One Script, Server-Side Conversions
Curve Compliance replaces browser ad pixels with one script and sends conversions from its servers to Meta Conversions API, Google Ads and Microsoft Advertising under neutral event names.
Curve for Addiction Treatment Centers
HIPAA and 42 CFR Part 2 Aware Ad Tracking for Addiction Treatment Centers
Curve Compliance is HIPAA and 42 CFR Part 2 aware ad tracking for addiction treatment centers and rehabs: it replaces browser ad pixels with one script, sends admissions inquiries, calls and bookings server-side to Meta, Google Ads and Microsoft Advertising under neutral event names, detects PHI-like patterns before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup for detox, residential, outpatient and dual-diagnosis programs, and it is typically live in about a week.
Book a call- Implement in days, not weeks
- Scale Google and Meta ads
- No engineering team required
4.9/5
average rating from healthcare organizations- HIPAA Compliant
- SOC 2 Type II
- US Hosted
What You Can Send
What a Rehab Can Send Ad Platforms, and What to Keep Out
Start with what leaves your site. The HHS bulletin on online tracking says that when a tracking vendor handles protected health information for a covered function, regulated entities must “enter into a business associate agreement (BAA) with these tracking technology vendors to ensure that PHI is protected in accordance with the HIPAA Rules.” It also says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures.”
On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated one part of that bulletin: the part that treated an IP address plus a visit to a public page about a health condition or provider as enough to trigger HIPAA. The HHS page says HHS “is evaluating its next steps in light of that order.” The lines quoted above are still on that page.
42 CFR Part 2 for substance use disorder programs
Part 2 adds its own rules. The eCFR text of 42 CFR Part 2 covers federally assisted programs, and defines a program as one that “holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment.” Federal assistance includes Medicare participation, a Controlled Substances Act registration used for substance use disorder treatment, and tax-exempt status. The rules “cover any information (including information on referral and intake) about patients receiving diagnosis, treatment, or referral for treatment for a substance use disorder created by a part 2 program,” so they can reach your admissions forms and calls.
HHS updated Part 2 with a final rule published in the Federal Register on February 16, 2024 (89 FR 12472). It implements section 3221 of the CARES Act and makes other changes “to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.” It took effect on April 16, 2024, and “Persons subject to this regulation must comply with the applicable requirements of this final rule by February 16, 2026.” As revised by that rule, Part 2 applies HIPAA's breach notification provisions to part 2 programs “in the same manner as those provisions apply to a covered entity.” Whether Part 2 covers your program, and which pages, forms and calls hold Part 2 information, are legal questions: talk to your counsel.
Meta's list of prohibited health information
Meta's page About prohibited information lists health information it does not want sent through Meta Business Tools, including “Mental health and psychological states” and “Physical locations that identify a health condition, or places of treatment and counseling.” Names for events, conversions and custom audiences “must not reflect, imply or be based on any prohibited information about people.” A substance named in a page URL or an event called detox_admission can fall under those headings. See what core setup means for a health business.
Curve Compliance sets up the ad tracking. The free website scan lists the pixels and trackers on your admissions and insurance verification pages. Curve then sends each platform only a fixed list of fields under neutral event names, keeps contact identifiers off by default and SHA-256 hashes them when you turn them on, and flags PHI-like patterns before data reaches an ad platform. Which events your program sends at all, along with consent forms, patient notices and records policies, is your team's decision under Part 2.
Platform Rules
Google, Meta and Microsoft Rules for Rehab Ads
Google Ads, Meta and Microsoft Advertising each require LegitScript certification for addiction treatment ads in the United States, and Google and Meta also require their own approval. These rules apply no matter what tracking you use. Key lines as of October 12, 2026, in each source's own words:
| Platform and policy | What the policy says |
|---|---|
| Google Ads, Addiction services | “Google restricts the promotion of recovery-oriented drug and alcohol addiction services.” Its examples include “Clinical addiction treatment providers” and “Lead generators or referral agencies for addiction services.” Approved advertisers can run these ads in listed locations, including the United States. |
| Google Ads, Healthcare and medicines (United States) | “In order to advertise for recovery-oriented drug and alcohol addiction services, you must be certified as an addiction services provider by the LegitScript Certification program.” “Advertisers must also be certified with Google.” Google's opioid painkiller policy says “This doesn't include medication-assisted treatment (MAT) drugs for opioid use disorder that meet all other requirements for prescription drugs listed on this page,” and lists an exception for “Certified addiction treatment providers in the United States.” |
| Meta, Drug and Alcohol Addiction Treatment | “Meta requires advertisers who wish to run addiction treatment ads targeting people in the United States to be certified with LegitScript and apply to Meta for permission to advertise.” Advertisers can run these ads “as long as they're certified with LegitScript and have written permission from Meta.” |
| Microsoft Advertising, Drug & Alcohol Recovery | “Advertising for drug and alcohol addiction recovery is only allowed in the United States.” Rehab facilities, group therapy, sober living facilities and similar offerings “must be certified by Legitscript.” “Landing pages and any URLs utilized in the ad must be certified.” “Lead generation ads are not allowed.” |
| LegitScript, Addiction Treatment Certification | Clinical services that may qualify “may include detox, residential or outpatient treatment, outpatient counseling, or MAT (medication-assisted treatment), with licensed healthcare professionals,” and “Addiction treatment provided as part of a co-occurring treatment program qualifies.” Its privacy standard says “US-based applicants who collect, store, or transmit Protected Health Information (PHI) must be in compliance with all applicable HIPAA requirements.” |
Certification comes from LegitScript, and permission comes from Google and Meta. Tracking decides what a platform learns after the click. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. See also Meta removed potentially prohibited information.
Capabilities
What Curve Gives an Addiction Treatment Center
PHI-Like Patterns Flagged First
Curve detects PHI-like patterns, such as condition names and form answers, before data reaches an ad platform, and flags them for you.
Admissions Calls Credited to the Ad
Calls from CallRail and other call tracking tools reach Curve by webhook, and Curve credits each one to the ad that drove it.
Attribution
How Curve Credits Admissions Inquiries, Calls and Bookings
A typical rehab funnel runs from an ad to an admissions call or an insurance verification form, then an assessment, then an admission. Curve Compliance credits each step to the original ad click and sends it on server-side under a neutral event name with a fixed list of fields, and strips PHI before data reaches an ad platform.
| Funnel step | Where it happens | What Curve does |
|---|---|---|
| Admissions inquiry or insurance verification form | Curve Forms, or your own form | Curve Forms are HIPAA-hosted intake and lead forms with ad attribution attached. The submission can be sent to ad platforms as a lead under a neutral event name. |
| Call to your admissions line | CallRail, or another call tracking tool through an incoming webhook | CallRail sends each call to Curve by secure webhook, and Curve forwards the conversion server-side, credited to the ads, campaigns and keywords that drove it. BAA status: CallRail, CallTrackingMetrics. |
| Assessment booked | Calendly, GoHighLevel, IntakeQ, Acuity and other schedulers | Keeps the ad attribution when a visitor leaves your site to book. Plain booking links work automatically, and Curve's team sets up GoHighLevel and embedded widgets. Bookings made days later still match. |
| Admission recorded | Your CRM or EHR, or Healthie, Athenahealth, OptiMantra, IntakeQ or Jane through Keragon | Incoming webhooks, Keragon or offline conversion uploads bring the outcome in, and Curve credits it to the original ad click. |
| Every step | Meta Conversions API, Google Ads and Microsoft Advertising | Sent from Curve's servers with a fixed list of fields. Event Logs show what Curve sent to each platform and what the platform accepted. |
Reporting
Campaign Reporting: Spend Next to Admissions Calls and Bookings
Campaign Reporting in Curve Compliance puts Meta and Google Ads spend next to the conversions Curve tracked, for each platform and campaign. It offers five attribution models, a list of the conversions behind any number, and a single prospect's journey from ad click to booking. HubSpot and WhatConverts outcomes show as CRM revenue and close rate.
For a rehab, that means you can see which campaigns produced admissions calls, booked assessments and admissions, not only clicks. Event Logs show what Curve sent to each platform and what the platform accepted.
Process
Set Up for You in About a Week
1
Scan Your Admissions Funnel
The free website scan lists the pixels and trackers on your admissions and booking pages.
2
Replace Pixels With One Script
Curve's team swaps your browser ad pixels for one script and connects Meta, Google Ads and Microsoft Advertising server-side, with neutral event names.
3
Connect Calls, Bookings and Admissions
Your call tracking, scheduler and CRM or EHR are linked so calls and admissions credit the right ad. Curve signs a BAA on every plan.
Scan your site
Run Curve's free website scan on the page your ads send people to. It lists the ad pixels, analytics tags, session recorders and other trackers running there. Book a call and Curve's team will go through the results with you, then set up HIPAA-compliant tracking that keeps your campaigns optimizing.
Or book a callBenefits
What Addiction Treatment Centers Get With Curve
- Admissions inquiries, calls and bookings credited to the ad that started them
- Server-side conversions to Meta, Google Ads and Microsoft Advertising
- Campaign Reporting with Meta and Google Ads spend next to conversions
- Event Logs that show what Curve sent and what each platform accepted
- A BAA on every plan, with setup done by Curve's team
Related
Guides for Addiction Treatment Centers
LegitScript, Google Ads and Meta
- Addiction Treatment Google Ads: Getting LegitScript Certified and Launching Compliant Campaigns
- Google Ads Addiction Services: Certification for Rehab Ads
- Facebook Ads for Addiction Treatment: 42 CFR Part 2 Compliance for Substance Abuse
- Meta Ads for Behavioral Health: Navigating Substance Abuse Ad Restrictions Without Rejections
Marketing by program type
- Addiction Treatment Marketing: HIPAA Compliance Guide
- Outpatient Substance Abuse Program Marketing: Local Search and Paid Strategies
- Dual Diagnosis Treatment Marketing: Substance Abuse and Mental Health Combined Campaigns
- Behavioral Health Lead Generation: Why Third-Party Rehab Leads Create HIPAA Liability
- Reputation management for rehab centers: Addiction Treatment Reputation Management: Review Response Protocols for Rehab Centers
- Curve Compliance for mental health providers
- Curve Compliance for telehealth platforms
Sources, checked October 12, 2026: eCFR, 42 CFR Part 2; Federal Register, Confidentiality of Substance Use Disorder (SUD) Patient Records (89 FR 12472); HHS bulletin on online tracking technologies; Meta, About prohibited information; Meta Advertising Standards, Drug and Alcohol Addiction Treatment; Google Ads Addiction services policy; Google Ads Healthcare and medicines policy; Microsoft Advertising Healthcare and Pharmaceutical policy; LegitScript Addiction Treatment Certification.
FAQ
Addiction Treatment Tracking Questions
Does 42 CFR Part 2 apply to rehab ad tracking?
It can. Part 2 covers federally assisted programs that hold themselves out as providing, and provide, substance use disorder diagnosis, treatment, or referral for treatment, and its coverage includes information on referral and intake. Admissions forms and calls can hold Part 2 information. Curve Compliance sends each ad platform only a fixed list of fields under neutral event names, with contact identifiers off by default. Source: eCFR, 42 CFR Part 2.
When does the 2024 Part 2 final rule apply?
HHS published the final rule, Confidentiality of Substance Use Disorder (SUD) Patient Records, in the Federal Register on February 16, 2024 (89 FR 12472). It took effect on April 16, 2024, with compliance required by February 16, 2026. It implements section 3221 of the CARES Act and increases alignment with the HIPAA Privacy Rule. Source: Federal Register, Confidentiality of Substance Use Disorder (SUD) Patient Records (89 FR 12472).
Do rehab centers need LegitScript certification for Google Ads?
Yes, in the United States. Google requires certification as an addiction services provider by the LegitScript Certification program, plus certification with Google. Its Addiction services policy also covers sober living environments and lead generators or referral agencies. Once your ads run, Curve Compliance sends admissions calls and bookings to Google Ads server-side, credited to the ad click. Sources: Google Ads Healthcare and medicines policy; Google Ads Addiction services policy.
Can addiction treatment centers run Facebook ads?
Yes, in the United States, if they're certified with LegitScript and have written permission from Meta. The policy covers in-person treatment, online treatment, addiction hotlines and mutual support groups. Curve Compliance sends Meta conversions under neutral event names with a fixed list of fields. Source: Meta Advertising Standards, Drug and Alcohol Addiction Treatment.
Can a rehab use the Meta pixel?
Meta's rules limit what the pixel may carry: it lists mental health and places of treatment and counseling as prohibited information, and says not to send information about people from pages such as patient portals. HHS says disclosing PHI to tracking vendors for marketing without patients' HIPAA-compliant authorization is impermissible. Curve Compliance replaces browser ad pixels with one script, sends Meta Conversions API a fixed list of fields under a neutral event name, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan. Sources: Meta, About prohibited information; HHS bulletin on online tracking technologies.
How do you track admissions calls from rehab Google Ads?
CallRail sends each call to Curve Compliance by secure webhook, and other call tracking tools connect through incoming webhooks. Curve credits each call to the original ad click and sends the conversion server-side to Google Ads, Meta or Microsoft Advertising under a neutral event name. Campaign Reporting then shows Meta and Google Ads spend next to those calls. Curve and CallRail.
Does Curve sign a BAA with addiction treatment centers?
Yes. Curve Compliance signs a BAA on every plan, and Curve is SOC 2 Type II. Under Part 2, a qualified service organization is a service provider with a written agreement in which it acknowledges that it is fully bound by Part 2, and the definition also includes a business associate of a part 2 program that is also a HIPAA covered entity, for PHI that is also a Part 2 record. Your program decides which agreements each vendor needs, and the BAA Directory shows which of your other tools sign one. Source: eCFR, 42 CFR Part 2. BAA Directory.
How long does setup take?
Curve's team does the setup for you, and it is typically live in about a week, though it varies case by case. Setup covers the website scan, one script in place of browser pixels, Meta, Google Ads and Microsoft Advertising server-side, and your call tracking, scheduler and CRM or EHR. Start with the free website scan.
Ready when you are
Talk to Curve Compliance
Server-side ad tracking for addiction treatment centers and rehabs, set up by Curve's team, with a BAA on every plan.
- Signed BAA included
- Live in ~7 days
- No engineering lift