HIPAA-Compliant Marketing, Done Right

Not automatically, and this is the most misunderstood question in the category. HIPAA applies to a health care provider only if that provider transmits health information in electronic form in connection with a transaction for which HHS has adopted a standard, such as a claim, an eligibility inquiry, or a referral authorization. HHS is explicit that using electronic technology like email does not by itself make a provider a covered entity: the transmission has to be in connection with one of those standard transactions. A purely cash-pay med spa that never bills insurance electronically may therefore fall outside HIPAA entirely, while one that bills any insurance, or uses a billing service that does, is almost certainly inside it. That is not a reason to relax. State medical-privacy laws, state board advertising rules, the FTC Act, and the FTC Health Breach Notification Rule can all still apply to a practice HIPAA does not reach, and patients do not draw the distinction. Confirm your own status with your compliance counsel rather than inferring it from a marketing page.

Yes, with a specific written authorization rather than a general release. A testimonial that identifies someone as your patient discloses protected health information, so the authorization has to name the exact content being used, state where it will appear, and preserve the patient's right to revoke it. A blanket photo release signed at intake does not cover a specific later use. Keep the signed authorization on file for as long as the asset is published, and stop using the asset when consent is withdrawn.

Wherever you store them, the storage has to be access-controlled, auditable, and covered by a business associate agreement if a vendor touches it. Consent forms are patient records: a shared cloud drive without access controls, a personal email inbox, or a marketing tool with no agreement in place are all common and avoidable failures. Retain the authorization for as long as the content is live, and be able to produce it for a specific asset on request, which in practice means filing consent against the asset rather than only against the patient.

Four things, in this order: know whether HIPAA applies to you, get specific written authorization before any patient becomes identifiable in an asset, keep claims truthful and substantiated, and make sure the tech stack is not leaking protected health information through pixels, analytics, or forms. The fourth is the one practices miss, because it happens without anyone deciding to do it.

Yes, provided targeting is built on intent and geography rather than health status, and the creative is honest about results. Health and beauty is a restricted advertising category on both platforms, and the fastest way to lose an account is wording around weight loss, GLP-1 medications, or prescription treatments. Compliance here is a platform-policy question as much as a HIPAA one, and both matter: the ads have to stay approved to be worth anything.

A before-and-after photo is protected health information about an identifiable patient, so it requires specific written consent naming the exact images and where they will appear, plus disclaimers that results vary. A generic release is not enough, and publishing an image without documented authorization creates both HIPAA and, depending on the claim, FTC exposure.

They can, and they do it silently. Standard tracking pixels and analytics can transmit what a visitor viewed or submitted, and on a healthcare site that data can amount to protected health information shared with a third party. HIPAA-aware tracking, careful form design, and the right data agreements are how a practice site stays compliant while still measuring what matters.

No. These resources explain how we build marketing that respects HIPAA, FTC substantiation, and platform rules, and they are educational rather than legal advice. For a determination about your specific practice, consult your own compliance counsel. We build to a conservative standard and coordinate with your counsel when one is involved.