CQC standards, ASA rules, and GMC guidance for marketing hospitals and medical practices in the UK. Covers both NHS-adjacent and private sector.
This is a working summary for marketing teams, not legal advice. Every rule below names the instrument it comes from so you can read the source rather than take our word for it — and so you can tell when something here has gone out of date.
Who regulates healthcare advertising in United Kingdom
- CQC Standards
- ASA CAP Code
- GMC Good Medical Practice
- Data Protection Act / UK GDPR
More than one of these usually applies at once. A campaign can satisfy the advertising regulator and still breach the data-protection one, which is the failure mode that catches most practices — the creative gets reviewed and the tracking does not.
The rules that actually change what you can publish
- Claims must be evidence-based and not misleading
- Patient consent required for testimonials
- UK GDPR applies to all patient data processing
- ASA regulates all advertising claims
- GMC governs doctor-specific advertising
- NHS branding cannot be used by private providers without permission
What this means in practice
Most of the list above is about evidence and consent. In practice that means two habits: keep a substantiation file for every claim you publish, dated, with the source attached; and treat patient consent as a precondition for publication rather than something to obtain later. Neither is expensive. Both are what an investigation asks for first.
The second recurring issue is tracking. Analytics, pixels and remarketing tags routinely collect more than a healthcare provider is permitted to share, and the default installation of most of them is not compliant in United Kingdom. Audit what your tags send before you audit your ad copy — the copy is easier to fix and less likely to be the problem.
Before you run anything
- Can you substantiate every claim in the creative, today, from a document you can produce?
- Do you have written consent for every patient who appears, covering this specific use?
- Does your tracking send anything that identifies a patient or their condition?
- Has someone qualified in United Kingdom reviewed the campaign, not just the marketing team?
If the answer to the last one is no, that is the gap worth closing first. We work inside these rules daily and will tell you when something you want to publish is not worth the exposure — but we are a marketing agency, and a regulated market deserves a qualified reviewer as well.
