Platform policies change often. The Google and Meta language quoted here reflects their pages as of September 2026, and each platform’s current help pages control. The page does not address substance use disorder records under 42 CFR Part 2, state health data laws such as Washington’s My Health My Data Act, or email marketing to existing patients.

This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

Can a practice retarget people who visited a specific condition page?

Not on Google when promoting mental health services: its policy bars advertiser-curated audiences there, including “Your data segments” and Customer Match. Meta flags custom conversions that suggest health conditions. Beacon does not recommend or build condition-based retargeting lists, and this page does not describe a compliant way to build one.

Does server-side tracking make retargeting compliant?

No tool makes a practice compliant, and server-side tracking is not a retargeting workaround. Beacon uses it only to strip contact and health details before a conversion reaches an ad platform, and hashed contact details are not sent either. FTC technology staff wrote that hashes “can still be used to identify users,” pointing to BetterHelp’s hashed email addresses.

Will campaigns perform worse without condition-based audiences?

Results vary by market, budget, and offer, and no one can promise a number. Beacon measures and optimizes campaigns on stripped-down conversion counts, and it tests changes on its own campaigns before applying them to client accounts. Condition-based lists stay off the table either way.

What sits behind a practice’s contact form, and how Beacon handles it, is covered in What’s Actually Behind Your Practice’s Contact Form?

A HIPAA-ready marketing agency signs a business associate agreement whenever its work touches protected health information and knows every tag on the practice’s website. It keeps tracking off booking, intake, and portal pages, sends ad platforms no contact or health details, gives each person a unique login, and removes its access cleanly at the end.

Why do unique logins matter when an agency manages your accounts?

Unique logins matter because a shared login makes every action impossible to trace to one person. The HIPAA Security Rule lists unique user identification as a required implementation specification at 45 CFR 164.312(a)(2)(i): “Assign a unique name and/or number for identifying and tracking user identity.”

That rule governs systems that hold electronic protected health information. Beacon’s working standard applies the same principle to every ad account, analytics property, CRM, and website login an agency touches, because a practice owner should be able to see who did what, and when, without guessing.

Account security matters because hacking dominates the breach numbers. The HHS Office for Civil Rights report to Congress on 2024 breaches counted 663 breach reports affecting 500 or more people in calendar year 2024, and 534 of them (81%) were hacking or IT incidents.

What should an agency know about the tracking on your website?

An agency should be able to list every tag firing on the practice’s website, what each tag sends, and where it goes. HHS guidance on online tracking states that “Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI,” and that tracking on unauthenticated appointment or symptom-checker pages “may have access to PHI in certain circumstances.”

A federal court in Texas vacated part of that guidance in June 2024, so the status of general public pages is contested. The conservative expectation avoids that question: tracking stays off booking, intake, and portal pages, and no names, contact details, or health information go to an ad platform in any form. FTC technology staff wrote that hashes “can still be used to identify users.”

The same care applies to analytics. Google’s Analytics help page on HIPAA says Google “does not offer Business Associate Agreements in connection with this service,” so an agency using it should say how protected health information stays out.

What else belongs in a HIPAA-ready agency relationship?

A business associate agreement belongs in the relationship when the agency creates, receives, maintains, or transmits protected health information for the practice. An agency answering web inquiries, storing call recordings, or managing a CRM with patient details likely fits that description. An agency that only buys ads may not, and it should say plainly which it is. What Is a Business Associate Agreement and When Do You Need One? covers the basics.

Patient lists should never go to ad platforms in any form. When the engagement ends, the agency should remove every login it held and confirm that in writing. OCR Director Paula M. Stannard put the principle simply in an August 2025 settlement announcement: “A HIPAA risk analysis is essential for identifying where ePHI is stored and what security measures are needed to protect it.” Agency access belongs in that analysis.

What does this checklist not cover?

This checklist does not cover whether a specific practice, agency, or tool meets HIPAA requirements. Compliance is the covered entity’s obligation, and no agency or vendor can make a practice compliant on its behalf. Clinical documentation, EHR configuration, and staff training sit outside the marketing relationship and outside this page.

The page also leaves out rules outside HIPAA. Substance use disorder programs covered by 42 CFR Part 2, practices subject to state health privacy laws, and practices facing Federal Trade Commission rules on health data have obligations this list does not address. The court ruling mentioned above is described only as HHS reports it, and nothing here predicts how any pending case will end.

This page is general information about how website tracking works and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

Does every marketing agency need to sign a BAA?

Not necessarily. HHS describes a business associate as a party that creates, receives, maintains, or transmits protected health information for a covered entity. An agency that never touches that information may not qualify. An agency that handles inquiries, call recordings, or CRM records usually does.

Should an agency upload patient lists to Facebook or Google?

Beacon’s working standard is no. A patient list tells an ad platform that each person on it receives care from the practice, and FTC technology staff wrote that hashing does not make such data anonymous. A practice should ask any agency whether it has ever uploaded one.

What should happen to agency access when a contract ends?

The agency should remove its own users from every account, return ownership of ad accounts and analytics properties to the practice, and confirm the removal in writing. The practice should then review each account’s user list itself. Unique logins make that review possible, because every remaining user has a name attached.

How Beacon handles the form data and tracking on its clients’ websites is explained in What’s Actually Behind Your Practice’s Contact Form?

There is no single right number of attempts to reach a new lead. Each practice should set its own written follow-up rhythm with its clinical leadership. A reasonable starting point is four or five contacts over about five business days, starting fast and ending with a final attempt that leaves the choice with the person.

Why doesn’t one follow-up cadence fit every practice?

One follow-up cadence can’t fit every practice because the people reaching out differ. Beacon runs a written cadence for its own agency leads, but a business buyer is in a different position from a person contacting a therapist for the first time.

A prospective client may be calling from work, unsure about starting care, or in real distress. Too few attempts miss people who couldn’t pick up; too many feel like pressure at a vulnerable moment. The right rhythm depends on each practice’s population, staffing and clinical judgment.

Paul Batalden, founding board chair of the Institute for Healthcare Improvement, adapted a colleague’s saying into the line “Every system is perfectly designed to get the results it gets.” A practice with no written rhythm gets whatever each staff member does that day.

What might a practice’s follow-up rhythm look like?

A practice’s follow-up rhythm might look like the table below, Beacon’s suggested starting point for clinics to adapt. Beacon’s published goal for the first response, explained in How Fast Should a Practice Respond to a New Inquiry?, is five minutes.

Time	Recommended action	Purpose
Immediately to 5 minutes during business hours	Call once; if no answer, send a brief text or email only if the person consented to that channel	Respond while motivation is high
Same business day	One additional contact attempt, preferably through a different permitted channel	Make access easy without feeling intrusive
Next business day	Call plus one concise written message with booking link, insurance or payment information, and a direct way to reach a human	Reduce friction and clarify the next step
Days 3 to 5	One final live attempt or personalized message	Offer help, acknowledge choice, and avoid pressure
After day 5	Close active outreach unless the person asked otherwise; retain records only per consent, privacy policy, and applicable law	Prevent repeated, unwanted contact

Texts and automated calls need consent. An FCC rule published in March 2024 notes that, under the Telephone Consumer Protection Act, “certain types of calls and texts may only be sent with the prior express consent of the called party,” and people can revoke it. Record consent on the inquiry form and in the CRM.

What if an inquiry suggests someone may be at risk?

An inquiry that suggests someone may be at risk leaves the routine follow-up rhythm immediately. If a form, voicemail or message mentions self-harm, suicidal thoughts or another urgent safety concern, it goes straight to the person clinical leadership has designated, under the practice’s own protocol.

That protocol is a clinical decision covering business hours, evenings and weekends. Front desk and intake staff need to know how to recognize these messages and who to hand them to, including when that person is unavailable. Clinical leadership also decides what crisis resources appear in after-hours greetings and automatic replies. A marketing follow-up rhythm should never decide how quickly a person at risk hears back.

What should a voicemail or text to a new lead say?

A voicemail or text to a new lead should give a first name, the practice name and a callback number, and stop there. It should never mention symptoms, a diagnosis or the reason the person reached out. HHS guidance on leaving messages for patients says covered entities “should take care to limit the amount of information disclosed on the answering machine.”

Those messages usually land on a personal phone. The CDC’s National Center for Health Statistics reported in June 2025 that 78.7% of adults lived in wireless-only households in late 2024. If the practice name signals a type of treatment, a first name and number may be enough.

What does this answer not cover?

This answer covers follow-up with people who make a routine new inquiry. It does not set clinical protocols for inquiries that suggest risk; those belong to licensed clinical staff and the practice’s own policies. It does not cover marketing to people who never inquired, and referral-only or waitlisted programs may need a different rhythm.

This page is general information, not legal advice. Consent rules, state privacy laws and HIPAA obligations change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.

Frequently asked questions

What happens after day five?

After day five, active outreach stops unless the person asked the practice to keep trying. Every attempt stays logged by time, channel and outcome, and the inquiry reopens whenever the person reaches back out. Records are kept only as consent, the practice’s privacy policy and applicable law allow.

What if a lead asks the practice to stop contacting them?

If a lead asks the practice to stop, the practice stops on every channel and records the request. FCC rules let people revoke consent to texts and automated calls, and callers must honor those requests within set time limits. The FCC revises these rules, so review the written rhythm when it does.

The larger follow-through question is covered in Are You Ghosting Your Own Leads?

Practices stop following up after one attempt because the process ends there. The first call gets logged as “contacted,” no one owns the second attempt, no written cadence says what comes next, and inquiries sit in separate phone, form and email queues. Ownership and process cause it, and a named owner, clear status rules and one shared list fix it.

Why does follow-up stop when no one owns it?

Follow-up stops when no one owns it because each person assumes someone else made the next call. The front desk believes intake has it, intake believes the front desk called back, and the owner is in session. Without one name attached to each inquiry, the first attempt becomes the last one by default.

Turnover makes this worse. In a May 2026 MGMA Stat poll of medical group leaders (303 responses), 28% reported higher staff turnover than in 2025, and MGMA noted that front-desk and entry-level administrative roles remain among the most common churn points. When follow-up lives in one person’s habits, it leaves when that person does. Who Should Own Lead Follow-Up in a Behavioral Health Practice? explains how to name an owner and a backup.

How does the word “contacted” end follow-up too early?

The word “contacted” ends follow-up too early when staff apply it after any attempt, including a voicemail. Once an inquiry shows “contacted,” it drops off the list of people still waiting, even though no one has spoken with the person. Beacon has observed that the first call to a new inquiry often reaches voicemail, and that one attempt gets logged as “contacted.”

A missing written cadence adds to the problem. If nothing on paper says how many attempts to make, on which channels and over how many days, each staff member decides alone, and a busy afternoon decides for them. The management scholar W. Edwards Deming said it plainly at a February 1993 seminar: “A bad system will beat a good person every time.”

What fixes follow-up that stops after one attempt?

A practice fixes follow-up that stops after one attempt by changing the process around the people doing it. Two more causes usually sit underneath: inquiries arrive by phone, form and email with no single list, and the person answering the phone is also checking in clients. Practice leaders across medicine are watching the phones too: in a December 2025 MGMA Stat poll, 22% of medical practice leaders named phone access their top patient access focus for 2026.

Cause	Fix
One attempt logged as “contacted”	“Contacted” means a real conversation; every other outcome is logged as an attempt
No named owner	One owner per inquiry, with a backup for days off
No written cadence	A written cadence that sets attempts, channels and days
Phone, form and email tracked separately	One shared list, usually the CRM, where every inquiry lands
Front desk also checking in clients	Follow-up time blocked on the schedule, away from the front window

What does this answer not cover?

This answer covers why follow-up with new inquiries stops after a single attempt and the process changes that fix it. It does not cover clinical triage, crisis response or whether the practice can clinically serve a given person. Those decisions belong to licensed clinical staff and the practice’s own policies.

It also does not set the exact number of attempts or the wording of messages, and it does not address consent rules for texts or automated calls, which the practice should confirm with its counsel. Practices that admit only by referral, or that keep a closed waitlist, may need a clear referral path instead of added follow-up. Results depend on staffing, inquiry volume and how consistently the new process is used.

Frequently asked questions

Should the front desk own new-inquiry follow-up?

The front desk can own new-inquiry follow-up only when the role has protected time for it. A person who is also checking in clients and answering the main line will reasonably help the person standing in front of them first. Beacon’s working standard is a named owner with follow-up time blocked on the schedule, plus a backup.

When should an inquiry be marked “contacted”?

An inquiry should be marked “contacted” only after a staff member has spoken with the person or traded messages back and forth. Every other outcome, including a voicemail, an unanswered text or a wrong number, should be logged as an attempt with its date, time and channel, so the inquiry stays on the list.

The wider follow-through problem, and what it reveals about a practice’s intake system, is the subject of Are You Ghosting Your Own Leads?

To measure response time, a practice records three timestamps for every new inquiry: when the call or form arrived, when staff made the first contact attempt, and when the first two-way conversation happened. The gaps between them give two numbers, speed to first attempt and speed to conversation. Review both every week and test them with a secret-shop inquiry.

What should a practice timestamp for each new inquiry?

A practice should timestamp three moments for each new inquiry: the arrival (the call time or the form submission time), the first contact attempt by staff, and the first two-way conversation with the person. Arrival to first attempt is speed to first attempt. Arrival to conversation is speed to conversation. Both belong on the same record.

The third timestamp matters because a phone call often reaches no one. In a secret shopper study published in Community Mental Health Journal in April 2026, researchers attempted to contact 183 psychiatric providers listed in an insurer directory in Puerto Rico, and approximately 47% of the calls were answered. A practice that logs only its callbacks can look fast on paper while prospective clients are still waiting to speak with a person.

Why track speed to first attempt and speed to conversation separately?

Speed to first attempt and speed to conversation measure different things, so each needs its own column. Speed to first attempt shows how quickly staff act. Speed to conversation shows how quickly a prospective client actually talks with someone. Beacon’s published standard, explained in How Fast Should a Practice Respond to a New Inquiry?, is a response within five minutes, three minutes ideal.

A voicemail belongs in the attempt column. Federal secret shopper guidance draws a similar line: in CMS technical guidance for Marketplace health plans, a voicemail greeting during regular business hours is one of the outcomes that, logged on each of three contact attempts, defines a provider as nonresponsive. Beacon has observed that the first call to a new inquiry often reaches voicemail, and that one attempt gets logged as “contacted.” Two separate columns keep that gap visible. The weekly review should show the median for each number, the five slowest inquiries and every inquiry that still has no conversation.

How can a practice secret-shop its own response time?

A practice can secret-shop its own response time by posing as a new inquiry and timing each step. Regulators use the method too. Announcing a settlement that followed a secret shopper survey of a health plan’s listed mental health providers, New York Attorney General Letitia James said in August 2025, “New Yorkers seeking mental health care deserve timely, accurate information.” A monthly test takes five steps:

1. Agree on the test with the practice owner in advance, then use a phone number and email address the staff will not recognize.
2. Submit the website form and note the exact time.
3. Call the main line once during business hours and once after hours, noting whether a person answers.
4. Record when the first callback, text or email arrives, and what it says.
5. Compare those times with the CRM record, then cancel any appointment offered.

What does this answer not cover?

This answer covers how a practice measures the time between a new inquiry and a real conversation. It does not set a clinical standard for how soon someone should be seen, and it does not cover crisis response, clinical triage or level-of-care decisions. Those belong to licensed clinical staff and the practice’s own policies.

It also does not cover which phone system, CRM or call tracking product to choose. If a tool stores inquiry details, the practice should confirm its privacy terms, including any business associate agreement, with privacy counsel; this is general information, not legal advice. Programs that admit only by referral may measure different moments, and the staffing needed to hit the standard varies by practice. Nothing here guarantees a booking rate.

Frequently asked questions

Where does response time data live in a practice?

Response time data usually lives in four places: the phone system’s call log, which shows inbound and missed call times; call tracking reports; form notification emails or the form tool’s entry log; and the CRM, where staff record attempts and outcomes. Beacon recommends pulling all four into one weekly list.

How should after-hours inquiries be counted?

After-hours inquiries should keep their real arrival time so the record stays honest. Beacon recommends reporting them in a separate column and also measuring from the next opening time, which shows whether the first-morning callback happens fast. High after-hours volume makes the case for extended coverage or an answering service.

Measurement is the first step in the broader follow-through fix described in Are You Ghosting Your Own Leads?

Behavioral health leads go cold faster because the person reaching out may be in a hard stretch, is encouraged to contact several practices at once and can book with whichever one offers a real conversation first. A practice cannot count on that moment lasting. A fast, human first response with an actual appointment time keeps more leads warm.

Why do people seeking behavioral health treatment contact several practices at once?

People seeking behavioral health treatment contact several practices at once because reaching one that answers and has an opening is hard. In a secret shopper study published in The American Journal of Managed Care in September 2025, callers reached only 2,152 of 6,657 directory-listed providers, and appointments were available with 321 of those providers (14.9%).

That study covered social workers, marriage and family therapists and counselors listed in Pennsylvania marketplace plans, and the mean wait for an offered appointment was 33.2 days. A July 2024 study in JAMA of psychiatric prescribers listed in Medicaid networks in four large cities found that only 18 percent of sampled clinicians “were reachable, accepted Medicaid and offered an appointment,” Weill Cornell Medicine reported.

Senior author William Schpero, PhD, assistant professor of population health sciences at Weill Cornell Medicine, said that “even among psychiatrists listed as participating in Medicaid, actual access to care is apparently quite low.” Against odds like these, calling several practices is a reasonable strategy.

Why does the first practice to respond often get the appointment?

The first practice to respond often gets the appointment because people seeking care are told to keep going until someone can see them. NAMI’s guide to finding a mental health professional advises getting at least three names and numbers, booking an appointment even when the wait is long and then calling the second and third numbers on the list.

The same guide adds, “You can always cancel your first appointment if you find someone who can help you sooner.” A practice that returns an inquiry two days later may be calling someone who already has a time on another practice’s calendar.

That urgency separates behavioral health from most purchases. A homeowner collecting roofing quotes can usually wait a week for a callback without much changing. NAMI tells anyone who feels they can’t wait weeks or months for help to see a primary care doctor as soon as possible. Beacon treats the readiness behind every inquiry as something that can pass.

How can a practice keep behavioral health leads from going cold?

A practice keeps behavioral health leads from going cold by making the first response fast, human and concrete. Beacon’s published standard is a response within five minutes of a new inquiry, three minutes ideal. That response should come from a person who can offer an actual appointment time rather than a promise to call back later.

Meeting that standard starts with decisions only the owner can make. Someone has to own new inquiries during every business hour, the calendar has to hold open new-client slots each week, and inquiries that arrive after hours need a named owner for the next business day.

Practices do fall short of it. A Beacon audit of a client’s inquiries found leads that were never returned at all. The broader reasons leads stall are covered in Here’s Why Your Leads Aren’t Turning into Clients.

What does this answer not cover?

This answer covers why outpatient behavioral health inquiries lose momentum and what an owner can change about the first response. It does not cover clinical triage, crisis response or level-of-care decisions, which belong to licensed clinicians and to the practice’s own protocols.

The access figures come from specific settings: marketplace plans in Pennsylvania and Medicaid networks in four large cities. They show how hard it can be to reach a clinician in those settings and say nothing about how any single practice performs. The roofing comparison is illustrative and does not rest on measured data from other industries.

This answer also does not apply in the same way to referral-only programs or practices that keep a deliberate waitlist. Nothing here promises a specific number of booked clients.

Frequently asked questions

Is a fast response enough to keep a behavioral health lead warm?

Speed alone may not keep a behavioral health lead warm. The person may already have other appointments on hold, as NAMI’s guidance recommends, so the first response should include an actual appointment time with a suitable clinician. A fast call that ends with a promise to follow up leaves the lead where it was.

Does a waitlist make behavioral health leads go cold?

A waitlist can make behavioral health leads go cold when it is the only thing offered at first contact. NAMI advises people to book an appointment anyway and keep calling other practices, so a waitlist spot may not hold the person. Offering a specific date, even a later one, gives them something concrete.

What these cold leads cost an owner is laid out in The Lead You Never Called Back Is Still on Your Balance Sheet.

An unreturned inquiry costs a practice twice: the marketing money spent to generate it, and the expected revenue from a client who never books. Cost per inquiry is monthly marketing spend divided by monthly inquiries. Lost value is expected sessions per new client, times average reimbursement per session, times the share of inquiries that normally become clients.

What is a new client worth to a behavioral health practice?

A new client is worth the revenue from every session that client attends. The working figure is expected sessions per new client multiplied by average reimbursement per session. A practice can pull both numbers from the past year of its own EHR or billing reports, split by payer where the mix varies.

Session rates vary widely by payer. A study published in Health Affairs Scholar in September 2024 found that cash pay rates “for a typical session averaged $143.26, compared to $82.77 in Medicaid,” based on psychotherapist directory listings collected in late 2023. The authors noted they did not have data on commercial prices.

That spread is the reason to use the practice’s own payer mix. A mostly Medicaid practice and a mostly self-pay practice will put very different values on the same lost inquiry, and commercial plan rates vary again.

Why is one inquiry worth less than one full client?

One inquiry is worth less than one full client because not every inquiry books and not every new client stays. The expected value of an inquiry is a client’s revenue multiplied by the share of inquiries that normally become clients. For example, a practice that converts 40 percent of its inquiries should count 40 percent of a client per inquiry.

Sessions per client also shift over time. Describing national psychotherapy trends from 2018 to 2021, Mark Olfson, MD, MPH, a professor of epidemiology and psychiatry at Columbia University Mailman School of Public Health, said, “A decrease in the fraction of patients with just one or two psychotherapy visits further suggests there was a decline in early drop-out.”

For a single practice, early drop-out and no-shows shrink the expected session count. Using the practice’s own average, including clients who came only once, keeps the estimate honest.

What does the full calculation look like?

The full calculation puts two numbers side by side: the marketing spend already sunk into each inquiry and the expected revenue that inquiry carried. The table below is an illustrative example with round numbers chosen to show the method. The figures are not benchmarks and do not describe any real practice.

Step (illustrative example)	Math	Result
Cost per inquiry	$6,000 spend / 80 inquiries	$75
Revenue from one new client	10 sessions x $100	$1,000
Expected value per inquiry	$1,000 x 40%	$400
Cost of 10 unreturned inquiries	10 x ($75 + $400)	$4,750 a month

At that pace the example practice loses $57,000 a year in wasted spend and expected revenue. Unreturned leads do happen: a Beacon audit of a client’s inquiries found leads that were never returned. Why the first response carries so much of the budget is covered in The First Phone Call Is Your Whole Marketing Budget.

What does this answer not cover?

This answer covers a revenue-based way to estimate what an unreturned inquiry costs a practice. It does not measure profit. Clinician pay, overhead and billing costs come out of every session, so owners who want a margin view should apply their own margin to the expected value.

It leaves out referral value, returning clients and the human cost to a person who reached out and heard nothing. It is also not accounting, tax or valuation advice, and owners should review these numbers with their accountant before using them in financial planning.

The dollar figures in the example are round numbers chosen to show the method. The only published figures here are the session rates from the cited study, which reflect late 2023 directory listings and may differ from what a given practice is actually paid.

Frequently asked questions

What if a practice doesn’t know its conversion rate?

A practice that doesn’t know its conversion rate can estimate it from one recent month: count every inquiry, then count how many of those people attended a first session. The rough share is enough to start the calculation, and repeating the count each month makes the estimate more reliable.

Should cost per inquiry be calculated by channel?

Cost per inquiry can be calculated by channel by dividing each channel’s spend by the inquiries that channel produced. Paid search, directory listings and referral programs can cost very different amounts per inquiry, and running the numbers separately shows which unreturned inquiries were the most expensive to lose.

The owner-level case for treating these losses as money on the books is in The Lead You Never Called Back Is Still on Your Balance Sheet.

Many prospective patients don’t call back because reaching out once took real effort, and a missed return call asks them to find that effort again. Stigma, no privacy at work and phones that screen unknown numbers all add friction. Consented texting, clear caller ID, discreet voicemails and repeat attempts bring more of them back.

Why is calling back so hard for a prospective patient?

Calling back is hard for a prospective patient because reaching out at all can take real effort. NAMI’s guide to finding a mental health professional says the step of finding a mental health professional “sometimes feels like a challenging one,” and it suggests that people who are reluctant to call ask a friend or family member to call for them.

Stigma adds weight. In a NAMI and Ipsos poll released in March 2026, almost half of the 2,153 full-time employees surveyed said they worry they would be judged for sharing potential mental health challenges with their colleagues. Megan Delp, director of workplace mental health at NAMI, said in the release that “real barriers persist in the form of stigma and fear of retaliation or lost opportunities.” Someone carrying that worry has already pushed past it once to fill out a form. A second call is the same obstacle again, with less momentum behind it.

What gets in the way when a practice returns the call?

Two obstacles get in the way when a practice returns a prospective patient’s call. The person may be at work and unable to talk openly, and the practice’s number may look like any other unknown caller.

Privacy at work is the first. A return call that rings at a desk or in an open office asks the person to discuss something private within earshot of coworkers, the same colleagues almost half of the NAMI poll respondents worried would judge them.

The phone itself is the second. The Federal Trade Commission’s guidance on blocking unwanted calls describes call labeling that flags calls as “spam” or “scam likely,” along with Do Not Disturb settings that send calls straight to voicemail. A practice number the person never saved can land in either place.

Both obstacles can grow as the callback slips. Someone who reached out on a lunch break may be at a desk, in a meeting or driving when the return call comes.

What can a practice do to make the second contact work?

A practice makes the second contact work by letting the prospective patient answer on their own terms. That means a text option for people who have agreed to receive texts, a caller ID the person can recognize, a voicemail that reveals nothing private and more than one attempt before an inquiry is closed.

Add an optional text-consent checkbox to the inquiry form so someone at work can reply without speaking. Ask the phone provider whether outbound calls can display the practice name, and call from the number printed on the website. Keep the voicemail script neutral, with nothing that hints at why the person reached out.

Then plan every attempt after the first. Beacon has observed that the first call to a new inquiry often reaches voicemail, and that one attempt then gets logged as “contacted.” The wider set of reasons inquiries stall is covered in Here’s Why Your Leads Aren’t Turning into Clients.

What does this answer not cover?

This answer covers routine follow-up on new, non-urgent inquiries to an outpatient behavioral health practice. It does not cover clinical screening, triage, crisis response or how licensed staff should assess a new patient. Those decisions belong to clinicians and to the practice’s own protocols.

It also does not cover the rules for calling, texting or leaving messages, including consent requirements under federal and state telemarketing laws and privacy obligations under HIPAA. This is general information, not legal advice; talk to your privacy counsel before changing how the practice contacts prospective patients.

It does not set a follow-up schedule or predict how many inquiries a given practice will recover. The behavioral points come from the named sources; Beacon’s observations come from its own work with practices. Results depend on staffing, hours, payer mix and local demand.

Frequently asked questions

Should a practice text a prospective patient who hasn’t called back?

A practice can text a prospective patient who has agreed to receive texts, usually through a checkbox on the inquiry form. Keep the message short, name the practice, include a callback number and leave out anything clinical. Consent rules vary by state and channel, so confirm the approach with privacy counsel first.

What should a voicemail to a new inquiry say?

A voicemail to a new inquiry should give the staff member’s first name, the practice name, a direct callback number and the hours someone will answer. It should say nothing about why the person reached out, because someone else may hear the message on a shared phone, a car speaker or a family voicemail box.

The owner-level math on what these missed callbacks cost is in The Lead You Never Called Back Is Still on Your Balance Sheet.