HIPAA gets used as a reason healthcare businesses cannot do marketing at all. That is fear-mongering, and it costs practices the patients they could be helping. The truth is more workable: you can run excellent marketing for a healthcare practice, you simply have to respect a few real lines around patient privacy. This guide to HIPAA compliant marketing draws those lines clearly, where marketing and HIPAA collide, what you genuinely cannot do, and the large amount you can, so you can grow without the constant low-grade fear that you are one analytics tag away from a violation. This is general guidance, not legal advice; for your specific situation, work with qualified compliance counsel.
What HIPAA governs
HIPAA protects individually identifiable health information, called protected health information or PHI, when it is held or handled by covered entities (healthcare providers, health plans, clearinghouses) and their business associates (vendors who handle PHI on their behalf). The key word is identifiable. HIPAA is not a blanket gag order on all healthcare marketing; it is a set of rules about protecting information that could reveal that a specific person is a patient or what their health situation is. Most marketing problems come from accidentally exposing or transmitting that identifiable information, usually without meaning to.
Where marketing and HIPAA collide
Website tracking and analytics (the modern minefield)
This is where most well-meaning practices get into trouble. Common analytics and advertising trackers can capture and transmit information (the page someone viewed, identifiers, sometimes form inputs) that, on a healthcare site, can amount to PHI. Federal guidance has made clear that putting standard tracking pixels on pages that reveal health-related activity, without the right safeguards and agreements, can create real compliance exposure. The fix is not to fly blind; it is to configure tracking carefully, limit what is collected on sensitive pages, and use vendors and setups that support compliance.
Forms, intake, and scheduling
Any form that collects health information, intake forms, "describe your symptoms," appointment requests tied to a condition, handles PHI and must be secured accordingly, with the data flowing only to compliant systems and vendors under proper agreements.
Email and SMS to patients
Messaging patients is allowed, but it must protect PHI. Avoid putting sensitive health details in unsecured messages, get the appropriate permissions, and use platforms configured for healthcare. Appointment reminders and general newsletters are very doable; broadcasting someone's diagnosis is not.
Reviews and testimonials
You cannot disclose that someone is a patient without their valid authorization, which makes patient testimonials and even responding to reviews a trap. Acknowledging a reviewer as a patient, or sharing any detail of their care, can itself be a disclosure. Respond to reviews generically and never confirm a specific person's patient status.
Vendors and business associate agreements
Any vendor that touches PHI on your behalf, including some marketing and analytics tools, generally needs a business associate agreement (BAA) in place. No BAA, no PHI. Choosing tools that will sign one, and getting them signed, is a foundational step.
What you absolutely can do
Here is the part the fear-mongering skips: most marketing is completely fine, because it never touches PHI.
- Content marketing and SEO. Educational articles, condition explainers, and helpful answers contain no patient information. Publish freely; it is one of the best things a practice can do.
- Local SEO and Google Business Profile. Being findable for "dermatologist near me" involves no PHI.
- General advertising to audiences (not built from patient lists) on compliant platforms.
- AI-answer visibility. Becoming the trustworthy source AI assistants cite about your specialty.
- Newsletters and reminders done through compliant systems with appropriate safeguards.
How to set up HIPAA compliant marketing
Get the foundation right and you can market with confidence: audit and configure your website tracking so sensitive pages are not leaking identifiable data, put BAAs in place with every vendor that could touch PHI, keep forms and patient messaging on compliant systems, set a clear policy for reviews and testimonials, and document your approach. Then go market aggressively on all the channels that never touch PHI, which is most of them.
For practices specificallyHow to market a therapy practice without feeling like a selloutRead the practice guide
