HIPAA compliant marketing means promoting a healthcare organization without using or disclosing protected health information (PHI) for marketing unless the patient has signed a valid authorization. HHS explains that, with limited exceptions, the Privacy Rule requires written authorization before PHI is used or disclosed for marketing. In practice, that shapes your email lists, retargeting, tracking pixels, testimonials and any vendor that touches patient data.
This guide is for practice owners, healthcare marketing directors and the agencies that support them. It covers what HIPAA counts as marketing, where the exceptions sit, how to handle email and digital ads, and how to review a campaign before it goes live. It is general information, not legal advice. Your compliance officer or healthcare counsel should sign off on anything that touches PHI.
TL;DR
- HIPAA treats a communication as marketing when it encourages people to buy or use a product or service. Using PHI for marketing generally needs the patient’s written authorization.
- Three carve-outs exist: describing your own health-related services, communications for treatment, and care coordination or recommending alternative treatments or providers. Face-to-face communication and nominal-value gifts are also exempt from authorization.
- Tracking pixels, retargeting and email platforms are risky when PHI flows to a vendor. A cookie banner does not count as a HIPAA authorization.
- Patient stories, photos and reviews responses are a common enforcement trigger. Get a valid authorization first.
- Review every campaign with the same checklist: is it marketing, does an exception apply, is PHI involved, and who receives the data.
Table of Contents
- What HIPAA counts as marketing
- When you need authorization, and when you do not
- HIPAA compliant email marketing
- Ads, pixels and retargeting
- Testimonials, photos and social media
- How to review a campaign before launch
- Magic Logix perspective
- Building a compliant program around search and content
- Work with Magic Logix on your marketing program
- FAQ
- Sources
What HIPAA counts as marketing
The starting point is the definition. HHS says the Privacy Rule defines marketing as a communication about a product or service that encourages recipients to purchase or use it. The definition also covers an arrangement where a covered entity discloses PHI to another entity, in exchange for direct or indirect payment, so that entity can promote its own product or service.
That second part matters for anyone who works with outside advertisers. HHS describes it as having no exceptions: a covered entity may not sell PHI to a third party for that party’s own purposes.
Who the rules apply to
HIPAA’s marketing rules apply to covered entities, such as providers and health plans, and to the business associates acting for them. A general business that has no patient data is not covered. But if you are an agency, a software vendor or a freelancer working with a healthcare client and you handle their PHI, you are in scope through your contract.
What counts as PHI in a marketing context
PHI is individually identifiable health information. A name tied to a diagnosis, a patient photo from a clinic, an email address on a patient list or an appointment record all qualify when they relate to someone’s care. A list of people who subscribed to a general wellness newsletter may not be PHI. A list of people who are patients of a specific oncology clinic is.
When you need authorization, and when you do not
The default is simple. Under 45 CFR 164.508, a covered entity must get authorization for any use or disclosure of PHI for marketing, except face-to-face communications to the individual and promotional gifts of nominal value. If a third party pays the covered entity for the communication, the authorization has to say so.
The three carve-outs from the marketing definition
HHS lists three categories that are not marketing in the first place:
- Communications describing your own health-related products or services, including certain communications about provider or plan networks and plan replacements or enhancements.
- Communications made for the treatment of the individual.
- Communications for case management or care coordination, or to direct or recommend alternative treatments, providers or care settings.
HHS adds that for each exception the activity must still be otherwise permissible under the Privacy Rule. Being exempt from the marketing definition does not mean anything goes.
Telling marketing apart from treatment and operations
HHS acknowledges that some overlap among treatment, health care operations and marketing is unavoidable, and that you have to apply the Privacy Rule’s specific definitions to decide where an activity falls. If it fits an exception, the marketing restrictions do not apply and no authorization is needed. If it does not, they do.
Here are examples of how that plays out:
| Communication | Likely category | Why |
|---|---|---|
| A reminder from your clinic about an upcoming appointment | Treatment | Made for the patient’s own care |
| A mailer from your practice announcing a new service you provide | Own health-related services | Describes your own offerings |
| A wellness or disease management program you run | Generally not marketing | HHS FAQ: about your own health-related services |
| A third party pays you to send its product offer to your patient list | Marketing | Remuneration for a communication about another entity’s product |
| Handing a patient a brochure at the front desk | Face-to-face | Exempt from authorization |
When a case is genuinely unclear, treat it as marketing until counsel says otherwise. That is the cheaper mistake.
What a valid authorization contains
HHS says authorizations must be in plain language and explain who is authorized to use or disclose the information, what information is involved, who will receive it, when the permission expires and the purpose. It must be specific about that purpose. HHS also notes that, with limited exceptions, covered entities cannot make treatment, payment, enrollment or benefits eligibility conditional on a patient signing an authorization.
Two practical consequences follow. A vague checkbox that says “I agree to marketing” is not enough. And you cannot tell a patient they must opt in to promotional use of their data to receive care.
HIPAA compliant email marketing
Email is where most teams ask the question first, because the list itself is often made of patients. Start with the list, not the platform.
Step 1: Classify each email program
- Appointment reminders, test result notices, care instructions: treatment communications. Keep them out of your marketing platform entirely.
- Newsletters describing your own services: often within the own-services carve-out, but check what data you use to segment them.
- Promotions for another company’s product, or anything sponsored: marketing. This needs authorization, and the authorization must disclose any payment you receive.
Step 2: Keep PHI out of general-audience campaigns
Segmenting a list by diagnosis, treatment or visit history turns a newsletter into something that uses PHI. A safer pattern is to send general educational content to people who subscribed through a public form, without tying the message to their health condition. If you want condition-specific messaging for existing patients, get a specific, written authorization that names the purpose.
Step 3: Review the vendor relationship
If your email platform will store or process patient information on your behalf, it is a vendor handling PHI. Your compliance officer or counsel should confirm whether a business associate agreement (BAA) is needed and whether the vendor is willing to sign one. Do this before you upload a patient list, not after. If a vendor will not sign a BAA, do not put PHI in that tool.
Step 4: Write the authorization like a person would read it
Use plain language. State who is sending, what you will use (for example, email address and the fact that someone is your patient), who will see it, the purpose, and when the permission ends. Do not bury it in a long form.
Email checklist
- Is the sender a covered entity or acting for one?
- Does the message promote something, and whose product is it?
- Does the list or segment rely on PHI?
- Is there a signed authorization on file for that purpose?
- Does a vendor store the list, and is there a BAA where required?
- Has anyone been paid for the message, and does the authorization say so?
Ads, pixels and retargeting
Digital advertising is where the rules get least intuitive. The risk is not your ad copy. It is the data your website sends to ad and analytics platforms.
HHS’s online tracking guidance explains that HIPAA applies when information collected through tracking technologies, or disclosed to tracking vendors, includes PHI. Regulated entities may not use tracking in ways that cause impermissible disclosures of PHI to those vendors, including disclosures for marketing without valid authorizations. HHS also says tracking on user-authenticated pages, such as a patient portal, generally has access to PHI, and that a website banner asking users to accept or reject cookies does not amount to a HIPAA authorization.
An evolving area
This guidance has been contested. In June 2024, a federal court ruling in American Hospital Association v. Becerra limited part of the OCR bulletin as it applies to third-party tools on unauthenticated public webpages. That does not make tracking risk-free. Authenticated pages, appointment flows and symptom checkers remain sensitive, and state privacy and consumer protection laws can apply separately. Confirm the current position with counsel before launching or changing a tracking setup.
Where risk concentrates
| Touchpoint | Why it is sensitive | Safer approach |
|---|---|---|
| Patient portal and logged-in pages | Tracking there generally has access to PHI | Keep ad and analytics pixels off these pages |
| Appointment and intake forms | URLs and form fields can reveal conditions or visits | Strip identifiers and review what each tag collects |
| Retargeting audiences | Building a list from patient visits may disclose health status | Use broad contextual targeting instead of patient-based lists |
| Lead forms | Free-text fields invite health details | Limit fields and say plainly not to include medical information |
| Call tracking | Recordings can include PHI | Confirm how recordings are stored and who can listen |
For the mechanics of a privacy-conscious setup, our guide to privacy-first marketing for US teams and the retargeting checklist with privacy controls cover the controls in more detail. If you need to measure results without over-collecting, conversion tracking basics and UTM parameter practices help you keep tags lean.
Testimonials, photos and social media
Patient stories are the quietest way to break the rules, because they feel harmless. They are also where enforcement is easiest to see.
- OCR settled with Cadia Healthcare Facilities after it posted “success stories” on a public website without valid written authorizations. Mintz reports a $182,000 payment and a two-year corrective action plan under monitoring.
- A physical therapy provider, Complete P.T., resolved an OCR matter over testimonials that included full names and photographs without compliant authorizations. The reported settlement was $25,000 plus a corrective action plan.
- NatLawReview reports that a nursing home posted patient photographs in a social media campaign without authorizations, and that OCR also found breach notification failures.
- The American Dental Association reports a $50,000 civil money penalty against a dental practice that disclosed a patient’s information on a webpage while replying to a negative online review.
The lesson is consistent. A name, a face or a treatment detail in a public post needs a valid authorization, and a reply to a review is a disclosure too. A safe reply acknowledges the feedback in general terms and invites the person to contact you privately, without confirming they were a patient.
A simple testimonial workflow
- Draft the story and list every identifier in it: name, photo, date, condition, location.
- Prepare a specific authorization covering that use, the channels, who will see it and the end date.
- Have the patient sign before anything is published, with no link to their care.
- Log the authorization and set a reminder for its expiry.
- Remove the content when the permission ends or the patient revokes it.
How to review a campaign before launch
Based on HHS’s marketing guidance, a campaign review comes down to a few questions asked in order. Use this as a pre-flight checklist.
- Is it marketing? Does the message encourage someone to buy or use a product or service?
- Does an exception apply? Own health-related services, treatment, or care coordination and alternative treatment recommendations.
- Is PHI involved? Lists, segments, photos, form data, tag data.
- Is authorization needed? If yes, confirm it is specific, in plain language and on file.
- Is anyone paying you? If so, the authorization must state that.
- Who receives the data? Ad platforms, email tools, analytics, call tracking and agencies all count.
- Is there a contract? Confirm BAAs where a vendor handles PHI for you.
- Who signed off? Record the compliance review and the date.
How to evaluate results without exposing PHI
Measure at the aggregate level: calls booked, form submissions, cost per lead and channel mix. If a metric would require sending identifiable patient data to an ad platform to calculate, find another way to measure it. Our guide to digital marketing performance metrics covers which numbers matter at that level.
Magic Logix perspective
We see the same pattern with healthcare teams: compliance becomes a brake on marketing because it is handled at the end. Someone builds the campaign, then legal reads it a day before launch.
We think it works better the other way around. Decide early what data the campaign needs, what it must never touch, and which tools are acceptable. Then build creative and measurement inside those limits. Our approach at Magic Logix is to treat privacy as part of the design of a digital marketing program, which is what “Digital Beyond Tomorrow” means to us: planning for how the rules and the technology will keep changing.
For healthcare marketers, that usually means strong first-party content, search visibility that does not depend on patient data, clean site architecture, and measurement built on aggregate signals. It does not mean giving up on performance.
Hassan Bawab
Building a compliant program around search and content
Much of the best healthcare marketing uses no PHI at all. Educational content, service pages, provider bios and local search presence reach people who are looking for care, without touching a patient record. That is why search is a natural foundation. Our SEO services and AI search visibility work focus on being found when people ask questions, which does not depend on patient lists. For sector-specific planning, see our guides to medical practice marketing and healthcare B2B marketing.
State law can add requirements on top of HIPAA. For California consumers, for example, our CCPA guide for marketing teams explains the practical steps.
Work with Magic Logix on your marketing program
If you want a marketing plan that fits inside your compliance requirements, our digital marketing and paid media team can help plan campaigns, site structure and measurement with your compliance lead in the room. You can start a conversation through Magic Logix to talk through your goals and constraints.
FAQ
Does HIPAA prohibit healthcare marketing?
No. HIPAA restricts how PHI is used and disclosed for marketing, not marketing itself. Promoting your own services, general educational content and communications for treatment can be done within the rules. Using PHI for marketing generally needs the patient’s written authorization.
Is a cookie consent banner enough for HIPAA authorization?
No. HHS states that website banners asking users to accept or reject tracking do not constitute a valid HIPAA authorization. A valid authorization must be specific, in plain language and cover the elements HHS lists, such as the recipient, the purpose and the expiration.
Can I email patients about my practice’s new services?
Often yes. Communications describing your own health-related products or services are one of the carve-outs from the marketing definition in HHS guidance. Using a third-party platform to send them is a separate question, because the vendor may handle PHI. Check with your compliance officer about a BAA first.
Can I post patient testimonials or photos?
Only with a valid written authorization that covers that use. OCR settlements with Cadia and Complete P.T. involved testimonials and photos posted without compliant authorizations.
What are the penalties for a marketing violation?
Reported OCR outcomes range from a $25,000 settlement to $182,000 plus a two-year monitored corrective action plan, and a $50,000 civil money penalty in one dental case. Amounts depend on the facts of each case, so these are examples, not a fixed schedule.
Sources
- Marketing, HHS.gov
- 45 CFR 164.508, Cornell Legal Information Institute
- How can I distinguish between activities for treatment or health care operations and marketing, HHS.gov
- Marketing FAQ, HHS.gov
- Collecting, Using, or Sharing Consumer Health Information, HHS.gov
- Use of Online Tracking Technologies by HIPAA Covered Entities, HHS.gov
- American Hospital Assn. v. Becerra, Holland & Knight
- OCR settlement with Cadia, Mintz
- Physical therapy provider testimonial settlement, Data Privacy + Cybersecurity Insider
- Using patient photos in marketing, NatLawReview
- Three dental practices subject to enforcement actions, ADA News
