What a new patient actually costs, and how to prove it

Patient acquisition cost is total acquisition spend divided by the number of new patients acquired. Published US benchmarks put it between $155 and $610 depending on the specialty. That number is unusable until you say what acquired means, because an enquiry, a booking, an arrival and a completed first visit are four different denominators.

How this was checked. The benchmark figures below were read from their original sources on 10 August 2026 and are named and dated where they appear. The platform upload limits come from Google’s and Meta’s own developer documentation, read the same day. For this query in the United States, Google returned an AI Overview and a page one dominated by vendor and agency pages answering what patient acquisition is and ten strategies to improve it, plus a video result. None of them shows the arithmetic, and neither of the two benchmark tables the niche quotes states the denominator behind its own numbers. That gap is what this page fills.

The formula everyone quotes, and the word it leaves undefined

Every source ranking for this gives the same equation:

Patient acquisition cost = total acquisition spend ÷ new patients acquired

Nobody disputes it, and nobody defines either term. The spend side is a scope decision, and practices make it differently. Here is one month at a four-clinician dermatology group, with the same expenses sorted by how often they actually get counted:

Line item	Amount	How often it gets counted
Google Ads media	$9,000	always
Meta media	$2,000	always
Agency management fee	$2,500	usually
Call tracking and scheduling software	$400	sometimes
Front-desk hours spent converting new-patient enquiries	$1,600	almost never
Total acquisition spend	$15,500

Two honest numerators come out of that table: $11,000 if you count media, $15,500 if you count what it cost to acquire patients. Neither is wrong. They differ by 41%, and no published benchmark tells you which one it used.

The denominator is worse, and it is where the word acquired hides.

Inquiry, booked, arrived, paid: four denominators, four different costs

A patient does not become a patient at a single moment. They pass four gates, and the practice can defensibly call any one of them acquisition. Same month, same $15,500, same 220 enquiries:

Rung	Count	Conversion from the rung above	Cost per unit, all-in spend	Cost per unit, media only
Enquiry — form submitted or tracked call connected	220	—	$70	$50
Booked appointment	141	64%	$110	$78
Arrived for the visit	118	84%	$131	$93
Completed a billable first visit	112	95%	$138	$98

The 64% enquiry-to-booking step is not invented for the example, and it is deliberately flattering. Patient Prism’s March 2026 analysis — drawn from 300 million patient interactions including 1,113,300 connected calls — puts the measured new-patient booking rate at 53.89%, against an industry-average band of 53% to 65% and 85% to 95% for top performers. A practice booking 64% of enquiries is already at the top of the average band.

Read the corners of that table. The narrowest defensible answer is $50 per enquiry. The widest is $138 per completed billable visit. Same practice, same month, same spend, nobody lying — a spread of 2.8×, produced entirely by two definitional choices that most practices have never explicitly made.

This is the same failure mode as counting leads without agreeing what a lead is, which is why sales and marketing teams argue about pipeline; the difference between a marketing qualified and a sales qualified lead is a denominator dispute in different clothing.

Pick one rung and write it down. The rung that survives audit is the one furthest down that you can measure reliably every month. For most practices that is booked appointment — arrivals and billable visits are more meaningful but live in the practice management system, which usually reconciles late.

Where the measurement breaks: the numerator is online, the conversion is not

In retail the click and the purchase happen in the same browser session, so the ad platform sees both ends. In healthcare they almost never do. The click happens on a phone; the conversion happens on a call to the front desk, or a walk-in, or a referral from a physician who saw the campaign months ago.

That splits the calculation across two systems that do not talk:

• The numerator lives in the ad platforms. Spend, clicks, click identifiers, and campaign structure.
• The denominator lives in the practice management or EHR system. Appointments, arrivals, procedures, revenue — and the patient’s identity, which is exactly the thing that must not travel back.

Everything difficult about measuring patient acquisition is a consequence of that split. The rest of this page is the three mechanisms that bridge it, and the limits of each.

Budget arithmetic itself — what a click costs, how to size a monthly media budget — is a separate problem with its own page; see how much Google Ads cost rather than re-deriving it here.

Call tracking answers “which ad”, not “which patient”

Call tracking assigns a different phone number to different traffic sources and swaps the number displayed on the page according to how the visitor arrived. The technique is usually sold under the name dynamic number insertion, or DNI. When the call connects, the system knows which source, campaign and often which keyword produced it.

What it genuinely gives you:

• A connected call becomes a countable enquiry, so the top rung of the ladder stops being a guess.
• Call duration and outcome tagging separate a two-minute booking from a nine-second wrong number.
• The click identifier captured in the browser session can be stored against the call record, which is what makes the next section possible at all.

What it does not give you, and what practices consistently over-claim:

• Walk-ins and word of mouth stay invisible. They never touched a tracked number.
• Callbacks from a saved number bypass the swap. Someone who visits on Monday, saves the number, and calls on Thursday from their contacts may reach a number that has since rotated to another source.
• A connected call is not a booking. Patient Prism’s same dataset counted 535,109 opportunities over thirty days across new and existing patients. New patients booked at 53.89%, leaving 142,762 missed appointments; existing patients booked at 78.85%. Only 25.97% of the missed opportunities got any follow-up attempt at all.

There is also a compliance consequence that is easy to miss. A recording or transcript of someone describing symptoms to a clinic is protected health information the moment the practice holds it. The call tracking vendor is therefore a business associate and needs a signed business associate agreement before the first call is recorded. Vendors serving healthcare offer this; the default self-serve plan usually does not include it.

Sending the conversion back to the ad platform without sending the patient

Bidding algorithms only optimise toward outcomes they are told about. If the platform never learns which clicks became patients, it optimises toward form fills and call volume, which is how a campaign ends up cheap per lead and expensive per patient. Closing that loop means sending a signal back — and the whole design problem is sending enough to be useful and nothing that identifies a person.

There are three routes, and they are not equivalent on risk.

Offline conversion import with the click identifier. The Google click identifier, GCLID, is captured as a URL parameter when the visitor lands, stored alongside the lead in your own system, and uploaded later with a conversion name, a timestamp and optionally a value. The upload contains a random string, an event label and a number. It contains no name, no email, no phone, no condition. This is the cleanest route available and it is the one to default to.

Enhanced conversions for leads. Instead of a click identifier, this matches on hashed first-party data — email, phone, name. Hashing is not de-identification in this context: the whole mechanism works precisely because the hash still matches a person on the other side. For a covered entity sending it about someone who enquired about care, that is a materially different risk position from sending a GCLID.

Meta’s Conversions API for offline events. Same shape as enhanced conversions: hashed contact fields, or an unhashed lead identifier if you captured one from a lead form. The server-side mechanics, deduplication and match quality are their own subject, covered in the Meta Conversions API walkthrough.

The rule that falls out of this is short. Send the click identifier and the outcome. Do not send the patient. If a route requires you to transmit something that identifies the individual, treat that as a decision requiring counsel, not a tracking configuration.

The upload windows: 90, 63 and 7 days, measured from different events

This is the constraint nobody ranking for the term mentions, and it is the one that silently deletes data. Read the last column carefully — the three deadlines are not counted from the same moment, which is why they cannot be compared as three numbers.

Route	What travels	Deadline, and what it is measured from
Google Ads offline conversion import	GCLID, conversion name, timestamp, value	90 days from the last click. Uploaded later than that and the conversion is not imported
Google Ads enhanced conversions for leads	hashed email, phone or name	63 days from the click. Later than that and it is rejected
Meta Conversions API, offline event	hashed contact fields or a lead ID	7 days from the conversion. An event_time more than seven days in the past makes Meta reject the whole request, not just that row. Meta separately asks for offline transactions within 62 days of the conversion, but the seven-day staleness rule is the one that bites

Now put a real dermatology timeline against those numbers. A patient clicks an ad and calls on day 0. The first available appointment is three weeks out, day 21. They cancel and rebook, day 52. They arrive, day 74.

If you defined acquisition as arrived, Google’s offline conversion import still accepts it with sixteen days to spare, and enhanced conversions for leads closed eleven days earlier. Meta will accept the same arrival only if you send it by day 81 — seven days after the visit, not seven days after the click. If the acquisition you actually care about is a consult that converts to a procedure at day 120, Google’s window is gone entirely and Meta’s depends on you having batched that week.

Two practical consequences:

1. Upload the rung you can hit inside the window, not the rung you wish you could measure. Booking usually lands well inside 90 days from the click; completed treatment often does not. Optimise the platform on the booking, report the business on the billable visit, and keep the ratio between them.
2. Run the upload weekly, not monthly. Meta’s seven-day staleness limit means a monthly batch arrives with three weeks of rows already dead — and because Meta rejects the entire request rather than the offending row, a single stale timestamp can take the whole upload with it.

What the HIPAA tracking rules say after a court vacated part of them

This section describes the state of published guidance and litigation. It is not legal advice, and the compliance decisions here belong with your counsel and privacy officer.

The sequence matters, because a lot of agency writing on this topic still quotes the version that no longer stands:

• December 2022. The HHS Office for Civil Rights issued a bulletin on online tracking technologies, taking the position that regulated entities may not use tracking tools in ways that disclose protected health information to vendors.
• 18 March 2024. OCR updated the bulletin. The update introduced what became known as the proscribed combination: the position that HIPAA obligations are triggered when an online technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers.
• 20 June 2024. The US District Court for the Northern District of Texas vacated that proscribed combination portion, holding it exceeded the department’s authority.
• 29 August 2024. OCR withdrew its appeal. The rest of the March 2024 guidance and the December 2022 bulletin remain in force.

The practical read is narrower than either side of the argument suggests. What was struck down is one specific inference — that an IP address plus a visit to a public condition page is automatically protected health information. What survives is everything else, including the straightforward case: an authenticated patient portal, a booking flow, or any page where the visitor has told you who they are and why.

And HIPAA is not the binding constraint in most of these cases anyway. The settlements have been driven by wiretapping and privacy statutes that carry a private right of action, which HIPAA does not:

Settlement	Amount	Theories pleaded
Aspen Dental Management	$18.5 million	negligence, ECPA, Florida Security of Communications Act, California Invasion of Privacy Act, California Confidentiality of Medical Information Act, Pennsylvania Wiretap Act
Advocate Aurora Health	$12.2 million	state privacy and wiretapping claims
Inova Health	$3.1 million	state privacy claims

Those three alone span $3.1 million to $18.5 million. Note what the Aspen Dental complaint alleged: tracking tools transmitting web user data to Meta and Google between 2022 and 2025. That is a marketing tag, not a clinical system.

One more structural fact worth knowing before you design any of this: Google does not sign a business associate agreement covering Google Ads or Google Analytics. No configuration of those products makes them a business associate. That is the reason the GCLID route exists — you keep the identity on your side and send the platform a token it can match to a click it already owns.

The advertising rules themselves — what a platform will and will not let a clinic say — are a different problem with a different failure mode, worked through in medical advertising on Facebook.

Where the $155-to-$610 benchmark actually comes from

Almost every patient acquisition cost figure circulating in 2026 traces back to one table. It is worth knowing its provenance before you set a target against it.

The source is First Page Sage’s Average Patient Acquisition Cost, published 31 July 2024 and last updated 23 December 2025. It reports figures from $155 for pediatrics to $610 for cosmetic and plastic surgery, with dentistry at $374, dermatology at $441 and cardiology at $577, across nineteen practice types, plus a second table of nine marketing channels. Its stated method is the agency’s own anonymised client database.

Three things about it that the pages quoting it leave out:

1. The sample is small and uneven. Per-specialty samples range from three reporting practices for rheumatology to twenty-seven for cosmetic and plastic surgery, with most specialties in the five-to-twenty-one range. A three-practice average is an anecdote with a decimal point.
2. The window is five years wide. The data covers 2021 to 2025. A single figure averaged across five years of very different media prices is a long-run average, not a current rate, and nothing on the page separates the early years from the late ones.
3. It does not state its own denominator. Nothing in the methodology says whether a patient was counted at booking, at arrival or at first billable visit. Which means the single most consequential variable in the number is unspecified.

Patient Prism’s March 2026 piece, which ranks alongside it and is frequently read as newer data, reports the same $155 to $610 endpoints — pediatrics to cosmetic surgery — with intermediate values rounded to the nearest five, and cites First Page Sage as the source for the specialty ranges themselves. The 2026 citation and the 2024 publication are largely the same dataset wearing a newer date.

Use the table the way it is actually good: as an order-of-magnitude check. If your dermatology practice computes $38 per patient, you have a counting error. If it computes $2,400, you have a different problem. Between those poles, your own prior quarters are a far better comparison than anyone’s anonymised average.

A monthly close for patient acquisition cost, in seven steps

Treat this as a bookkeeping close, not an analytics project. It takes an hour once the plumbing exists.

1. Fix the two definitions in writing. One numerator scope, one denominator rung, recorded where the next person will find it. Changing either mid-year destroys the only comparison that matters.
2. Pull spend for the period from the platforms, then add the non-media lines you committed to in step one. Use the same lines every month even when one is zero.
3. Export the rung count from the practice management system, filtered to new patients only. Existing patients rebooking are not acquisitions and they convert far better, which will flatter your number if they leak in.
4. Reconcile the two enquiry counts. Tracked calls plus form submissions from the ad platforms, against enquiries logged at the front desk. The gap is your untracked demand — walk-ins, referrals, callbacks — and it belongs in the report as a stated figure, not silently in the denominator.
5. Upload conversions for the rung you optimise on, weekly, inside the windows in the table above. Click identifier and outcome only.
6. Compute all four rungs, not just the one you chose. The step conversions between them are where the money actually is. Even in the flattering example above, 36% of enquiries never booked — 79 people — and no bid adjustment recovers that.
7. Record the number with its two definitions attached. “$110 per booked appointment, all-in spend” is a fact. “$110 per patient” is a number someone will misread next quarter.

Reading your own ladder to find the rung that leaks

Once four rungs exist, the diagnosis is mechanical and it is usually not the ad account.

• Cost per enquiry high, step conversions healthy. The problem is upstream: targeting, landing page, or you are buying the wrong intent. This is the only case where the ad account is the right place to work.
• Cost per enquiry fine, enquiry-to-booking below the 53% to 65% band. The leak is answer rate and follow-up. Against a 25.97% follow-up rate on missed opportunities, the cheapest available improvement in most practices is calling people back.
• Booking-to-arrival weak. Reminders, waiting times and rescheduling friction. No amount of media spend fixes a four-week wait.
• Arrival-to-billable weak. Intake, eligibility and consent paperwork. Operational, not marketing.

The reason the ladder is worth building is that three of those four diagnoses point away from the ad account. A practice measuring only cost per lead sees one number going up and buys more optimisation for a problem that lives at the front desk.

If you want the measurement plumbing and the campaigns run by the same people rather than by two vendors blaming each other, that is what our healthcare and wellness marketing work is built around.