HIPAA marketing rules: when you need patient authorization

What HIPAA calls marketing (and what it doesn't)

The Privacy Rule's definition in 45 CFR 164.501 (opens in a new tab) is short: marketing means "to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service."

Then come the carve-outs. A communication is not marketing when it is:

• A refill reminder or other message about a drug or biologic currently prescribed for the patient, as long as any payment the practice receives for sending it is "reasonably related to the covered entity's cost of making the communication."
• About the patient's treatment, including care coordination or recommending alternative treatments, therapies, providers or settings of care.
• A description of a health-related product or service the practice itself provides, such as a new location, a new service line or a new clinician joining.
• Case management or care coordination, including telling patients about treatment alternatives.

The treatment and operations carve-outs disappear when the practice "receives financial remuneration in exchange for making the communication." The rule defines that as direct or indirect payment "from or on behalf of a third party whose product or service is being described." A device maker paying your practice to email patients about its device turns an ordinary update into marketing.

HHS also explained in the 2013 Omnibus Final Rule (opens in a new tab) that communications "promoting health in general" that don't promote a particular provider's product or service, such as a reminder to get an annual mammogram, are not marketing.

Marketing that needs no patient data at all

Most of what a practice spends on marketing never touches PHI:

• Google Search ads bidding on "pediatric dentist near me"
• Facebook or Instagram ads shown to adults within 10 miles of the office
• Service pages, blog articles and location pages on your website
• Your Google Business Profile, directory listings and local SEO
• Print, radio, billboards and community sponsorships

None of these uses a patient's information, so the authorization rule has nothing to attach to. That's the distinction many vendor pages blur: HIPAA doesn't stop a practice from advertising. It stops a practice from using patient information to advertise without permission.

The risk starts when PHI enters the picture: patient lists, form submissions, testimonials, retargeting audiences built from site visits, and tracking pixels that fire on pages where people type health details. If you're unsure whether a piece of data qualifies, start with what counts as PHI. Ads that use no PHI still have to follow healthcare advertising rules set by Google, Meta, the FTC and your licensing board.

Want to see where your own site stands? A free marketing audit scores your website, SEO, local listing, AI visibility, social and ads, and its ads check flags privacy risks such as pixels on patient forms.

When patient authorization is required

Under 45 CFR 164.508(a)(3) (opens in a new tab), a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing." Two exceptions apply: a face-to-face communication, and "a promotional gift of nominal value." When a third party pays, "the authorization must state that such remuneration is involved."

A valid authorization has required elements and statements, and it can't be a condition of treatment. The authorization guide listed in the channel table below walks through each line. For reviews and testimonials, the FTC's Endorsement Guides (16 CFR Part 255) (opens in a new tab) add their own requirements, covered in our patient testimonial rules.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

The channels where practices slip: pixels, ads, email, social, reviews

Search volumes show what practice teams worry about most. Monthly US searches: "social media hipaa violation" 320, "hipaa compliant authorization form" 210, "meta pixel lawsuit" 110, "hipaa marketing" 90 and "hipaa marketing rules" 70 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).

Tracking is the channel with the most legal movement. In June 2024, a federal court in Texas vacated one part of HHS's online tracking guidance, the part treating an IP address plus a visit to a public health-condition page as protected information (American Hospital Association v. Becerra (opens in a new tab), N.D. Tex., June 20, 2024). The court said the rest of the guidance remains operable. The pixels guide explains what that leaves in place.

State law can be stricter than HIPAA. Washington's My Health My Data Act (opens in a new tab), for example, regulates "consumer health data" held by businesses that HIPAA doesn't cover. Check your own state's health-privacy and consumer-privacy laws as well as HIPAA.

What your marketing vendors must agree to (BAAs)

A vendor becomes your business associate when it creates, receives, maintains or transmits PHI on your behalf, a definition in 45 CFR 160.103 (opens in a new tab) that explicitly includes consulting, management and administrative services. Before PHI flows, 45 CFR 164.502(e) (opens in a new tab) requires "satisfactory assurance" that the vendor will safeguard it. In practice, that assurance is a business associate agreement (BAA).

Ad platforms are the hard stop. Google states that it "does not offer Business Associate Agreements" for Google Analytics (opens in a new tab). Meta's Business Tools Terms (opens in a new tab) go further: advertisers must not send data that "includes or is based on, directly or otherwise, health information." The safe design is one where these tools never receive PHI. Our guide to business associate agreements covers what the contract must say.

A safe default setup for a practice website and ads

1. Inventory every tag. List each script on the site, including anything loaded through Google Tag Manager.
2. Fence off PHI pages. No ad pixels or third-party analytics on intake forms, booking flows, portals or thank-you pages that name a condition.
3. Use BAA-covered forms. Contact and appointment-request forms should submit to a system that signs a BAA and encrypts the data.
4. Count conversions as generic events. "Form submitted" or "call clicked," with no service, symptom or name attached.
5. Target by place and search intent. Keywords and geography, not patient lists or condition-page retargeting.
6. Get authorization before patient content. Testimonials, photos and stories need a signed form first.
7. Write it down. Keep a dated record of what you reviewed and changed; the Privacy Rule expects documented policies.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

How Medfy keeps patient data out of marketing tools

Medfy is AI marketing for independent medical practices in the US and Canada, built HIPAA-compliant by design. The website forms it builds are HIPAA-compliant: submissions go to an access-controlled patient CRM and inbox, and patient information is stored in separate, encrypted HIPAA databases in the US or Canada, encrypted in transit and at rest. Medfy signs a Business Associate Agreement (BAA) with every practice before any patient data flows.

Marketing reports use aggregate numbers only, and ad platforms never receive patient data. Role-based permissions and an audit log record who saw what. Read how Medfy handles patient data, or see Medfy pricing for the base plan and the Google Ads and Meta ads add-ons.

Frequently asked questions

Does HIPAA apply to marketing a medical practice?

Yes, whenever the marketing uses or discloses protected health information. A covered practice needs a patient's written authorization to use PHI for marketing, with narrow exceptions such as face-to-face conversations and promotional gifts of nominal value. Search ads, public social ads and website content that use no patient data don't trigger the rule, though platform and FTC rules still apply. Confirm your setup with your compliance officer or attorney.

Can a practice use patient testimonials in ads?

Yes, with a signed HIPAA authorization that describes the content, where it will appear and when the permission ends. A quote, photo, first name or story that identifies the patient is PHI. The FTC Endorsement Guides apply separately: if the patient's result isn't what others can generally expect, the ad must say what they can expect. Have your attorney review the authorization form before you use it.

Is it a HIPAA violation to email patients about new services?

Usually not, if the service is your own. The Privacy Rule's marketing definition excludes communications describing a health-related service the practice itself provides, unless a third party pays you to send them. Promoting another company's product, or being paid by a manufacturer to promote its device, needs written authorization. CAN-SPAM opt-out rules still apply to promotional email. Check the specifics with your compliance officer or attorney.

Do marketing agencies need to sign a BAA?

Only if they create, receive, maintain or transmit PHI for your practice, for example by hosting intake forms, managing your patient CRM, reading form submissions or handling patient lists. An agency that only runs public search ads and edits website copy, without touching patient data, may not be a business associate. When in doubt, ask for a BAA and limit what the agency can open. Confirm with your compliance officer or attorney.

Can I upload my patient list to Facebook or Google for ads?

Treat it as off-limits. A list of your patients is PHI, so uploading it is a disclosure for marketing that needs each patient's written authorization. The platforms restrict it too: Meta's Customer List Custom Audiences Terms bar audiences based on health information, and Google doesn't support Customer Match when an ad promotes health products or services. Confirm any exception with your compliance officer or attorney.