HIPAA does not ban medical marketing, but it does require you to know what patient information each form, tracking tool and vendor touches before it goes live. HIPAA is the federal law that protects patients’ health information, and PHI (protected health information) is the information it covers.
Before adding a form, tracking tool or communication platform, establish what information it will collect, where that information goes and who can access it. These questions help your practice review a proposed marketing setup, whether you run it in-house or through managed marketing with an agency.
Review the Information Flow, Not a Product Label
HIPAA does not prohibit medical practices from marketing. It does require you to control how protected health information, or PHI, is used and disclosed.
Ask the agency for a written data-flow map and vendor list. Review it with the people responsible for privacy, security and clinical operations at your practice.
HHS (the U.S. Department of Health and Human Services, which enforces HIPAA) explains that using or disclosing protected health information for marketing generally requires the patient’s written authorization, with limited exceptions such as communications about the patient’s own treatment. A general website checkbox is not a substitute. HHS marketing guidance →
Check What Tracking Tools Transmit
Review the actual data collected by pixels (small pieces of code from Google, Meta and others that report what visitors do on your site), analytics, forms and scheduling tools. Do not assume that a tool is appropriate because another local business uses it.
HHS’s tracking guidance includes a notice that a court vacated its treatment of an IP address combined with a visit to certain unauthenticated public health pages. Assess the actual information and circumstances with qualified advisors; do not treat every public page visit as PHI. Read the guidance and court-order notice →
Your agency should be able to explain:
- Which pixels and scripts are installed
- What information each tool receives
- Which pages each tool can access
- Whether the vendor will sign a Business Associate Agreement (BAA), a contract in which a vendor that handles PHI agrees to protect it
- How sensitive pages are excluded from tracking
- How conversions are measured without exposing PHI
- How the setup is reviewed when campaigns or pages change
Separate the Purpose of Each Message
A patient agreeing to receive care is not automatically agreeing to receive promotional texts or emails.
Your forms should distinguish between:
- Transactional messages, such as appointment confirmations
- Care-related communications
- Educational communications
- Promotional emails or text messages
- Review requests and reputation campaigns
Marketing permissions should be clear, specific, and easy to withdraw. Opt-outs should be honored across your CRM (customer relationship management software, the system that tracks every inquiry and patient conversation), email platform, text messaging system, and other connected tools.
Limit Information Collected in Marketing Tools
Lead forms should collect only what is necessary at that stage of the patient journey. Our guide to HIPAA-compliant forms walks through each field and what to ask your form vendor.
Route clinical information through the practice’s approved channels. Identify which vendors handle PHI, which agreements are needed and what safeguards apply before granting access. The same questions apply to phone tools; see what to check before using a voice AI receptionist.
Security should include practical controls such as:
- Encryption in transit and at rest
- Role-based access (each person sees only what their job needs)
- Multi-factor authentication (a second login step, such as a code sent to a phone)
- Audit logs (a record of who opened or changed what)
- Secure hosting
- Access removal when staff or vendors change
- Documented incident response procedures
Review Advertising Audiences and Disclosures
Patient lists, retargeting (showing ads to people who visited your website) and conversion uploads (sending records of who booked back to Google or Meta) need a review of applicable privacy requirements and platform restrictions. Meta’s advertising standards, for example, bar ads that assert or imply a person’s health condition. Keeping booking reports inside the practice is different from sending those records to an ad platform.
Review Public Replies and Patient Stories
Your practice must not confirm someone’s patient relationship in a public response. Even if a reviewer shares specific information, your reply should remain general and move any discussion offline. HHS has settled with a dental practice in 2019 and a New Jersey provider in 2023 over patient details shared in replies to online reviews.
A compliant review flow should help your team:
- Send general post-visit review invitations
- Avoid including treatment details in messages
- Honor communication preferences
- Manage opt-outs
- Avoid review incentives and screening for positive feedback (the FTC’s 2024 rule bans rewards that depend on a review being positive or negative)
- Use approved response templates
- Escalate sensitive reviews privately
Before publishing a patient story, image or testimonial, have the practice verify the required authorization and intended uses. A public review does not automatically permit the practice to disclose additional information.
Approve Automation and Opt-Out Handling
A HIPAA-aware nurture system (automated emails or texts that keep in touch with leads and patients over time) focuses on:
- Clear channel-specific consent
- General educational content
- Practice updates
- Broad service information
- Secure appointment reminders
- Easy opt-out instructions
- Controlled access and auditability
- Suppression lists (lists of people who have opted out) that sync across systems
Questions to Resolve Before Launch
-
Will you sign a Business Associate Agreement when your work involves PHI?
If the answer is unclear, ask which parts of the engagement may involve PHI and how those parts are handled. -
Which vendors will receive information from our forms, CRM, calls, or website?
You should receive a clear list, not a vague reference to “our technology stack.” -
Will you install Meta, Google, TikTok, session-recording, or other tracking tools?
Ask which pages they can access and how sensitive pages are excluded. -
Do you upload patient or lead lists to advertising platforms?
The agency should explain its policy and the safeguards around audience creation. -
How do you separate marketing consent from appointment and care communications?
Look for channel-specific consent, suppression management, and clear opt-out procedures. -
How do you request reviews without revealing patient information?
Ask to see the type of message and response process they use. -
How do you handle testimonials and before-and-after content?
Written authorization should be specific. A general intake form is not enough. -
Who owns the accounts, data, website, and campaign history?
You should be able to retain access to your business assets if the relationship ends. - How do we keep internal appointment reporting separate from data sent to advertising platforms?
HIPAA and Healthcare Marketing at a Glance
| Area | What to check | Ask your agency for |
|---|---|---|
| Information flow | What each form, tool and vendor collects, where it goes and who can see it | A written data-flow map and vendor list |
| Tracking tools | Which pixels and scripts run on which pages; part of HHS’s 2022 guidance was vacated by a court in 2024 | A list of installed tools and how sensitive pages are excluded |
| Messages and consent | Promotional, care and appointment messages kept separate; opt-outs honored everywhere | Channel-specific consent and synced suppression lists |
| Vendors | Which vendors handle PHI and what safeguards apply | A signed BAA wherever PHI is involved |
| Ad audiences | Patient lists, retargeting and conversion uploads reviewed before use | Their policy on uploading patient or lead lists |
| Reviews and stories | General replies that never confirm a patient; written authorization for testimonials and photos | Their review-request message and response templates |
| Ownership | Who holds the accounts, data, website and campaign history | Confirmation that your practice keeps access if the relationship ends |
Common Questions About HIPAA and Healthcare Marketing
Does HIPAA prohibit medical practices from marketing?
No. HIPAA limits how protected health information is used and disclosed, and HHS explains that using it for marketing generally requires patient authorization, with exceptions. Marketing that does not use PHI, such as general educational content and public service pages, is not restricted in the same way.
Do tracking pixels on my website violate HIPAA?
It depends on what the tool receives and from which pages. HHS issued guidance on online tracking technologies, and a federal court set aside part of it, so the picture is still changing. Ask your agency which tools are installed, which pages they can see and how sensitive pages are excluded, and have your compliance advisor review the answers.
Can I reply to a patient’s online review?
Yes, but keep the reply general. Do not confirm the person is a patient or mention treatment details, even if they shared their own. Invite them to contact the office directly.
What should I ask a marketing agency about HIPAA?
Start with the nine questions above: whether they will sign a Business Associate Agreement when PHI is involved, which vendors receive your data, which tracking tools they install, and who owns your accounts. If you want marketing help with these questions answered up front, see our paid advertising, local SEO and CRM software pages, or plans and pricing.
What to Do Before Your Next Launch
Send the nine questions above to your agency in writing and keep the answers on file. Start with the two that cause the most trouble: which tracking tools run on pages where patients enter health information, and which vendors will sign a BAA. Review the answers with your compliance advisor or counsel before any new form, pixel or texting tool goes live. Our Practice Growth Review reviews public information only; it is not a HIPAA compliance audit. This article is general information, not a determination about your practice’s legal obligations.
Sources
- U.S. Department of Health and Human Services, Marketing (HIPAA Privacy Rule guidance, December 3, 2002, revised April 3, 2003).
- U.S. Department of Health and Human Services, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (issued 2022, updated June 26, 2024, with notice of the June 20, 2024 court order in American Hospital Association v. Becerra).
- U.S. Department of Health and Human Services, Business Associate Contracts (published January 25, 2013).
- U.S. Department of Health and Human Services, Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients’ Protected Health Information (October 2, 2019).
- U.S. Department of Health and Human Services, HHS Office for Civil Rights Reaches Agreement with Health Care Provider in New Jersey That Disclosed Patient Information in Response to Negative Online Reviews (June 5, 2023).
- Federal Trade Commission, Final Rule Banning Fake Reviews and Testimonials (August 14, 2024).
- Meta Transparency Center, Privacy Violations and Personal Attributes (accessed October 2026).