HIPAA-Compliant Marketing: What Practices Can and Can’t Do With Patient Data in Campaigns

Every medical practice wants more patients, and most marketing tools work best when they use data. Email lists, retargeting ads, review requests and text reminders all depend on information about real people. In healthcare, though, that information is often protected health information (PHI), and the HIPAA Privacy Rule sets firm limits on how it can be used.

Many practices break these rules by accident. A front-desk employee uploads a patient list to an ad platform, a website pixel quietly shares appointment details with a third party, or a thank-you post on social media confirms that someone is a patient. Each of these can lead to complaints, investigations and fines, and it can also damage the trust you have worked to build.

This guide explains what HIPAA allows and prohibits in marketing, where practices most often go wrong, and how to build campaigns that grow your patient base without putting your compliance at risk.

What Counts as PHI in a Marketing Context

PHI is more than a diagnosis or a chart note. It is any individually identifiable health information that a covered entity creates, receives, stores or transmits. In marketing, the identifiers people forget matter most:

• Names, email addresses, phone numbers and home addresses
• Appointment dates, provider names and service types
• Insurance details, account numbers and payment history
• The simple fact that someone is a patient of your practice

That last point surprises many practice owners. Even without any clinical detail, a list of people who have visited a cardiology office is PHI. Once you treat every patient list, billing record and appointment log as protected, most marketing decisions become much clearer.

When HIPAA Treats a Message as “Marketing”

Under the Privacy Rule, marketing generally means a communication that encourages someone to buy or use a product or service. The practical consequence is that marketing using PHI usually requires the patient’s written authorization. The rule has important exceptions, and knowing them keeps you from being either too cautious or too careless.

Communications that typically do not need a marketing authorization include:

• Face-to-face conversations with a patient, such as a provider mentioning a new service during a visit
• Promotional gifts of nominal value, such as a branded pen or magnet
• Treatment and care coordination messages, such as telling a patient about a follow-up screening that is relevant to their condition
• Certain health care operations messages, such as general updates about your practice’s own services, as long as no third party is paying you to send them

The key issue is financial remuneration. If a pharmaceutical company, equipment vendor or other outside party pays you to promote its product to your patients, that is marketing and requires authorization. If you are simply telling your own patients about your own services, you may have more room, but the details of the message matter. When a campaign falls in a gray area, document your reasoning and get a qualified compliance review before launch.

What Practices Can Do

HIPAA does not ban marketing. It shapes how you do it. Compliant practices regularly do all of the following:

Send communications about their own services and care. Appointment reminders, annual wellness prompts, flu shot notices and follow-up care messages are generally permitted when they serve treatment or operational purposes.

Build email lists with proper consent. A patient who signs a clear authorization to receive newsletters or promotions can be marketed to. Make the opt-in separate from your general intake paperwork, explain what they will receive, and make unsubscribing simple.

Run general advertising to the public. Search ads, social posts, local sponsorships and educational blog content do not use PHI at all. They reach people based on broad targeting, not on your patient records.

Share testimonials with authorization. A patient story or review can be used when the patient signs a specific authorization that explains where and how it will appear.

Use de-identified or aggregate data. Statistics such as “we served thousands of patients last year” involve no PHI. Properly de-identified data, following HIPAA’s standards, can inform strategy as well.

Work with vendors under a Business Associate Agreement. If a marketing, call-handling or technology partner will touch PHI on your behalf, a signed Business Associate Agreement (BAA) is required before any data changes hands.

What Practices Can’t Do

These are the mistakes that most often lead to violations.

Upload patient lists to advertising platforms without authorization

Custom audience and lookalike tools are tempting because they work well. But uploading a list of patients to an ad platform discloses PHI to that platform. Unless you have valid patient authorization, and the platform is willing to meet HIPAA requirements, this is a risk you should avoid.

Sell or trade PHI

HIPAA generally prohibits selling PHI without authorization. Handing your patient list to a partner for a fee, or swapping lists with another business, falls squarely in this category.

Confirm that someone is a patient in public

When a patient leaves an online review, the instinct is to respond warmly. A reply like “We’re glad your knee surgery went well” confirms the person’s relationship with your practice and reveals treatment details. Respond in general terms without acknowledging that they received care from you, and invite them to continue the conversation privately.

Use testimonials, photos or videos without written permission

Before-and-after photos, patient videos and named success stories all require specific authorization. A general consent form signed at intake is not enough, and a verbal “sure, go ahead” will not hold up in an audit.

Mix marketing into messages that carry sensitive billing or clinical details

Adding a promotion to an outstanding balance reminder, or putting treatment-related details in a mass email, can turn a permitted communication into a problematic one. Keep operational and promotional messaging clearly separate.

Send unsolicited texts or calls without proper consent

The Telephone Consumer Protection Act (TCPA) sits alongside HIPAA. Marketing texts generally need prior express written consent, and patients must be able to opt out easily. Appointment and billing reminders follow different rules, which is another reason to keep message types separate.

Websites, Pixels and Tracking Technologies

Your website may be your biggest compliance blind spot. Analytics tools, advertising pixels, chat widgets and session-recording software can all collect information about visitors and send it to outside companies. If a visitor is logged into a patient portal, or is booking an appointment for a specific condition, the data collected may be PHI.

Federal regulators have issued guidance on tracking technologies on healthcare websites, and parts of that guidance have been challenged in court, so the legal picture has shifted over time. The safe approach does not depend on the latest ruling:

• Audit every script and tag running on your site, especially on login, scheduling, intake and payment pages
• Avoid placing third-party tracking on authenticated or condition-specific pages unless the vendor will sign a BAA and the setup has been reviewed
• Configure analytics to avoid collecting identifiers that could connect a visitor to a health condition
• Review your cookie banner and privacy policy so they accurately describe your data practices

A quarterly website audit is cheap compared with the cost of a breach investigation.

Where Billing Data and Marketing Collide

Billing records are some of the most sensitive data your practice holds. They contain insurance information, dates of service, procedure codes, balances and payment history. Marketers love this data because it shows which services bring in revenue, and that is exactly why it must be handled carefully.

Practices that outsource to trustworthy medical billing services often gain a compliance advantage, because a dedicated billing team already works inside a tightly controlled environment: role-based access, secure transmission, audit trails and a signed BAA. The data stays within a defined workflow instead of flowing into spreadsheets, shared drives and personal inboxes.

At Mednex Group, the principle we encourage practices to follow is simple: billing data exists to get claims paid and support patient accounts, not to feed ad audiences. If your marketing team wants insights from billing, such as which service lines are most profitable or which payers reimburse best, request aggregated, de-identified reports. You get the strategic value without exposing a single patient’s information.

Billing communications deserve the same discipline. Statements, payment reminders and balance notices should be clean, accurate and free of promotional content. When billing and marketing messages stay separate, you protect compliance and patient trust, and you make it more likely that patients actually pay on time.

Choosing a Marketing Partner Who Understands HIPAA

Not every agency understands healthcare rules. A general marketing firm may suggest tactics that are standard in retail or e-commerce but risky for a covered entity. When you evaluate a healthcare digital marketing partner, ask direct questions before you sign:

• Will you sign a Business Associate Agreement if your work involves PHI?
• How do you handle patient lists, retargeting and lookalike audiences?
• What is your process for reviewing website tracking and analytics setups?
• How do you manage testimonials, reviews and patient stories?
• Can you show examples of campaigns you built for other practices within HIPAA limits?

A partner who answers confidently, and who says “no” to a tactic when the risk is too high, is worth far more than one who promises quick wins without mentioning compliance.

A Practical HIPAA Marketing Checklist

Use this list before launching any campaign:

1. Identify the data. Does the campaign use patient names, contact details, appointment history or billing information?
2. Check the purpose. Is this treatment, health care operations or marketing? If it is marketing, is there written authorization?
3. Confirm remuneration. Is any third party paying you to promote something to your patients?
4. Verify vendors. Does every vendor that touches PHI have a signed BAA?
5. Review consent. Do opt-ins meet HIPAA and TCPA standards, and is opting out simple?
6. Audit your website. Are tracking scripts and forms configured to avoid sending PHI to outside parties?
7. Train your team. Do front-desk, social media and billing staff know what they can and cannot say or share?
8. Document decisions. Keep records of your reasoning, authorizations and reviews.

Building Trust Through Compliant Marketing

Patients share sensitive information with the expectation that it stays private. When your marketing respects that expectation, it becomes part of your reputation. Practices that explain how they use data, ask permission before sharing stories and keep billing communications clean tend to earn stronger loyalty and better reviews.

Compliance is also a growth strategy. A single privacy complaint can cost far more than a year of ad spend, in legal fees, regulatory attention and lost goodwill.

Final Thoughts

HIPAA-compliant marketing is not about doing less. It is about being deliberate. Know what counts as PHI, understand when a message becomes marketing, secure written authorization when it is required, and keep billing data in its proper place. Choose partners who treat privacy as a core requirement, not an afterthought.

If your practice wants a billing process that supports both revenue and compliance, Mednex Group can help you build a workflow where claims are handled correctly, patient data stays protected, and your marketing team can grow the practice with confidence.

This article is for general educational purposes and is not legal advice. Practices should consult a qualified healthcare compliance attorney for guidance specific to their situation.