HIPAA Compliant Marketing for Clinics: 10 Digital Checks

You can market healthcare services, but using or disclosing patient information for marketing generally requires the patient’s written authorization. The two narrow exceptions are face-to-face conversations and promotional gifts of nominal value. Before any digital campaign, check where website tracking sends data and whether every vendor that touches patient information has a signed business associate agreement.

TL;DR:

• For marketing that uses or discloses PHI, obtain prior written authorization naming the information, purpose, recipients, expiration, revocation right, and any payment received.
• Require a signed business associate agreement from every vendor handling PHI, including subcontractors, but remember that the agreement does not itself permit a marketing disclosure.
• Remove third party trackers from booking, symptom, intake, and portal pages, or block identifiers; retest after updates because new tags can restore exposure.
• Use public education, contextual or local ads, and secured booking flows; major ad platforms generally will not sign agreements, so keep PHI off those services.

Table of Contents

• How do you tell whether a communication counts as marketing under HIPAA?
• When is a patient authorization required, and what must it say?
• How can website tracking, pixels, and forms expose PHI?
• What does a business associate agreement need to cover?
• Which marketing tactics keep PHI out of your campaigns?
• What should you do and avoid on email, SMS, reviews, and paid ads?
• How do risk management, monitoring, and breach notification fit in?
• What is the 10-step checklist before you launch a campaign?
• Why compliance is a growth strategy, not a brake
• How we help practices market with compliance built in
• FAQ

How do you tell whether a communication counts as marketing under HIPAA?

The Privacy Rule defines marketing as a communication about a product or service that encourages the recipient to buy or use it. It also covers disclosures of patient information to a third party in exchange for payment. HHS marketing guidance lays out the definition and its exceptions in detail, and the regulation text sits in 45 CFR 164.501 and 164.508(a)(3).

The label is not decided by a call to action alone. HHS frames the question around purpose, sender, recipient, payment, and whether protected health information (PHI) is used or disclosed. Ordinary public education that uses no patient data is not the target of the rule.

These communications are generally not marketing when they meet the conditions HHS sets out:

• Treatment and care coordination, such as referring a patient to a specialist.
• Case management and prescription refill reminders.
• Descriptions of your own health-related products or services, or plan benefits, when no third party pays you to send them.

Here is how that plays out in a clinic:

• Appointment reminder to an established patient: not marketing.
• Postcard promoting a third party’s supplement, funded by that company and sent to your patient list: marketing, and it needs authorization.
• Selling or renting your patient list to another business: marketing, and it needs authorization that names the payment.
• A blog post on seasonal allergies with no patient data behind it: ordinary public education, not a PHI use.

When in doubt, ask who benefits, who pays, and whose data moved. If a third party pays you and patient data is involved, treat it as marketing.

When is a patient authorization required, and what must it say?

If a communication meets the marketing definition, you need the patient’s prior written authorization before using or disclosing their PHI for it. HHS states that the only exceptions are face-to-face communications and promotional gifts of nominal value. A hand-delivered brochure during a visit fits the first; a branded pen fits the second.

A valid authorization is more than a signature line. It must include:

• A specific description of the information to be used or disclosed.
• The purpose of the use or disclosure.
• Who will receive the information, by name or class of recipients.
• An expiration date or event.
• A statement that the patient can revoke the authorization in writing.

If a third party pays you for the marketing use or disclosure, the authorization must say so. That remuneration statement is the detail practices most often miss. The HHS FAQ on marketing authorizations repeats it.

A common operational trap is treating a newsletter checkbox as a HIPAA authorization. It is not. A generic opt-in on a signup form usually lacks the required elements, and it does not substitute for a compliant marketing authorization. If your list mixes patients and non-patients, separate them, and have patients who will receive marketing built on their PHI sign a proper authorization.

Keep a signed copy of every authorization and a record of when each is revoked or expires. Without that record, you cannot prove the campaign was permitted.

How can website tracking, pixels, and forms expose PHI?

OCR’s bulletin on online tracking technologies, issued November 19, 2022, says HIPAA obligations apply when covered entities or business associates use tracking technologies that collect identifiers or ePHI in context. The vendor’s identity does not matter. What matters is what the technology receives, where it sends it, and whether that disclosure is permitted.

Pages carry the highest risk when a visitor’s activity reveals something about their health and the visitor is identifiable. Typical leak paths include:

• Appointment booking pages that pass a condition or provider name to an analytics tool.
• Symptom checkers that send answers alongside an IP address or cookie ID.
• Authenticated patient portals running third-party scripts.
• Contact and intake forms wired to a CRM or ad pixel.
• Call-tracking numbers that record or tag condition-specific calls.

Fixing this takes a data-flow review, not just removing one pixel. Work through it in order:

1. List every page and form on your site and mark which ones touch appointments, conditions, or logins.
2. Inventory every script, pixel, tag, and plugin firing on those pages, including ones an agency added.
3. Remove third-party trackers from PHI pages, or restrict them so they receive no identifiers.
4. Where a vendor must receive PHI, confirm it will sign a business associate agreement and has been configured accordingly.
5. Where a vendor will not sign one, keep PHI away from it entirely, or de-identify the data first.
6. Retest after every site update, because new plugins and tag changes reintroduce risk.

Pro Tip: Open your booking page in a browser with developer tools running and watch the network requests. Any request leaving to an ad or analytics domain with a page URL, form value, or ID is a data path to review.

What does a business associate agreement need to cover?

A vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate, and HHS business associate guidance says you must have a written agreement with it. A marketing agency that handles patient data for a provider falls in this category. HHS also confirms that failing to have a required agreement can itself be a HIPAA violation, and business associates can be directly liable for their own compliance. Their subcontractors count too.

A strong agreement addresses at least these terms. HHS sample provisions are a useful starting point:

• Permitted and prohibited uses of PHI, including a bar on the vendor using it for its own purposes.
• Required safeguards for the data.
• Reporting of incidents and breaches, with a stated timeline.
• Flow-down of the same obligations to subcontractors.
• Return or destruction of PHI when the relationship ends.

An agreement is necessary, but it does not make a marketing use lawful. The Privacy Rule still decides whether your campaign may use the PHI at all. Signing one does not authorize uploading a patient list to an advertising platform.

Good governance goes past the contract:

• Give each vendor the least access it needs and document the configuration.
• Reserve audit rights and ask which subcontractors and integrations touch your data.
• Confirm retention and deletion practices, not just promises.
• Set a clear internal owner for vendor incidents.

Accuracy of clinical data matters here too. Partners such as Health Code Index offer code validation and compliance checks for billing systems, which is a reminder that integrations between systems deserve the same scrutiny as marketing tools.

Pro Tip: Ask each vendor for a one-page diagram showing where your data enters, where it is stored, and who else can see it. Vague answers are a signal to pause.

Which marketing tactics keep PHI out of your campaigns?

The safest campaigns separate audience education from patient-level activation. OCR’s tracking guidance points to the data path as the typical failure point, so design the path before the creative.

These patterns work without PHI:

• Education-first content. Publish articles, videos, and guides on conditions and treatments aimed at the general public. They attract prospective patients without using anyone’s records.
• Contextual targeting. Place ads next to relevant content or search terms, rather than building audiences from condition-level patient data.
• Broad geographic and demographic targeting. Target a service area and general interest groups, not individuals identified as patients.
• Consented lists only. If you need audience matching, use lists of people who signed a HIPAA authorization for that purpose, and only with a vendor under a business associate agreement. Otherwise de-identify the data before it leaves your systems.
• Authenticated conversion flows. Capture PHI only inside secured systems that do not feed pixels or third-party trackers. A public landing page can invite a call; the intake itself happens behind a login.

A practical example: a dental practice wants more implant consultations. Instead of uploading its patient list to build a lookalike audience, it publishes patient-education content, runs search ads on implant-related terms in its city, and sends visitors to a landing page with no embedded ad tags. The booking form lives in its practice software. The campaign reaches the right people, and no patient record ever leaves your control.

This is where a human voice helps. Content written in the practitioner’s own words builds trust without needing invasive tracking. We build campaigns on that principle, and our Asheville team and our other location teams apply it for local practices.

What should you do and avoid on email, SMS, reviews, and paid ads?

Each channel has its own traps. Use this as a quick filter:

• Email and SMS to patients. Messages about treatment, care coordination, appointment and refill reminders, or your own services are often permitted without marketing authorization. Messages promoting a third party’s product, or sent because someone paid you, are marketing and need authorization. Do not put condition details in the subject line or text preview.
• Online reviews. Invite reviews with a neutral request that asks for a star rating and does not ask for clinical details. Never reply to a review in a way that confirms someone was a patient or reveals treatment details, even if the reviewer shared their own story.
• Paid ads. Major ad platforms generally will not sign business associate agreements. Keep identifiable patient data off those platforms, and do not use platform pixels on pages that reveal appointments or conditions.
• Retargeting. Retargeting built from visits to condition-specific or booking pages can disclose PHI in context. Limit retargeting to general pages, or skip it for sensitive service lines.
• Call tracking. Check that recordings and tags do not capture identifiable health details sent to third parties.
• Non-HIPAA data. Even where HIPAA does not apply, the FTC reminds marketers that health-related data sold or shared with ad networks can still trigger enforcement.

Verify the thresholds with your compliance lead before launch, because the line between treatment communications and marketing turns on purpose and payment, not channel.

How do risk management, monitoring, and breach notification fit in?

The Security Rule expects administrative, physical, and technical safeguards, and a documented risk analysis. That analysis should include marketing data flows: your website, forms, CRM, call tracking, email platform, and agency dashboards. Tools that nobody classifies as clinical systems are where gaps hide.

OCR’s cybersecurity guidance highlights controls worth building into your routine. Start with these:

• Multi-factor authentication on every system that can see patient data.
• Encryption of data in transit and at rest.
• Role-based, least-privilege access, reviewed when staff or vendors change.
• Logging and monitoring that would reveal an unexpected data transfer.
• Network segmentation and phishing awareness training.
• A written incident response plan with named contacts.

If a breach of unsecured PHI occurs, covered entities and business associates must notify affected individuals and HHS OCR, and in some cases the media. The annual breach report to Congress summarizes how these requirements work in practice. Your business associate agreement should set how fast a vendor must tell you, so you can meet your own deadlines.

Not every entity that handles health data is covered by HIPAA. The FTC’s Health Breach Notification Rule covers certain health apps and similar entities outside HIPAA, requiring notice to consumers, the FTC, and sometimes the media. April 2024 amendments, described in the FTC announcement, clarified that scope for modern health technologies. Map which regime applies to each data flow, since one campaign can touch both.

What is the 10-step checklist before you launch a campaign?

Run this before spending a dollar on ads. It also works as your documentation trail.

1. Inventory pages and data flows. List every page, form, script, and system the campaign touches.
2. Classify the PHI risk. Mark each flow as no PHI, possible PHI in context, or PHI.
3. Pick a campaign design. Choose a pattern that avoids PHI, or one that is permitted with authorization.
4. Decide whether it is marketing. Apply the definition and the exceptions, and write down the conclusion.
5. Obtain authorizations if required. Confirm each includes every required element and the remuneration statement where relevant.
6. Confirm vendor agreements. Verify a signed business associate agreement for every vendor that handles PHI, and review its settings.
7. Test the tracking configuration. Check live pages for stray pixels and identifiers leaving your site.
8. Verify safeguards. Confirm encryption, multi-factor authentication, access limits, and logging are active.
9. Set monitoring and contacts. Name an incident owner and a vendor contact, with notification timelines.
10. Document and sign off. Your privacy or compliance officer approves, and you file the analysis, authorizations, agreements, and test results.

Pause the campaign if any of these are true: a tracker fires on a booking or portal page, a vendor will not sign a required agreement, or an authorization is missing a required element. Keep your records for the period your compliance policy and state law require, and update them whenever the campaign changes.

Why compliance is a growth strategy, not a brake

Patients hand clinics their most personal information, and marketing that treats that trust casually costs more than any fine eventually. In my view, the practices that grow steadily are the ones that treat compliance as part of how they sound to patients, not a legal hurdle bolted on at the end. A clear, honest message in the practitioner’s real voice, with no hidden tracking behind it, tends to hold up better with both patients and regulators.

There is also a practical benefit. A marketing partner that already understands these rules takes work off the clinician’s desk, so more time goes to patients instead of data-flow diagrams.

— Robert

How we help practices market with compliance built in

Marketing that attracts patients and respects their privacy does not require choosing between the two. We build compliance-aware campaigns for healthcare practices, shaped around your voice and your patients’ trust, so you can spend your time on care.

• Practitioner-specific marketing that reflects how you actually talk to patients.
• Authentic content creation that educates without using patient data.
• Targeted ad campaigns designed to keep PHI out of ad and analytics systems.
• Compliance-aware campaign design, with transparent analytics you can review.

Ready to see where your current campaigns stand? Visit HealthJam to learn more about our services, and we will walk through your data flows with you.

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

FAQ

What is HIPAA compliant marketing?

It is marketing that does not use or disclose protected health information without the patient’s written authorization, unless an exception applies. It also means controlling website tracking and having business associate agreements with vendors that handle PHI. HHS marketing guidance sets out the definition and exceptions.

Which marketing activities do not require patient authorization?

Face-to-face communications and promotional gifts of nominal value do not need authorization. HHS also treats treatment, care coordination, refill reminders, and descriptions of your own services as outside the marketing rule when the stated conditions are met. Public education that uses no PHI raises no authorization question.

Will ad platforms sign business associate agreements?

Major ad platforms generally do not, so keep identifiable patient data and PHI-revealing page activity away from them. OCR advises that if a vendor will not sign an agreement, you should avoid disclosing PHI to it.

Can we ask patients for online reviews?

Yes, if the request is neutral and asks for a rating without clinical details. Do not publish or confirm PHI in replies, even if the reviewer shared their own story. A review request that uses patient data for a third party’s benefit could become marketing and need authorization.