Most dental office managers know the HIPAA basics for the chart and the front desk. Marketing is where newer exposures appear: the web form, the review reply, the before-and-after post, the tracking code an agency added to the website. This explainer covers HIPAA compliance for dental offices on that marketing and website side, with the required basics linked to HHS. "Hipaa compliance for dental offices" gets about 210 US searches a month at about $23.08 a click (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
In short: HIPAA follows patient information wherever marketing touches it: web forms, email alerts, review replies, social posts, patient photos and tracking code. Get a signed authorization before using any patient's image or story, never confirm someone is a patient in public, keep tracking pixels off appointment pages, and sign a BAA with every vendor that handles patient data.
Where HIPAA meets marketing in a dental office
The HIPAA Privacy Rule requires a patient's written authorization before their information is used for marketing, with limited exceptions (HHS marketing guidance (opens in a new tab)). Messages to your own patients about your own services or their treatment, such as recall and appointment reminders, fall outside the definition of marketing unless a third party pays you to send them (45 CFR 164.501 (opens in a new tab)).
The exposure points in a typical dental office are:
| Where | What can go wrong |
|---|---|
| Website forms and chat | Requests stored or emailed without safeguards |
| Review replies | Confirming a patient relationship or treatment details |
| Social media | Patient photos or tags without authorization |
| Website tracking | Pixels sending appointment-page data to ad platforms |
| Vendors | Patient data handled without a BAA |
Our guide to HIPAA marketing rules covers these across specialties. This page is part of our dental marketing hub.
Website forms, email notifications and the inbox
A new-patient request that says "cracked molar, need a crown" is protected health information (PHI) the moment it reaches you. Three safeguards matter:
- Store submissions in a protected system, under a BAA with that vendor, not in a general email account.
- Send alerts without contents. A notification that says "New request received" with a link to the secure inbox keeps details out of phones and shared mailboxes.
- Limit access to staff who follow up on requests, each with their own login.
Email is not banned. HHS says the Privacy Rule lets providers communicate electronically with patients "provided they apply reasonable safeguards," and that patients may ask to be contacted another way (HHS FAQ (opens in a new tab)). For how a CRM fits in, see our guide to dental CRM and patient data.
Tracking pixels and analytics on your website
HHS guidance says tracking technologies on pages where people request appointments can collect PHI, such as an email address or the reason for seeking care, and that sharing it with a tracking vendor is then subject to HIPAA (HHS tracking guidance (opens in a new tab)).
On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated part of that guidance in American Hospital Association v. Becerra: the part saying HIPAA is triggered when a technology connects a visitor's IP address with a visit to a public page about specific health conditions or providers. As of October 2026, HHS's page says it "is evaluating its next steps." The rest of the guidance, including tracking on forms and patient portals, remains on HHS's site. Keep ad pixels off request forms, portal logins and confirmation pages; see tracking pixels and HIPAA.
Vendors that need a BAA, and ones that don't
A vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate and needs a BAA (HHS business associate guidance (opens in a new tab)).
| Usually needs a BAA | Usually doesn't |
|---|---|
| Website or form host storing submissions | Janitorial or maintenance services with only incidental access |
| CRM, patient inbox or chat widget | The US Postal Service and other pure conduits that only transmit |
| Cloud storage and IT support with access to PHI | A specialist you refer a patient to for treatment |
| Review-request or messaging software given patient lists | A dental plan you submit claims to |
HHS limits the conduit exception to services that only transmit PHI; anyone who accesses it regularly is not a conduit.
Where Medfy fits
Medfy builds HIPAA-compliant website forms and stores patient information in separate, encrypted HIPAA databases in the US or Canada. It signs a BAA with each practice before any patient data flows, and ad platforms never receive patient data. See how Medfy handles patient data.
Risk analysis and staff training basics
The Security Rule requires a risk analysis: "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of electronic PHI (HHS risk analysis guidance (opens in a new tab)). Include marketing systems in it: the website and forms, CRM, email, chat, ad accounts and anyone who replies to reviews. The Security Risk Assessment Tool (opens in a new tab) from ONC and OCR is built for small and medium providers.
Train the front desk on three things: review replies, photo authorizations and what never goes in an email. The ADA's HIPAA resources (opens in a new tab) add member materials and guidance on consent for calls and texts. Our HIPAA compliance checklist covers the rest, and a free marketing audit flags privacy risks such as pixels on patient forms.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor, and have your privacy officer or counsel lead the practice's own risk analysis.
Frequently asked questions
Does a dental office website have to be HIPAA compliant?
HIPAA applies to the parts of your website that collect or reveal patient information: appointment request forms, chat, patient portals and any tracking code on those pages. Those parts must be protected, and every vendor that stores or handles what patients submit needs a signed BAA. Pages that only describe your services and hours don't hold PHI, but tracking code on them still needs a look.
Can a dental office text or email patients?
Yes. HHS says providers may communicate electronically with patients if they apply reasonable safeguards, such as checking the address or number before sending. Patients can ask for a different channel and you should accommodate reasonable requests. Appointment and treatment reminders are not marketing under HIPAA, but promotional texts and calls raise separate consent rules, so check the ADA's guidance on calls and texts.
Can a dentist post patient photos on social media?
Only with a signed HIPAA authorization that names the marketing use. The authorization must describe the photos, who will use them and for what purpose, include an expiration date or event, and be signed and dated by the patient. Full-face photographs are one of HIPAA's 18 identifiers, and tagging a patient or naming them in a caption is a disclosure too.
What are the most common HIPAA violations in dental offices?
On the marketing side, OCR's dental cases point to review replies that reveal patient names, treatment, insurance or costs: Elite Dental Associates in 2019, and New Vision Dental and a North Carolina practice in 2022. Other risks worth checking are patient photos posted without authorization, form submissions sent in plain email, tracking pixels on appointment pages and vendors handling patient data without a BAA.