HIPAA does not stop a practice from advertising. It controls how a practice uses what it knows about its patients: their names, contact details, photos, visits and conditions. Most marketing problems come from treating patient information as a mailing list or as content.
Verified
Practices
Vendors
HIPAA
Privacy
What counts as marketing under HIPAA?
Under the Privacy Rule, a communication that encourages a patient to buy or use a product or service is marketing, and a practice needs the patient's written authorization before using their information for it. The rule carves out the communications practices make every day: describing the practice's own services, communications for the patient's treatment, and care coordination.
So a practice may send its patients a newsletter about a new service, remind them about a follow-up, or tell them a physician has joined. What it may not do without authorization is let another company use its patients' information to promote that company's products, or sell its patient list. Those two are where vendors' offers usually lead.
Which common activities need a patient's authorization?
The table sorts everyday marketing activities by what the rules require. It is a starting point for a conversation with the practice's privacy officer or counsel, not a substitute for one.
Verified
Common marketing activities and what they need
Activity
Marketing under HIPAA?
What it needs
A newsletter or email to patients about the practice's own services
No, it describes the practice's own services
Nothing beyond the email and texting rules below.
Letting a vendor send its own promotions to your patients
Yes
Each patient's written authorization, and more if the vendor pays.
Selling or renting the patient list
Yes, and a sale
Authorization from every person on the list.
Posting a patient's photo, story or testimonial
A use of the patient's information
A signed authorization naming each place it will appear.
Uploading patient emails to an ad platform
A use of the patient's information
Authorization; most practices should simply not do it.
Replying to an online review
A possible disclosure
A reply that confirms nothing about the reviewer's care.
How do the rules apply to photos, testimonials and reviews?
Photos and stories are patient information. A recognizable face, or any comparable image, is one of the identifiers that must be removed before information counts as de-identified, so a before-and-after photo is almost always identifiable. Get a signed authorization that names the uses, keep it with the image, and honor a patient who withdraws it.
Reviews are the trap practices fall into without meaning to. A patient's public complaint does not give the practice permission to discuss their care in reply.
What do the rules say about websites, tracking and vendors?
Marketing tools see more than practices realize. An analytics or advertising tag on a booking page, a symptom form or the patient portal can pass health information to the tool's owner. A chat widget, form builder or call tracking service that handles patient information is a business associate, and needs an agreement before it does.
The working rule is simple: keep advertising tags off pages where patients identify themselves or describe their health, and sign a business associate agreement with any vendor that touches patient information, including marketing agencies that manage forms or call recordings.
Which records get extra protection?
Two kinds of record are off limits for marketing in practice even where the general rules would allow a use. Psychotherapy notes need the patient's authorization for almost any disclosure. Substance use disorder records from a federally assisted program fall under a separate federal rule with its own consent requirements.
What about texts and email to patients?
HIPAA is not the only rule on messages. Texts and calls follow the telephone consumer rules, and commercial email follows CAN-SPAM, whether it goes to patients or to referring physicians. Reminders and care messages are informational; promotions are commercial and need consent for texts and an opt-out for email.
Questions to ask
Who is the practice's privacy officer, and do they see marketing plans before launch?
Which vendors touch patient information, and which have signed business associate agreements?
Where are signed photo and testimonial authorizations kept?
Which website pages carry analytics or advertising tags?
Is there a written policy for replying to online reviews?
Questions people ask.
Is a practice newsletter marketing under HIPAA?
Not when it describes the practice's own services or relates to patients' care. It becomes marketing that needs authorization when it promotes another company's product in return for payment, or when another company uses the list.
Can a practice post patient testimonials and photos?
Yes, with each patient's signed authorization for the specific uses, and with the FTC's rules on typical results applied to what the testimonial says. State boards may add limits; see the state board index.
Is it a HIPAA problem to use a tracking pixel on a practice website?
It can be. HHS says tracking on pages where patients log in, book or describe symptoms can expose health information, so keep pixels off those pages unless a business associate agreement covers the vendor and the use is permitted.
Sources
Every rule and figure on this page was read on the source’s own page on the date shown. The guide was last checked on .