By Aidan Sowa, CEO and Founder, Frontier Industries | October 2026
The first hospital annual report was a ledger. Beds, births, deaths, dollars, written down so a community could check whether its institution deserved to survive. That ledger instinct is gone from modern health system communications, replaced by brand campaigns your board cannot audit. This guide restores the ledger: it weighs agency types against the actual work a health system generates, and it uses published breach, trust and workforce data to price the cost of choosing badly. A health system does not buy publicity. It buys fewer bad days.
Key numbers for this decision:
- 732: large health data breaches reported to the HHS Office for Civil Rights in 2023 (HHS Office for Civil Rights, 2024 report to Congress)
- 113 million: individuals whose protected health information those breaches exposed (HHS Office for Civil Rights, 2024)
- 86 percent: adults who trust their own doctor for reliable health information, the benchmark your system competes with (KFF, 2025)
I Discrimen
A health system is not a brand with beds attached
The distinction that decides everything else: a health system is a regulated utility that happens to compete. Your agency is not selling a product launch calendar. It is managing public confidence in an institution that holds a community monopoly on emergencies, employs thousands of neighbours, and answers to regulators who can read your press releases as evidence.
Most agency pitches ignore this. They show consumer launch reels, influencer maps and awareness dashboards. Those artefacts answer a question you did not ask. Your real questions are harder. Can this firm write a breach notification that satisfies the HHS Office for Civil Rights and a frightened patient in the same paragraph. Can it prepare your chief executive for a legislative hearing. Can it explain a service line closure to the county that depends on it.
Confidence is the product. Coverage is one input among many, and often the least important one.
Ask for the ledger test. Ask any finalist to describe the worst week they ever managed for a regulated client, in detail, with the documents they produced. A consumer agency will describe a launch that underperformed. A health system agency will describe a notification letter, a call centre script and a regulator timeline. Only one of those answers belongs in your building.
II Machina
The machine that grades you runs on regulators, ratings and local news
Three mechanisms set your reputation, and your agency must work all three. The first is regulatory: the HHS Office for Civil Rights publishes every breach affecting 500 or more people on a public portal, and your name sits there permanently. The second is measurement: quality ratings, safety grades and patient experience scores are republished by local media as league tables, whether you participate or not. The third is local journalism, still the channel your community trusts most for institutional news.
An agency that only pitches national health reporters is working one gear of a three gear machine. The breach portal gear turns on legal precision. The ratings gear turns on clinical translation, turning quality data into language a reporter can print without a statistics degree. The local gear turns on relationships built before you need them, because a newsroom that knows your communications director answers the phone at midnight will call before publishing.
Relationships are built in peacetime and spent in wartime. There is no other order.
Test the machine knowledge in the pitch. Ask how the firm would respond in the first four hours after a ransomware event takes your electronic record offline. The correct answer starts with patient safety messaging and a downtime procedure story, not with a holding statement about how seriously you take privacy. Every health system says that sentence. It has never calmed anyone.
III Exemplum
The breach year showed exactly what a weak bench costs
In 2023 the HHS Office for Civil Rights received 732 reports of breaches affecting 500 or more individuals, exposing the protected health information of more than 113 million people (HHS Office for Civil Rights, 2024). Hacking and IT incidents drove 81 percent of those breaches and 96 percent of the records (HIPAA Journal analysis of OCR data, 2024). One incident, at a single large hospital operator, accounted for over 11 million affected individuals on its own.
Read those numbers as a communications buyer. The breach itself is an IT event. Everything after it is a communications event: the notification letters, the call centre surge, the credit monitoring questions, the local television crew in your car park, the state attorney general, the class action filing that quotes your own website back to you. Systems with rehearsed crisis benches worked from scripts their agencies had written in advance, with notification language pre-cleared by counsel. Systems without them improvised in public.
The example generalises beyond breaches. A maternity unit closure, a surgeon under investigation, a billing scandal: the pattern is identical. The story is set in the first day by whoever has documents ready. Improvisation is a strategy only if your strategy is losing slowly.
Your agency is the firm that writes the documents before the day arrives. Judge finalists on the documents they have already written for somebody else, redacted as needed. Paper beats polish, every time.
IV Damnum
The cost of the wrong firm is paid in workforce and bond markets first
When a health system loses public confidence, the damage does not arrive as a reputation score. It arrives as nurses who stop applying, as a bond rating conversation that gets harder, as donors who quietly pause, and as elected officials who decide your expansion plans are politically expensive. KFF polling in 2025 found that 86 percent of adults trust their own doctor for reliable health information, while trust in institutions runs far lower (KFF, 2025). Your clinicians are your credibility reserve. An agency that puts administrators in front of cameras while doctors stay silent is spending your weakest asset and hoarding your strongest.
Workforce is the sharpest edge. Health systems compete for the same nurses and technicians as every system in the region, and candidates research employers the way patients research surgeons. A system that looks chaotic in local coverage pays more per hire, in agency staffing fees and in signing bonuses, than a system that looks governed. That differential never appears in a communications budget, which is why weak agencies never get blamed for it.
Count it anyway. Before you sign, ask your human resources lead what a one point improvement in local reputation would be worth in recruitment spend. Then ask the agency finalists how their programme would move it. The firm that cannot connect its work to your hiring problem is selling decoration.
V Genus
Agency types behave very differently inside a regulated institution
| Agency type | What it does well for a health system | Where it fails you |
|---|---|---|
| National healthcare specialist firm | Crisis depth, regulatory fluency, clinical translation | Senior people sell, junior people staff |
| Generalist national network | Scale, media reach, research resources | Health team is one floor of a general building |
| Regional boutique agency | Local newsroom trust, executive access, speed | Thin bench during a multi week crisis |
| In house team plus freelancers | Institutional knowledge, total control | No surge capacity, no outside pattern recognition |
| Consumer brand agency | Creative campaigns, recruitment advertising flair | Treats a breach like a product recall, badly |
No type is disqualified by its label. Each is disqualified by a specific gap you can test. The specialist firm must prove the people in the pitch are the people on your account at 2 a.m. The regional boutique must show a written escalation plan for the week its two principals are both in your boardroom and a story breaks elsewhere. The in house model must explain where surge capacity comes from when notification letters go to 200,000 patients.
Types are promises. Staffing plans are facts.
Shortlist two types at most, and score them against the same scenario exercise: a Friday evening ransomware disclosure with a Monday legislative inquiry attached. The scenario is not theatre. It is your most probable worst month, rehearsed in miniature.
VI Regio
Your market structure decides which skills matter most
A monopoly system in a rural region needs a different agency from a system fighting three competitors in a metro market. The rural system needs government relations weight, community benefit storytelling and crisis steadiness, because its existential risks are political and workforce related. The metro system needs differentiation, service line marketing discipline and ratings management, because its existential risk is leakage to the system across town.
Segment your own demand honestly before you read proposals. List the ten stories most likely to define your next three years: a campus expansion, a union negotiation, a quality rating cycle, a physician group acquisition, a service consolidation, a payer dispute that goes public. Then map each story to the skill it demands. The agency whose case history covers seven of your ten stories is your frontrunner, whatever its size.
Local knowledge compounds. National reach depreciates. A firm that knows your state hospital association leadership, your health department press officer and your market television assignment editors starts six months ahead of a famous name learning them on your retainer.
VII Occasio
The opening is that clinician voices are underpriced and underused
KFF found doctors remain the public most trusted source of health information, ahead of every agency and institution (KFF, 2025). Yet most health systems communicate through administrators, because administrators are available and clinicians are busy. That is a scheduling problem masquerading as a strategy. An agency worth its fee solves the scheduling problem: it builds a clinician bench, trains twelve physicians and nurses a year as spokespeople, pre-records explainers on your highest volume conditions, and keeps a roster current enough that a credible clinical voice is never more than one phone call away.
The equaliser runs deeper. A mid sized system with a disciplined clinician bench routinely out communicates a larger rival whose programme depends on executive statements. Cameras prefer scrubs to suits. So do patients, boards and, quietly, bond analysts reading local coverage for signs of competent management.
Ask finalists for their clinician training curriculum, by name of module. If the answer is a single media training afternoon, you have learned what you need to know.
The bench also protects your executives. Every hour a trusted physician spends explaining a clinical story on camera is an hour your chief executive is not the face of a problem she did not create. Boards notice who absorbs pressure well. So do the reporters deciding how much benefit of the doubt your next hard story receives.
VIII Consilium
Score the decision, do not vibe it
| Criterion | Weight | What good looks like |
|---|---|---|
| Crisis record in regulated settings | 25 percent | Named scenarios, documents produced, references who lived it |
| HIPAA and regulatory fluency | 20 percent | Staff who can draft OCR ready language without counsel rewriting it |
| Local and trade media relationships | 15 percent | Assignment editors and health trade reporters who take their calls |
| Clinician bench building | 15 percent | A training system, not a training day |
| Measurement discipline | 15 percent | Reports tied to trust, recruitment and leakage, not clip counts |
| Bench depth and surge plan | 10 percent | Written cover for simultaneous crises and principal absence |
Bring your general counsel and your chief human resources officer into the final scoring, not just marketing. The agency serves the institution, and the institution risks sit in their offices as much as yours.
Sign for twelve months with a crisis retainer defined separately from programme fees, and review at month six against the scorecard you used to hire them. You are not buying a vendor. You are appointing the people who will speak when speaking is hardest. Choose them the way you choose a surgeon: record first, manner second, price last.
Frequently asked questions
How much should a health system expect to pay a PR agency?
Programme retainers for a mid sized system typically sit well above consumer brand fees because crisis cover and regulatory drafting are senior labour. The honest answer is that the retainer is the small number; a single mishandled breach notification can cost more in legal exposure and call centre surge than a decade of fees. Buy the bench first, then negotiate the programme.
Should the agency or our lawyers write breach notifications?
Both, in that order of drafting and approval. The agency drafts for comprehension because frightened patients stop reading legal prose. Counsel approves for compliance because the HHS Office for Civil Rights reads every word. Any firm that resists legal review, or any legal team that resists plain language, is a risk you do not need.
Do we need a national firm for national stories?
Rarely. National health stories are usually local stories that travelled, and wire pickup follows strong local coverage. What you need is a firm whose local work is good enough to travel, plus trade relationships with the health policy press. Paying a national premium for a logo list is the most common overspend in system communications.
How fast should an agency respond in a crisis?
Acknowledge within the hour with verified facts only, even if the verified fact is that verification is under way. Your contract should name response times, named responders and a 24 hour contact chain. Test it once before you need it, on a weekend, without warning the account team.
Can one agency handle both marketing communications and crisis?
Yes, if the crisis team is separately staffed and separately retained. The failure mode is a campaign team improvising crisis work because the contract bundled everything into one fee. Keep the benches distinct on paper and in the staffing plan. See how the service is structured on the public relations services page for one model of the split.
What should we prepare before the agency starts?
A document library: pre-cleared holding language for your top ten scenarios, clinician spokesperson roster, regulator contact map, and a plain English summary of your quality data. An agency that asks for this library in week one is serious. One that asks for your brand guidelines first is not.
How do we judge the agency after six months?
Against the scorecard you hired on: crisis readiness drills completed, clinician bench size, local coverage quality, and movement in the trust and recruitment measures you set at signing. Clip volume is not a measure of anything except clip volume.
How this guide was built
This guide draws on published data from the HHS Office for Civil Rights, KFF and the HIPAA Journal analysis of federal breach reports, all cited in the text and listed below. It is an advisory framework, not an audit of any individual firm, and it reflects United States regulatory conditions. Retainer norms vary sharply by market and system size, and nothing here substitutes for reference calls with clients who have lived through a crisis with the firm you are considering.
IX Incipe
Where Frontier Industries fits
Frontier Industries is the industry focused practice behind this guide series, and its health system work is built the way this guide prescribes: crisis documents drafted before they are needed, clinician benches trained as a programme rather than an event, and reporting tied to trust and workforce outcomes instead of clip counts. Read the full set of sector guides in the resources library and the background of the team on the about page. For a parallel sector view, see the companion guide on choosing a PR agency for medical practices.
If your system is scoring agencies now, start with the scenario exercise above and one structured conversation: start an industry campaign enquiry or call 401-219-4207.
Sources
1. HHS Office for Civil Rights, HIPAA compliance and data breach reports to Congress, 2023 data. https://www.hhs.gov/hipaa/index.html 2. HIPAA Journal, OCR reports to Congress on HIPAA compliance and data breaches in 2023. https://www.hipaajournal.com/ocr-reports-congress-hipaa-compliance-data-breaches-2023/ 3. KFF, Poll finds most adults lack confidence in key health agencies to act independently, 2025. https://www.kff.org/health-information-trust/kff-poll-finds-that-most-adults-lack-confidence-in-key-health-agencies-to-act-independently/ 4. KFF, New poll shows public divided on trusting federal health agencies, 2025. https://www.kff.org/health-information-trust/new-kff-poll-shows-public-divided-when-it-comes-to-trusting-federal-health-agencies-for-reliable-information/ 5. American Hospital Association, Fast Facts on US Hospitals. https://www.aha.org/statistics/fast-facts-us-hospitals 6. CDC, National Center for Health Statistics, Data Brief 445 on telemedicine use. https://www.cdc.gov/nchs/products/databriefs/db445.htm 7. Press Ganey, Patient Experience research and insights. https://www.pressganey.com/resources/ 8. Edelman, Trust Barometer, health sector findings. https://www.edelman.com/trust-barometer 9. American Medical Association, Code of Medical Ethics, advertising and publicity. https://www.ama-assn.org/delivering-care/ethics 10. Definitive Healthcare, HealthcareView industry reports. https://www.definitivehc.com/resources