HIPAA-compliant medical marketing

What needs a patient's authorization

HHS defines marketing as a communication about a product or service that encourages people to buy or use it, and the Privacy Rule's limits attach to the patient information a campaign uses. So compliance in healthcare marketing is decided campaign by campaign: the same campaign can need nothing from HIPAA or every patient's signature, depending on what it draws on.

Two things need no authorization even when they are marketing: a face-to-face conversation with the patient, and a promotional gift of nominal value.

When HIPAA applies to a marketing vendor

The HIPAA Rules apply to covered entities and business associates. A vendor becomes a business associate when it performs covered work involving protected health information for a covered entity. A business associate agreement safeguards that relationship; each use of the data still needs its own basis under the Privacy Rule.

A marketing company that never receives protected health information is not a business associate, so calling it “HIPAA compliant” describes nothing about it. One that receives PHI needs the agreement, the least data the work requires, and the controls around that data.

The Google reviews workflow separates neutral requests, public replies, and private escalation. Selected HIPAA violation cases show the controls HHS reported as failing.

Tracking tags, forms and ad platforms

HHS's online tracking guidance sorts pages by what a tag can see. On a patient portal or any page behind a login, a tag generally has access to protected health information. On many public pages it does not, and HIPAA then does not regulate it. The exceptions are pages where a visitor gives health or identifying information without logging in: an appointment form or a symptom checker, where a tag can capture an email address or the reason for the visit, and the portal's login and registration pages, which may be the homepage, where it can capture the name and email the patient enters. A June 20, 2024 federal court order vacated the part of the guidance that treated an IP address plus a visit to a public page about a condition or a provider as enough to trigger HIPAA.

Where a tag does reach PHI, a line in the privacy policy does not permit the disclosure, a cookie banner is not an authorization, and a vendor's promise to remove or de-identify the PHI after receiving it does not repair the transfer. The vendor needs a business associate agreement and the disclosure a Privacy Rule permission, or each patient's authorization. When an analytics or ad platform will not sign an agreement, HHS describes another route: a vendor that will, such as a customer data platform, de-identifies the data, stripping identifiers such as email addresses, IP addresses and device IDs, and passes on only de-identified information.

Privacy duties can also arise outside HIPAA. The FTC Health Breach Notification Rule and state laws such as Washington's My Health My Data Act may apply to other organizations and health information. The practice's privacy officer or counsel determines which apply.

Testimonials and before-and-after photos

Before publishing a patient story, record what will be disclosed, where it will appear, how long the permission lasts, and who approved it under the practice's policy and applicable law. Secure permission for that marketing use rather than relying on general treatment consent, a social media post, or a positive review.

HIPAA defines de-identification through specific methods. HHS recognizes the Expert Determination and Safe Harbor methods under the Privacy Rule. If a case description, image, date, or unusual fact can still identify the person, a casual “anonymous case study” label does not settle the question.

Replies to online reviews

A reviewer's disclosure covers the reviewer's speech. The practice needs its own basis to confirm the relationship, correct the medical record in public, or add facts. HHS has resolved enforcement matters involving providers that disclosed PHI while responding to negative online reviews, including New Vision Dental and Manasa Health Center. The safe operational pattern is a neutral public response followed by an approved private escalation path; the public response leaves patient status unconfirmed.

Before a form, tag or vendor goes live

1. Write down the page, user action, fields, events, and destinations.
2. Remove health-detail fields from ordinary marketing forms unless the approved workflow truly needs them.
3. Separate patient communication from acquisition measurement where possible.
4. Identify every vendor and subprocessor that can receive the data, including email and logs.
5. Have the practice's privacy officer decide permissions, agreements, notices, and retention for the real configuration.
6. Test the rendered page and network behavior before launch; recheck after tag, form, or vendor changes.

Once the practice has approved that boundary, its healthcare SEO agency can build the public pages and the measurement inside the approved legal determination.