Table of contents
15,032 urgent care centers were open in the U.S. as of January 2025, and two recent FTC orders - against BetterHelp and Cerebral - now name sharing identifiable health data with ad platforms as an unfair practice. Neither FTC case named an urgent care or primary care operator, but the same tracking-pixel exposure applies to any clinic intake form or patient portal. This page separates what UCA's own 2025-2026 operational data says is safe to measure from what the FTC and HHS precedent now flags as risky, for urgent care and primary care specifically.
Key Takeaways
- 15,032 urgent care centers were open in the U.S. as of January 2025.
- 670 new urgent care centers opened in 2024 alone.
- Average daily visit volume reached 33.96 patients per center in 2025, up from 33.13 in 2023.
- 39% of urgent care centers are owned by or affiliated with a hospital/health system.
- National average visit duration is 56 minutes (July 2024-June 2025).
- Volume explains only 18% of the variance in visit duration - staffing and process drive the rest.
- BetterHelp paid $7.8 million to settle FTC charges over sharing mental health data with ad platforms.
- Cerebral was ordered to pay more than $7 million in a similar 2024 FTC/DOJ action.
- BetterHelp spent USD 10-20 million a year on Facebook ads while sharing that data, per the FTC complaint.
- OCR's March 2024 revision softened, but did not remove, its 2022 tracking-technology guidance.
- Google lists physical health conditions under its Health sensitive-interest category, blocking advertiser-curated audiences on flagged pages.
- 67% of urgent care centers are open 7 days a week, per UCA's 2025 census.
- Traditional urgent care makes up 60.3% of all centers, versus 31.5% limited-service.
Why two telehealth FTC settlements matter to a walk-in clinic
Neither the BetterHelp order (2023) nor the Cerebral order (2024) named an urgent care or primary care operator. Both named telehealth mental-health platforms that shared identifiable user data, including health information, with Meta, Google, Snapchat, Pinterest and Criteo for ad targeting. BetterHelp agreed to pay $7.8 million to consumers; Cerebral was ordered to pay more than $7 million over charges that it disclosed consumers' sensitive personal health information to third parties for advertising. The legal theory in both cases - that disclosing sensitive personal health data to an ad platform for targeting is an unfair or deceptive practice - does not require the clinic to specialize in mental health. It requires only that the data disclosed be personal health information and the recipient be an ad platform, a description that fits an urgent care intake form or a primary care patient portal just as easily.
| Case | Year | What was shared | Outcome |
|---|---|---|---|
| BetterHelp | 2023 | Email, IP address, health questionnaire answers shared with Meta, Snapchat, Pinterest, Criteo | $7.8M to consumers; barred from sharing health data for ads |
| Cerebral | 2024 | Sensitive personal health information shared with ad platforms via tracking pixels | $7M+ (incl. $10M civil penalty); barred from same practice |
| Urgent/primary care exposure | Ongoing | Any intake form, portal or appointment page firing a third-party ad pixel | Same FTC theory applies; no urgent/primary care case yet filed |
What HHS OCR's guidance actually targets
Per the federal court's own summary of OCR's March 2024 Revised Bulletin in American Hospital Association v. Becerra, OCR softened its original December 2022 position: an IP address captured alongside a visit to an unauthenticated page that merely lists health conditions is no longer automatically treated as protected health information. That is good news for a public-facing urgent care or primary care service-line page. It changes nothing for an authenticated patient portal, an intake form with free-text symptom fields, or a post-visit follow-up page - exactly the page types both the OCR bulletin and the FTC orders keep returning to.
| Page type | Typical clinic use | Post-2024 OCR risk | Practical read |
|---|---|---|---|
| Public service-line page (e.g. "we treat sprains") | Both urgent + primary care | Lower after March 2024 revision | Standard analytics tags are workable |
| Appointment/booking form | Both | Elevated - links identity to intent to seek care | Avoid third-party ad pixels on the form itself |
| Patient portal (primary care, ongoing record) | Primary care, mostly | High - unchanged since 2022 | Keep third-party marketing tags off entirely |
| Same-day intake form (single encounter) | Urgent care, mostly | Moderate - thinner record, still risk if free text | Strip free-text symptom fields from any tagged form |
The operational baseline: what UCA already tracks safely
The Urgent Care Association's own 2025 data shows exactly the kind of aggregate, de-identified measurement that carries the least regulatory exposure: average daily visit volume rose from 33.13 patients per center in 2023 to 33.96 in 2025, and the network counted 15,032 open centers as of January 2025, with 670 new centers opening in 2024 alone. Separately, Experity EMR data covering 2,710 urgent care locations, presented at the 2025 Urgent Care Congress puts the national average visit duration at 56 minutes for the year ending June 2025, and notes that patient volume explains only 18% of the variance in that duration - staffing levels and internal process explain the rest. None of these figures required identity-level tracking to produce; every one is a category or network-level average.
| Safe-to-track metric | 2025 benchmark value | Compliance exposure | Source |
|---|---|---|---|
| Average daily visit volume per center | 33.96 patients/day | Low - aggregate, network-level | UCA 2025 |
| Open center count | 15,032 (Jan 2025) | Low - public business data | UCA State of Urgent Care 2025 |
| New centers opened in a year | 670 (2024) | Low - public business data | UCA State of Urgent Care 2025 |
| Average visit duration | 56 minutes | Low - operational, not identity-linked | Alan Ayers Urgent Care Congress 2025 |
| Hospital/health-system affiliation | 39% of centers | Low - ownership structure, not patient data | UCA State of Urgent Care 2025 |
Where Google Ads policy adds a separate layer
Independent of HIPAA, Google's Health sensitive-interest category covers "physical or mental health conditions, including diseases... and chronic health conditions." Neither urgent care nor primary care is flagged as a category by name, but a specific landing page - a diabetes management page, a stroke-symptom page - can trigger the same rule that governs mental health advertising: predefined Google audiences remain usable, but advertiser-curated audiences, including remarketing built from your own site visitors, are blocked for that page. That makes page-by-page review, not a blanket clinic-type exemption, the right way to check exposure before building a remarketing list.
For addiction-recovery service lines specifically - a service some urgent care and primary care networks now offer - Google requires LegitScript's Addiction Treatment Certification before ads can run at all, the same requirement that applies across Meta, Microsoft Ads and Nextdoor.
| Targeting feature | Flagged page usable? | Source | Applies to urgent/primary care when... |
|---|---|---|---|
| Predefined Google audiences | Yes | Google Ads Health policy | Landing page discusses a specific condition |
| Advertiser-curated audiences (remarketing) | No, on flagged pages | Google Ads Health policy | Same |
| Customer match uploads | No, on flagged pages | Google Ads Health policy | Same |
| Addiction-recovery ads | Requires LegitScript cert | Google Ads Health policy / LegitScript | Clinic advertises addiction/recovery services |
| Contextual/keyword targeting | Yes, unaffected | Google Ads Health policy | All pages |
Building the audit into a repeatable governance checklist
A one-time tag review goes stale the moment a marketing team adds a new pixel for a campaign. The more durable fix is a governance checklist reviewed on the same cadence as a standard growth marketing program: every new tag gets logged against the page type it sits on, using the same four-tier risk read the OCR guidance and the FTC orders both point to. A quarterly review catches a marketing team's new pixel before it becomes next year's settlement, rather than after.
| Governance step | Cadence | Who owns it | What it prevents |
|---|---|---|---|
| Log every third-party tag by page and page type | At install + quarterly | Marketing ops | Undocumented pixels on portals/intake forms |
| Review Customer Match/remarketing lists for flagged pages | Monthly | Paid media lead | Curated-audience use on a sensitive-category page |
| Strip free-text fields from any tracked form | At form build + audit | Web/dev team | Symptom or diagnosis data reaching a pixel |
| Confirm BAAs cover every ad-platform pixel in use | Annually | Compliance/legal | Uncovered third-party disclosure |
A compliant measurement stack for both specialties
In practice: keep standard analytics on public service-line pages, remove third-party ad pixels from any authenticated portal or appointment-confirmation flow, strip free-text symptom fields from tracked intake forms, and report on the same category-level metrics UCA already publishes - visit volume, duration, and center growth - rather than an individual visitor's journey. Where remarketing budget would normally sit, redirect it to contextual and keyword targeting, which Google's own policy leaves untouched. If your current stack cannot answer "which pages carry a third-party pixel and what could it infer," that is the audit to run before adding another tool - our data and analytics team can help scope one, and you can get in touch to start.
Frequently Asked Questions
Do the BetterHelp and Cerebral FTC settlements apply to urgent care or primary care clinics?
The two settlements named telehealth mental-health platforms specifically, but the legal theory behind both - that sharing identifiable health data with an ad platform for targeting is an unfair or deceptive practice - does not stop at mental health. BetterHelp's 2023 order and Cerebral's 2024 order both center on disclosing sensitive personal health information gathered through the platform to Meta, Google, Snapchat, Pinterest and Criteo for advertising. An urgent care intake form or a primary care patient portal that fires the same kind of third-party ad pixel is exposed to the same theory, even though neither FTC case named an urgent care or primary care operator.
What is the practical difference between urgent care and primary care tracking risk?
Volume and record depth. UCA's own 2025 data puts average daily visit volume at 33.96 patients per center, almost entirely walk-in, single-encounter visits with a thin digital record. Primary care runs on a persistent EHR-linked patient portal, the exact page type the HHS Office for Civil Rights guidance treats as highest risk for a tracking technology, because a portal login pairs an identity with an ongoing diagnosis history. A same-day urgent care visit form carries less of that persistent linkage, but is not risk-free once it captures a symptom or diagnosis field.
Did the 2024 OCR guidance revision loosen the tracking rules?
Partially, and only for a specific fact pattern. Per Health Law Advisor's analysis of the March 2024 revision, OCR now recognizes that an IP address captured alongside a visit to an unauthenticated page that merely lists health conditions is not automatically enough to count as protected health information. That helps a public urgent care or primary care service-line page carrying a standard analytics tag. It changes nothing for an authenticated patient portal, an intake form with free-text symptom fields, or an appointment-confirmation page - the fact pattern both the OCR bulletin and the FTC orders keep coming back to.
What can an urgent care or primary care operator still measure without the same exposure?
Aggregate, de-identified operational data. UCA already publishes exactly this kind of metric: 33.96 average daily visits per center in 2025 and a 56-minute national average visit duration, with volume explaining only 18% of the variance in that duration. A clinic can track service-line page views, call volume, and average wait time at the category level, the same way UCA tracks it network-wide, without tying any of it to an individual identified visitor.
Does Google's advertising policy treat urgent care and primary care as a restricted category?
Not automatically, unlike mental health or cosmetic surgery. Google's Health sensitive-interest category covers specific conditions, procedures and body-part-related content, not general urgent care or primary care service lines. The restriction only activates page by page - a urgent care landing page for a specific diagnosis or a primary care page discussing a chronic condition can trigger the same predefined-audiences-only rule that governs mental health advertising, even though the clinic type itself is not flagged.
Sources
Federal Trade Commission - BetterHelp order and press release, 2023
Federal Trade Commission - Cerebral order and press release, 2024
American Hospital Association v. Becerra - Opinion & Order, N.D. Tex., June 20, 2024 (quotes OCR's March 2024 Revised Bulletin)
Urgent Care Association - Urgent Care Data (visit volume 2023-2025)
Urgent Care Association - State of Urgent Care 2025
Experity EMR data (2,710 locations, 7/1/2024-6/30/2025), via Alan Ayers's Urgent Care Congress presentation, June 2025
Google Ads Help - Health in personalized advertising policy
LegitScript - Addiction Treatment Certification requirements
