Rules

The federal rules, in one place.

State boards write most of the rules on physician advertising, but a set of federal laws applies in every state: patient privacy, endorsements and reviews, texts and calls, health claims, referral payments and a few more. Here is each one, grouped by what a practice or recruiter is doing.

Verified

  • Federal law
  • Practice marketing
  • Physician recruiting
  • Cited and dated

Each rule below is summarized from the regulator's own page and linked to it, with the day we read it and, where the page names it, the statute or regulation behind it. A short phrase copied from the page shows the wording the summary rests on. The guides on this site cite these same entries, so a rule reads the same wherever it appears.

These summaries describe the rules; they do not say whether a particular ad, contract or arrangement complies. State law adds its own layer, and the state medical board index is where this site keeps it.

Verified

The 45 rules, by what you are doing

What you are doingRulesRegulators
Using patient information in marketing8HHS Office for Civil Rights, FTC
Testimonials, reviews and photos6FTC, HHS Office for Civil Rights
Texting, calling and emailing3FCC, FTC
Advertising drugs, devices and procedures13FTC, FDA, CDC
Paying for referrals and paying physicians7HHS Inspector General, CMS, FTC, USCIS, HHS HRSA
Advertising prices, bills and emergency care5CMS, HHS Inspector General
Accessibility and telehealth3HHS Office for Civil Rights, DOJ Civil Rights Division, HHS
Each group below lists its rules with the regulator, the law its page names, a phrase copied from the page and the source, read on the date shown.

What may a practice do with patient information in its marketing?

Privacy law reaches marketing before any ad runs: deciding whom to contact, which vendor holds the list, what a tracking pixel sends and whether a record can follow a sale. Most of these rules come from the HIPAA Privacy Rule, with a stricter federal regime for substance use treatment records and an FTC order that shows how the agency treats health data shared with advertising platforms.

The HIPAA marketing rule

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
45 CFR 164.501; 45 CFR 164.508(a)(3)

Under the HIPAA Privacy Rule, a communication about a product or service that encourages the patient to buy or use it is marketing, and a practice needs the patient's written authorization before using their health information for it. A practice describing its own services, a communication made for the patient's treatment, and care coordination are not marketing. Selling a patient list, or handing patient information to another company that pays for the chance to promote its own product, always needs each patient's authorization.

“covered entities may not sell lists of patients or enrollees to third parties without obtaining authorization from each person on the list”

Source: HHS: Marketing, HIPAA Privacy Rule guidance, read

Tracking tools on a practice's website

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights

HHS says tracking technologies on pages where patients log in generally have access to protected health information, and so can tracking on public pages where a visitor books an appointment or enters symptoms; where they do, the HIPAA rules apply to the practice and the tracking vendor. On June 20, 2024 a federal court vacated the part of the HHS bulletin that treated an IP address joined to a visit to a public page about a health condition as protected health information, and the HHS page notes the ruling.

“Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI”

Source: HHS: Use of online tracking technologies by HIPAA covered entities and business associates, read

Vendors that handle patient information

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
45 CFR 160.103; 45 CFR 164.504(e)

A vendor that creates, receives, keeps or transmits patient health information on a practice's behalf is a business associate under HIPAA, and the practice needs a business associate agreement with it before the vendor handles that information. HHS's examples include cloud providers, IT contractors and app developers that hold patient information for a practice.

“performs certain functions or activities regulated by the HIPAA administrative simplification regulations”

Source: HHS: Business associates, HIPAA guidance, read

Patient records when a practice is sold

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
45 CFR 164.501; 45 CFR 164.506

HHS lists the sale or transfer of assets among the business management activities that count as health care operations, which a covered practice may carry out with patient information without each patient's authorization, within the minimum necessary standard and the practice's notice of privacy practices.

“sale or transfer of assets”

Source: HHS: Uses and disclosures for treatment, payment and health care operations, read

Parents as a child's personal representative

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
45 CFR 164.502(g)

Under the HIPAA Privacy Rule, a parent, guardian or other person with legal authority to make health care decisions for an unemancipated minor generally acts as the child's personal representative, so it is that adult who signs an authorization for the child's information, with the exceptions HHS describes.

“A parent, guardian, or other person acting in loco parentis with legal authority to make health care decisions on behalf of the minor child”

Source: HHS: Personal representatives, HIPAA guidance, read

Psychotherapy notes under HIPAA

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
45 CFR 164.501; 45 CFR 164.508(a)(2)

The HIPAA Privacy Rule generally treats mental health information like any other health information, with one exception: psychotherapy notes, a mental health professional's notes analyzing a counseling session that are kept apart from the rest of the record. With few exceptions, a practice needs the patient's authorization before disclosing them for any reason, even to another treating provider. Diagnoses, medications, session times and treatment plans are not psychotherapy notes.

“One exception to this general rule is for psychotherapy notes, which receive special protections.”

Source: HHS: Does HIPAA provide extra protections for mental health information compared with other health information?, read

Substance use disorder records (42 CFR Part 2)

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
42 U.S.C. 290dd-2; 42 CFR part 2

42 CFR Part 2 protects the records of patients who receive substance use disorder diagnosis, treatment or referral from a federally assisted program. In general such a program may not share anything that would identify a person as having, or having had, a substance use disorder unless Part 2 permits it, which usually means the patient's written consent; a patient may give one consent covering treatment, payment and health care operations.

“Part 2 rules apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment.”

Source: HHS: Understanding confidentiality of substance use disorder patient records (Part 2), read

Health data shared with ad platforms

Regulator
Federal Trade Commission

The FTC finalized an order requiring the online counseling service BetterHelp to pay $7.8 million and barring it from sharing consumers' health data for advertising, after charging that it disclosed email addresses, IP addresses and health questionnaire answers to Facebook, Snapchat, Criteo and Pinterest for advertising despite promising to keep such data private. The order also bans sharing personal information for re-targeting.

“used and disclosed consumers' email addresses, IP addresses, and health questionnaire information to Facebook, Snapchat, Criteo, and Pinterest for advertising purposes”

Source: FTC: Final approval of order banning BetterHelp from sharing sensitive health data for advertising, read

What do the rules say about testimonials, reviews and photos?

Patient praise is the most persuasive thing a practice can publish and the area where federal rules are most detailed. The FTC governs endorsements, fake or suppressed reviews and gag clauses; HHS governs what a reply to a review may reveal and when a photo makes information identifiable.

The FTC Endorsement Guides

Regulator
Federal Trade Commission
Law named on the page
Section 5 of the FTC Act

The FTC reads a testimonial that describes specific results as a claim that others can expect the same, and a line such as "results not typical" does not change that. The advertiser needs proof that the results shown are typical, or must clearly disclose what people generally achieve, and must disclose any payment, gift or other connection that could change how readers weigh an endorsement.

“Statements like "Results not typical" or "Individual results may vary" won't change that interpretation”

Source: FTC: FTC's Endorsement Guides, what people are asking, read

The FTC rule on consumer reviews and testimonials

Regulator
Federal Trade Commission

The FTC's Rule on the Use of Consumer Reviews and Testimonials, in effect since October 21, 2024, prohibits fake or false consumer reviews and testimonials, buying them, and incentives conditioned on what a review says, among other practices, and lets courts impose civil penalties for knowing violations. A business that puts testimonials on its own website is disseminating them, not merely hosting them.

“which went into effect on October 21, 2024, addresses deceptive and unfair conduct involving consumer reviews and testimonials”

Source: FTC: The Consumer Reviews and Testimonials Rule, questions and answers, read

Asking patients for reviews

Regulator
Federal Trade Commission

FTC staff guidance on asking for reviews says not to ask only the customers you expect to be happy, not to have staff review the business without disclosing that you employ them and asked them to, not to tie an incentive to a positive review, and not to misuse a platform's reporting tools to remove honest negative reviews.

“Don't ask for reviews only from customers you think will leave positive ones.”

Source: FTC: Soliciting and paying for online reviews, a guide for marketers, read

The Consumer Review Fairness Act

Regulator
Federal Trade Commission
Law named on the page
Consumer Review Fairness Act

The Consumer Review Fairness Act makes it illegal to put standardized provisions in a form contract, such as intake paperwork or online terms, that bar or penalize honest reviews; the FTC and state attorneys general enforce it. A business may still remove a review that contains confidential or private information, such as a person's medical file.

“makes it illegal for companies to include standardized provisions that threaten or penalize people for posting honest reviews”

Source: FTC: Consumer Review Fairness Act, what businesses need to know, read

Answering online reviews

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights

HHS's Office for Civil Rights settled with Manasa Health Center, a New Jersey provider of adult and child psychiatric services, over a reply to a patient's negative online review that disclosed the patient's protected health information. The practice paid $30,000 and agreed to a corrective action plan; the potential violations also included having no policies and procedures for protected health information.

“impermissibly disclosed the protected health information of a patient when the entity posted a response to the patient's negative online review”

Source: HHS: Agreement with a New Jersey provider that disclosed patient information in response to negative online reviews, read

Patient photos and the HIPAA identifiers

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
§164.514(b)(2)(i)(R)

HHS lists full-face photographs and any comparable images among the identifiers that must be removed before health information counts as de-identified under the Privacy Rule's safe harbor method. A recognizable photo of a patient tied to their treatment is not de-identified, so using it in an ad falls under the authorization rule for marketing.

“Full-face photographs and any comparable images”

Source: HHS: Guidance regarding methods for de-identification of protected health information, read

What applies to texting, calling and emailing patients?

Outreach by phone, text, email and fax each has its own federal statute. Consent is the common thread: what kind the law requires, how it is recorded, and how easily the person can withdraw it.

The TCPA and patient texts and calls

Regulator
Federal Communications Commission
Law named on the page
Telephone Consumer Protection Act

FCC rules under the Telephone Consumer Protection Act require prior written consent, on paper or electronically, before a prerecorded telemarketing call to a home or wireless number, and consent before an autodialed or prerecorded call or text to a wireless number. Commercial texts need written consent; for informational texts, consent may be oral. A person may opt out at any time in any reasonable manner.

“FCC rules require a caller to obtain your prior written consent”

Source: FCC: Stop unwanted robocalls and texts, read

The CAN-SPAM Act

Regulator
Federal Trade Commission
Law named on the page
CAN-SPAM Act

The CAN-SPAM Act covers every commercial email, business-to-business email included. A commercial email may not use false header information or a deceptive subject line, must say it is an ad, must give the sender's valid postal address and a clear way to opt out, and the sender must honor an opt-out within 10 business days. A company that hires another to send its email stays responsible, and each email in violation can draw a penalty of up to $53,088.

“The law makes no exception for business-to-business email”

Source: FTC: CAN-SPAM Act, a compliance guide for business, read

Fax advertising

Regulator
Federal Communications Commission
Law named on the page
Telephone Consumer Protection Act; Junk Fax Prevention Act

FCC rules under the Telephone Consumer Protection Act and the Junk Fax Prevention Act prohibit most unsolicited fax advertisements. A business may fax an ad to someone who gave permission, or to someone it has an established business relationship with whose fax number it obtained in the ways the rules allow; those faxes must carry a notice with a cost-free way to opt out, and senders must honor an opt-out within 30 days. A recipient may sue for up to $500 for each violation.

“FCC rules under the Telephone Consumer Protection Act and Junk Fax Prevention Act prohibit sending junk faxes”

Source: FCC: Rules for junk faxes, read

What limits apply to advertising drugs, devices and procedures?

Claims about what a treatment does need proof, and claims about its regulatory status need to be accurate. The FTC polices health and weight loss claims and the eyeglass prescription rule; the FDA's consumer pages explain what approval, clearance and its warnings mean for fillers, regenerative treatments, compounded drugs, imaging, robotic systems and donated tissue; the CDC collects fertility clinic results.

Proof for health claims

Regulator
Federal Trade Commission
Law named on the page
Section 5 of the FTC Act

FTC staff's Health Products Compliance Guidance says claims about the health benefits or safety of a product generally need competent and reliable scientific evidence, as a rule randomized, controlled human clinical trials, that FTC law applies to all products and claims, and that testimonials do not substantiate a health claim.

“substantiation of health-related benefits will need to be in the form of randomized, controlled human clinical testing”

Source: FTC: Health Products Compliance Guidance, read

Weight loss claims

Regulator
Federal Trade Commission

The FTC says it has brought hundreds of cases challenging deceptive weight loss claims, that advertisers need scientific proof for the objective claims their ads make, and that its rules on consumer endorsements apply to all weight loss products, programs and services: a testimonial describing results that are not likely to be typical needs a clear disclosure of what people generally lose, and a line such as "results not typical" is not enough.

“has brought hundreds of cases challenging deceptive weight loss claims”

Source: FTC: Gut Check, a reference guide for media on spotting false weight loss claims, read

The FTC Eyeglass Rule

Regulator
Federal Trade Commission

The FTC's Eyeglass Rule requires ophthalmologists and optometrists to give each patient a copy of their eyeglass prescription immediately after a refractive eye exam, whether or not the patient asks and before offering to sell eyeglasses, without charging extra for it.

“to give patients a copy of their prescription, whether they ask for it or not and before offering to sell eyeglasses”

Source: FTC: Complying with the Eyeglass Rule, read

What "FDA approved" means

Regulator
U.S. Food and Drug Administration

The FDA approves new drugs and the highest-risk medical devices. Most moderate-risk devices reach the market through 510(k) clearance, which rests on showing the device is substantially equivalent to one already on the market, and the FDA does not approve health care providers, physician offices or laboratories, or compounded drugs.

“The FDA does not "approve" health care providers, including physician offices or laboratories.”

Source: FDA: Is it really "FDA approved"?, read

Stem cell and other regenerative treatments

Regulator
U.S. Food and Drug Administration

The FDA says regenerative medicine therapies, such as stem cell products, have not been approved for any orthopedic condition, including osteoarthritis, back, hip, knee, neck or shoulder pain, nor for chronic pain or any neurological disorder, and that a patient charged for one outside an FDA-overseen clinical trial is likely being offered a product illegally.

“Regenerative medicine therapies have not been approved for the treatment of any orthopedic condition”

Source: FDA: Important patient and consumer information about regenerative medicine therapies, read

Compounded and unapproved GLP-1 drugs

Regulator
U.S. Food and Drug Administration

The FDA warns that unapproved versions of GLP-1 drugs such as semaglutide and tirzepatide do not undergo its review for safety, effectiveness and quality, that compounded drugs should only be used when an FDA-approved drug cannot meet the patient's needs, and it names a claim that a compounded drug is the same as an FDA-approved drug as a red flag.

“Compounded drugs should only be used in patients whose medical needs cannot be met by an FDA-approved drug.”

Source: FDA: FDA's concerns with unapproved GLP-1 drugs used for weight loss, read

Over-the-counter hearing aids

Regulator
U.S. Food and Drug Administration

Adults with perceived mild to moderate hearing loss can buy over-the-counter hearing aids that meet FDA requirements in a store or online, without the supervision, involvement or prescription of a licensed health care professional.

“without the supervision, involvement, or prescription of a licensed health care professional”

Source: FDA: OTC hearing aids, what you should know, read

Dermal fillers

Regulator
U.S. Food and Drug Administration

The FDA approves dermal fillers as medical device implants for specific uses in adults over 21, such as facial wrinkles and folds and adding volume to the lips, cheeks, chin and back of the hand. It recommends against using any injectable filler for body contouring and enhancement, says injectable silicone is not approved for any aesthetic procedure, and says having filler injected should be considered a medical procedure, not a cosmetic treatment.

“The FDA recommends against using dermal fillers or any injectable filler for body contouring and enhancement”

Source: FDA: Dermal fillers (soft tissue fillers), read

Whole-body CT screening

Regulator
U.S. Food and Drug Administration

The FDA says it knows of no scientific evidence that whole-body CT scanning of people without symptoms provides more benefit than harm, that whole-body CT screening has not been shown to meet accepted criteria for an effective screening procedure, and that medical professional societies have not endorsed it for people without symptoms.

“knows of no scientific evidence demonstrating that whole-body scanning of individuals without symptoms provides more benefit than harm to people being screened”

Source: FDA: Full-body CT scans, what you need to know, read

Mammography facility certification

Regulator
U.S. Food and Drug Administration
Law named on the page
42 U.S.C. 263b; 21 CFR 900.12

Under the Mammography Quality Standards Act, every mammography facility outside the Department of Veterans Affairs must be accredited by an approved accreditation body, be certified as providing quality mammography services, have a yearly survey by a medical physicist and a yearly inspection, and meet federal quality standards for personnel, equipment, radiation dose and recordkeeping.

“Be MQSA certified as providing quality mammography services.”

Source: FDA: Mammography Quality Standards Act (MQSA) and MQSA program, read

Robotically assisted surgery claims

Regulator
U.S. Food and Drug Administration

The FDA has cleared robotically assisted surgical devices for use by trained physicians in laparoscopic procedures in general, cardiac, colorectal, gynecologic, head and neck, thoracic and urologic surgery, but has not granted marketing authorization for any such system specifically for the prevention or treatment of cancer. The FDA does not supervise or accredit physician training on the devices and says hospitals should make sure surgeons are trained and credentialed.

“The FDA has cleared RAS devices for use by trained physicians in an operating room environment for laparoscopic surgical procedures in general surgery, cardiac, colorectal, gynecologic, head and neck, thoracic and urologic surgical procedures.”

Source: FDA: Computer-assisted surgical systems, read

Donated eggs and sperm

Regulator
U.S. Food and Drug Administration
Law named on the page
Title 21 Code of Federal Regulations (CFR) Part 1271

The FDA regulates donated eggs and sperm as human cells, tissues, and cellular and tissue-based products. An establishment that recovers, processes, stores, labels, packages or distributes them must register with the FDA and list its products under 21 CFR Part 1271, and donors must be screened and tested for the communicable diseases the regulations name.

“Donated reproductive tissue (eggs or sperm) are regulated as human cells, tissues, and cellular and tissue-based products (HCT/Ps).”

Source: FDA: What you should know about reproductive tissue donation, read

Fertility clinic success rates

Regulator
Centers for Disease Control and Prevention
Law named on the page
Fertility Clinic Success Rate and Certification Act of 1992

The Fertility Clinic Success Rate and Certification Act of 1992 requires clinics that perform assisted reproductive technology to report data on those procedures to the CDC every year, and the CDC publishes clinic-specific success rates after checking the data with yearly audits and site visits.

“The Fertility Clinic Success Rate and Certification Act of 1992 mandates that clinics performing ART annually provide data to CDC for ART procedures they perform.”

Source: CDC: National ART Surveillance System, read

What limits how referrals and physicians are paid?

This group matters to recruiters as much as to marketers. The kickback and self-referral laws shape signing bonuses, directorships, income guarantees and any payment that travels with patients; Open Payments makes industry money public; the FTC has warned healthcare employers about noncompete agreements; and two federal programs, the Conrad visa waiver and NHSC loan repayment, are recruiting tools for shortage areas.

The Anti-Kickback Statute and the Stark law

Regulator
U.S. Department of Health and Human Services, Office of Inspector General
Law named on the page
42 U.S.C. § 1320a-7b(b); 42 U.S.C. § 1395nn

The federal Anti-Kickback Statute makes it a crime to knowingly and willfully pay anything of value to induce or reward referrals of items or services paid by Medicare, Medicaid or other federal health care programs, and paying others to refer patients is as illegal as being paid. HHS-OIG notes that a practice may not advertise that it will forgive copayments. The Stark law separately bars a physician from referring Medicare and Medicaid patients for designated health services to an entity they have a financial relationship with, unless an exception applies.

“prohibits the knowing and willful payment of "remuneration" to induce or reward patient referrals”

Source: HHS-OIG: A roadmap for new physicians, fraud and abuse laws, read

The physician self-referral law (Stark)

Regulator
Centers for Medicare and Medicaid Services
Law named on the page
Section 1877 of the Social Security Act; 42 U.S.C. 1395nn

The physician self-referral law, often called the Stark law, bars a physician from referring patients for designated health services payable by Medicare to an entity the physician or an immediate family member has a financial relationship with, unless an exception's requirements are met, and bars the entity from billing for services referred in breach of it. A financial relationship includes a compensation arrangement as well as an ownership or investment interest, so the way a hospital or group pays a physician must fit an exception. Designated health services include clinical laboratory, imaging and radiation therapy, physical and occupational therapy, home health, outpatient prescription drugs, and inpatient and outpatient hospital services.

“Prohibits a physician from making referrals for certain designated health services payable by Medicare to an entity with which he or she (or an immediate family member) has a financial relationship, unless the requirements of an applicable exception are satisfied”

Source: CMS: Physician Self-Referral, read

Gifts and offers to Medicare and Medicaid patients

Regulator
U.S. Department of Health and Human Services, Office of Inspector General
Law named on the page
42 U.S.C. § 1320a-7a(a)(5)

The federal beneficiary inducement statute imposes civil monetary penalties on physicians who offer anything of value to Medicare and Medicaid beneficiaries to influence them to use their services, and the kickback prohibition applies to all sources of referrals, patients included.

“imposes civil monetary penalties on physicians who offer remuneration to Medicare and Medicaid beneficiaries to influence them to use their services”

Source: HHS-OIG: A roadmap for new physicians, fraud and abuse laws, read

Open Payments

Regulator
Centers for Medicare and Medicaid Services

Open Payments is a national disclosure program: drug and medical device companies report the payments and other transfers of value they make to physicians and other covered recipients, and CMS publishes them in a public database each year on or by June 30. Physicians can register to review the records attributed to them and dispute them before publication.

“The Open Payments program is a national disclosure program that promotes a more transparent and accountable health care system.”

Source: CMS: Open Payments, read

Noncompete agreements in health care

Regulator
Federal Trade Commission

In September 2025 the FTC's chairman sent warning letters to healthcare employers and staffing companies, saying many may include unreasonable noncompete agreements in contracts for nurses, physicians and other medical professionals, and urging them to review those agreements. The letters followed the Commission's vote to withdraw its defense of the nationwide noncompete ban, which the courts had blocked; the FTC says it can investigate noncompetes that are unjustified, overbroad or otherwise anticompetitive under Section 5 of the FTC Act.

“Many healthcare employers and staffing companies may include unreasonable noncompete agreements in employment contracts for vital roles like nurses, physicians, and other medical professionals.”

Source: FTC: Chairman Ferguson issues noncompete warning letters to healthcare employers and staffing companies, read

The Conrad 30 visa waiver for physicians

Regulator
U.S. Citizenship and Immigration Services
Law named on the page
section 214(l) of the Immigration Nationality Act

The Conrad 30 program lets a physician who trained in the United States on a J-1 exchange visa apply for a waiver of the two-year foreign residence requirement. A state health department must sponsor the application, and the physician must sign a full-time contract to practice in H-1B status for at least three years at a facility in, or serving patients from, an area HHS designates as a Health Professional Shortage Area, Medically Underserved Area or Medically Underserved Population. Each state sets its own application rules. USCIS's page says that unless Congress extends the provision, physicians admitted in or acquiring J-1 status on or after October 1, 2025 are not eligible; those who held J-1 status by September 30, 2025 still are.

“allows J-1 foreign medical graduates (FMGs) to apply for a waiver of the 2-year foreign residence requirement upon completion of the J-1 exchange visitor program”

Source: USCIS: Conrad 30 Waiver Program, read

National Health Service Corps loan repayment

Regulator
U.S. Department of Health and Human Services, Health Resources and Services Administration

The National Health Service Corps Loan Repayment Program repays the educational loans of licensed clinicians in eligible disciplines who serve at least two years at an NHSC-approved site in a Health Professional Shortage Area. The physician disciplines it lists for primary care are family medicine, general internal medicine, general pediatrics and geriatrics, and for maternity care obstetrics and gynecology and family physicians who practice obstetrics; physicians in behavioral health may qualify in a mental health shortage area. A full-time two-year term pays up to $75,000 for primary care providers and up to $50,000 for other eligible providers, free of federal income and employment taxes. HRSA had closed the 2026 application cycle when the page was read.

“In exchange, you must serve at least two years at an NHSC-approved site within a HPSA.”

Source: HRSA: NHSC Loan Repayment Program, read

What do the rules on prices, bills and emergency care require?

A practice that advertises a price, a membership or a cash option runs into the rules on surprise bills, estimates for self-pay patients, Medicare billing and emergency screening. They decide what an ad can promise about cost and access.

The No Surprises Act

Regulator
Centers for Medicare and Medicaid Services
Law named on the page
No Surprises Act

The No Surprises Act, in effect since January 1, 2022, protects people with most kinds of health insurance from unexpected out-of-network bills for emergency room visits, for non-emergency care related to a visit to an in-network hospital, hospital outpatient department or ambulatory surgical center, and for air ambulance services.

“The No Surprises Act is a federal law that went into effect on January 1, 2022.”

Source: CMS: Your rights and protections against surprise medical bills, read

Good faith estimates for self-pay patients

Regulator
Centers for Medicare and Medicaid Services
Law named on the page
No Surprises Act

Providers usually must give a patient who does not have or does not use health insurance a good faith estimate of what their care will cost, when the care is scheduled at least three business days ahead or when the patient asks for one, and the patient may be able to dispute a bill that comes in at least $400 above the estimate.

“if you request one or schedule services at least 3 business days in advance”

Source: CMS: Your rights and protections against surprise medical bills, read

Concierge and access fees for Medicare patients

Regulator
U.S. Department of Health and Human Services, Office of Inspector General

HHS-OIG tells physicians that, whether or not they participate in Medicare, they may not ask Medicare patients to pay a second time for services Medicare has already paid for. Charging for services Medicare does not cover is legal, but an access or administrative fee that simply lets patients obtain Medicare-covered services from the practice is double billing.

“you may not ask Medicare patients to pay a second time for services for which Medicare has already paid”

Source: HHS-OIG: Physician relationships with payers, read

Opting out of Medicare

Regulator
Centers for Medicare and Medicaid Services

Physicians and practitioners who see Medicare patients but do not want to enroll in Medicare must opt out: they file an affidavit, sign a private contract with each Medicare patient, who then pays out of pocket, and may not opt out for some patients or services but not others. Opt-out status renews automatically every two years. Chiropractors and physical therapists are among the practitioners who may not opt out.

“Physicians and practitioners who see Medicare patients but don't want to enroll in the Medicare program must opt-out of Medicare.”

Source: CMS: Manage your enrollment (opt out of Medicare), read

EMTALA

Regulator
Centers for Medicare and Medicaid Services
Law named on the page
Section 1867 of the Social Security Act

The Emergency Medical Treatment and Labor Act requires Medicare-participating hospitals that offer emergency services to provide a medical screening examination to anyone who asks for examination or treatment of an emergency medical condition, including active labor, regardless of ability to pay.

“to ensure public access to emergency services regardless of ability to pay”

Source: CMS: Emergency Medical Treatment and Labor Act (EMTALA), read

What do accessibility and telehealth rules require?

A practice website is a public accommodation as well as an ad, and a telehealth offer is a prescribing arrangement as well as a convenience. Two agencies have set accessibility expectations for websites and apps, and the controlled substance rules decide what a remote visit can include.

Website accessibility under Section 504

Regulator
U.S. Department of Health and Human Services, Office for Civil Rights
Law named on the page
Section 504 of the Rehabilitation Act

HHS's Section 504 rule requires doctors and other providers that receive federal financial assistance from HHS, which its fact sheet says includes Medicare and Medicaid funds, to make their web content and mobile apps conform to WCAG 2.1 Level AA: by May 11, 2026 for recipients with fifteen or more employees, and by May 10, 2027 for those with fewer.

“That standard is WCAG 2.1 Level AA.”

Source: HHS: New requirements on the accessibility of web content, mobile apps and kiosks (fact sheet), read

Website accessibility under the ADA

Regulator
U.S. Department of Justice, Civil Rights Division
Law named on the page
Title II of the ADA

The Justice Department's guidance says Title III of the Americans with Disabilities Act covers businesses open to the public, medical offices among them, and that its requirements apply to what they offer on the web. Businesses have flexibility in how they comply, and the Web Content Accessibility Guidelines are a helpful technical standard.

“Hospitals and medical offices;”

Source: U.S. Department of Justice: Guidance on web accessibility and the ADA, read

Prescribing controlled substances by telehealth

Regulator
U.S. Department of Health and Human Services

The Drug Enforcement Administration, jointly with HHS, has extended through December 31, 2026 the telemedicine flexibilities for prescribing controlled medications that were in place during the COVID-19 public health emergency: a DEA-registered practitioner can prescribe a schedule II to V controlled substance by telemedicine without an in-person evaluation if the required conditions are met.

“through December 31, 2026”

Source: HHS telehealth.hhs.gov: Prescribing controlled substances via telehealth, read

What do professional ethics codes add?

Some professions hold their members to more than federal law requires. These provisions are a professional body's own guidance, not law, and they bind members of that body; we list them because they change what those practices may advertise.

The AMA's ethics opinion on retainer practices

Whose code
American Medical Association, Code of Medical Ethics (professional guidance, not law)

The AMA Code of Medical Ethics says physicians may contract with patients for special non-medical services and amenities paid out of pocket, but should present the terms clearly, including what they mean for the patient's insurance, take care not to imply that more or better medical services come with the contract, give every patient the same quality of medical care, and help patients who decline the arrangement transfer their care.

“Physicians are free to enter into contracts to provide special non-medical services and amenities with individual patients”

Source: AMA Code of Medical Ethics: Retainer practices, read

Testimonials in the psychologists' ethics code

Whose code
American Psychological Association, Ethical Principles of Psychologists and Code of Conduct (professional guidance, not law)

The APA Ethics Code says psychologists do not solicit testimonials from current therapy clients, or from others who because of their circumstances are vulnerable to undue influence (Standard 5.05), and do not engage in uninvited in-person solicitation of business from actual or potential therapy clients (Standard 5.06).

“Psychologists do not solicit testimonials from current therapy clients/patients or other persons who because of their particular circumstances are vulnerable to undue influence.”

Source: American Psychological Association: Ethical Principles of Psychologists and Code of Conduct, read

Announcing a dental specialty

Whose code
American Dental Association, Principles of Ethics and Code of Professional Conduct (professional guidance, not law)

The ADA Code says a dentist may announce as a specialist only in a specialty recognized by the National Commission on Recognition of Dental Specialties and Certifying Boards, after an accredited advanced program or as a diplomate of a recognized certifying board, and that a general dentist who announces services must avoid implying specialization and state that a general dentist provides them. It also warns that fellowships which mark membership rather than attainment can mislead the public in advertising.

“A dentist may ethically announce as a specialist to the public in any of the dental specialties recognized by the National Commission on Recognition of Dental Specialties and Certifying Boards”

Source: American Dental Association: Principles of Ethics and Code of Professional Conduct, Veracity, read

Questions about the federal rules.

Is there one federal law on physician advertising?

No. Advertising by physicians is regulated mainly by each state's medical board, and federal law reaches it through separate statutes: privacy, endorsements and reviews, telemarketing, health claims and referral payments. This page gathers those federal pieces; the state medical board index covers the states.

Which federal rules apply to recruiting a physician?

The kickback and self-referral laws govern how a hospital or group may pay a physician it recruits, the FTC's warning letters concern noncompete agreements, and the Conrad waiver and NHSC loan repayment programs help shortage areas hire. The recruiting guides apply them specialty by specialty.

How current are these rules?

Each one shows the day we read the regulator's page, and we read each page again on a schedule. Federal guidance changes, sometimes quickly, so follow the source link before relying on a summary.

Sources

Each rule was read on the regulator’s own page, or for an ethics code on the professional body’s site, on the date shown. The page was last checked on .

  1. HHS: Marketing, HIPAA Privacy Rule guidance read
  2. HHS: Use of online tracking technologies by HIPAA covered entities and business associates read
  3. HHS: Business associates, HIPAA guidance read
  4. HHS: Uses and disclosures for treatment, payment and health care operations read
  5. HHS: Personal representatives, HIPAA guidance read
  6. HHS: Does HIPAA provide extra protections for mental health information compared with other health information? read
  7. HHS: Understanding confidentiality of substance use disorder patient records (Part 2) read
  8. FTC: Final approval of order banning BetterHelp from sharing sensitive health data for advertising read
  9. FTC: FTC's Endorsement Guides, what people are asking read
  10. FTC: The Consumer Reviews and Testimonials Rule, questions and answers read
  11. FTC: Soliciting and paying for online reviews, a guide for marketers read
  12. FTC: Consumer Review Fairness Act, what businesses need to know read
  13. HHS: Agreement with a New Jersey provider that disclosed patient information in response to negative online reviews read
  14. HHS: Guidance regarding methods for de-identification of protected health information read
  15. FCC: Stop unwanted robocalls and texts read
  16. FTC: CAN-SPAM Act, a compliance guide for business read
  17. FCC: Rules for junk faxes read
  18. FTC: Health Products Compliance Guidance read
  19. FTC: Gut Check, a reference guide for media on spotting false weight loss claims read
  20. FTC: Complying with the Eyeglass Rule read
  21. FDA: Is it really "FDA approved"? read
  22. FDA: Important patient and consumer information about regenerative medicine therapies read
  23. FDA: FDA's concerns with unapproved GLP-1 drugs used for weight loss read
  24. FDA: OTC hearing aids, what you should know read
  25. FDA: Dermal fillers (soft tissue fillers) read
  26. FDA: Full-body CT scans, what you need to know read
  27. FDA: Mammography Quality Standards Act (MQSA) and MQSA program read
  28. FDA: Computer-assisted surgical systems read
  29. FDA: What you should know about reproductive tissue donation read
  30. CDC: National ART Surveillance System read
  31. HHS-OIG: A roadmap for new physicians, fraud and abuse laws read
  32. CMS: Physician Self-Referral read
  33. CMS: Open Payments read
  34. FTC: Chairman Ferguson issues noncompete warning letters to healthcare employers and staffing companies read
  35. USCIS: Conrad 30 Waiver Program read
  36. HRSA: NHSC Loan Repayment Program read
  37. CMS: Your rights and protections against surprise medical bills read
  38. HHS-OIG: Physician relationships with payers read
  39. CMS: Manage your enrollment (opt out of Medicare) read
  40. CMS: Emergency Medical Treatment and Labor Act (EMTALA) read
  41. HHS: New requirements on the accessibility of web content, mobile apps and kiosks (fact sheet) read
  42. U.S. Department of Justice: Guidance on web accessibility and the ADA read
  43. HHS telehealth.hhs.gov: Prescribing controlled substances via telehealth read
  44. AMA Code of Medical Ethics: Retainer practices read
  45. American Psychological Association: Ethical Principles of Psychologists and Code of Conduct read
  46. American Dental Association: Principles of Ethics and Code of Professional Conduct, Veracity read