Marketing confidential health services to teens: consent laws, HIPAA, Title X and bills that leak

A teenager who wants to be tested, get birth control or talk to someone about drinking will look for two things before they call: whether they can come in without a parent, and whether a parent will find out. A practice that offers that care has to answer both questions on its website and in its ads, and the honest answer depends on state law, on the HIPAA rules for parents of minors, on whether the clinic runs a Title X project, and on what the insurer mails home afterward.

This guide is for pediatric and family practices, adolescent clinics, sexual and reproductive health clinics, behavioral health practices and school-linked programs that want to tell teens about confidential services. It covers what the law lets a minor consent to, what HIPAA says about parents, Title X confidentiality, what to promise and what not to, explanation of benefits notices, portal proxy access, reminders, ads that reach minors, and crisis wording. For children under 13 online, see our guide to COPPA for pediatric practice websites. For the wider parent audience, see our guide to pediatric practice marketing, and for ad and imagery rules on testing services, our guide to sexual health clinic marketing. For the age targeting rules on one platform teens use, see our guide to Snapchat ads for medical practices. Screening reminders that reach teens are covered in chlamydia and gonorrhea screening outreach.

The short version

• Consent comes from state law. Whether a minor can agree to a service without a parent is set by your state, and the list of services differs from one state to the next.
• HIPAA follows consent. Under 45 CFR 164.502(g)(3), when a minor lawfully consents to a service, the parent is generally not the personal representative for that service, but state law can still allow or forbid telling the parent.
• Title X projects have their own rule. 42 CFR 59.10(b) says a Title X project may not require parental consent for services to minors and may not notify a parent before or after a minor requests or receives Title X family planning services.
• Promise only what you can deliver. A page that says “your parents will never know” is a promise your billing, insurer, portal and state law may not let you keep.
• Insurance mail is the leak. An explanation of benefits notice can go to the policyholder. Tell teens before the visit, and show them their options.
• Ads reach minors under platform rules. Ad platforms limit how ads may target people under 18 and how health topics may be targeted. Read each platform’s current policy, and keep patient data out of audiences.
• Crisis wording: print 988 for a mental health or suicide crisis and 911 for an emergency.

Start with what your state lets a minor consent to

Minor consent laws are written service by service. Three examples show how different they are, which is why a page written for one state cannot be copied into another.

• Texas. Texas Family Code 32.003(a) lets a child consent to diagnosis and treatment of a disease that must be reported to a health officer, to examination and treatment for drug or chemical dependency, and, if unmarried and pregnant, to pregnancy related care other than abortion, among other grounds. Section 32.003(d) also lets a licensed physician, dentist or psychologist tell the parents about treatment given or needed, with or without the child’s consent. A Texas page that promises a parent will not be told would overstate the law.
• Florida. Florida Statutes 384.30(1) lets licensed providers and facilities examine and treat a minor for sexually transmissible diseases without a parent’s consent. Section 384.30(2) says the fact of the visit is confidential and may not be divulged directly or indirectly, and it names sending a bill to a parent or guardian as an example of what is not allowed, with exceptions in 384.29.
• California. California Family Code 6926 lets a minor 12 or older consent to care to diagnose or treat certain reportable infectious diseases and related sexually transmitted diseases, and to care to prevent a sexually transmitted disease. Section 6926(c) says the parents are not liable for payment for that care.

These are examples, not a survey. Your state may set different ages, different services and different rules on telling parents, and a statute can change after you publish. Ask your attorney for a short written list of the services a minor can consent to in your state, the age for each, and whether a provider may or must tell a parent. Build your web copy from that list, and date it.

What HIPAA says about parents

HIPAA does not decide whether a teen can consent to care. It points back to state law. Under 45 CFR 164.502(g)(3)(i), a parent, guardian or person acting in loco parentis who has authority under applicable law to make health care decisions for an unemancipated minor is treated as the minor’s personal representative. That person is not the personal representative, and the minor acts as the individual, for a service when:

• the minor consents to the service, no other consent is required by law, and the minor has not asked that the parent be treated as the personal representative;
• the minor may lawfully get the service without a parent’s consent, and the minor, a court or another person authorized by law consents to it; or
• the parent agrees to a confidentiality arrangement between the provider and the minor for that service.

Even then, 164.502(g)(3)(ii) lets state or other law, including case law, decide what a parent may see. Where that law permits disclosure or access to the parent, the covered entity may give it. Where that law prohibits it, the covered entity may not. Where the parent is not the personal representative and no state or other law addresses access, a licensed health care professional decides, in the exercise of professional judgment, whether to give or deny the parent access, consistent with applicable law.

For marketing, this means two things. Your staff need a written rule on who counts as the patient for each confidential service, because that decides who gets messages and portal access. And your web copy should describe what happens at your practice, not what HIPAA promises, because HIPAA hands the question to your state.

Title X projects have their own confidentiality rule

If your clinic runs a project funded under Title X of the Public Health Service Act, 42 CFR 59.10 applies. As of the eCFR text current on October 28, 2026, it says:

• information about people receiving services must be held confidential and not disclosed without the person’s documented consent, except as needed to provide services or as required by law (59.10(a));
• reasonable efforts to collect charges must be made without jeopardizing client confidentiality (59.10(a));
• the project must tell the client of any potential for their confidential health information to be disclosed to a policyholder who is someone other than the client (59.10(a)); and
• Title X projects should encourage family participation to the extent practical, but may not require parental consent for services to minors and may not notify a parent or guardian before or after a minor has requested or received Title X family planning services (59.10(b)).

The definitions in 42 CFR 59.2 add that unemancipated minors who want services on a confidential basis must be considered on the basis of their own resources when the project decides who counts as low income. Title X rules have been rewritten more than once, and grant terms can add conditions, so check the current rule and your grant documents before you rely on this in an ad. This rule covers Title X projects. A practice that is not one should not borrow its wording.

What to promise on your website, and what not to

Teens read a confidentiality page closely. Write it as a plain description of how your practice handles each service, in your state, and keep the limits on the page with the promise.

• Use: “In [State], people [age] and older can get [service] here without a parent’s permission.” Avoid: “You never need a parent.”
• Use: “We keep these visits private as the law allows. Before your visit, we will tell you what could show up on an insurance notice and what your options are.” Avoid: “Your parents will never find out.”
• Use: “There are times we have to share information, for example if someone is in danger. We will tell you about those limits at your visit.” Avoid: “Everything you say stays here.”
• Use: “You can tell us how you want us to reach you.” Avoid: “We will text you,” with no choice.
• Use: “Ask us about cost before your visit.” Avoid: “Free and confidential,” unless both are true for each patient you are speaking to.

Put the page where a teen will find it: a short line on the service page, a link from the appointment page, and a clear name such as “Teen visits and privacy”. Keep the page free of stock photos of identifiable young people presented as patients, and do not add patient stories from minors.

Explanation of benefits and billing leaks

The plainest way a confidential visit reaches a parent is the paperwork after it. A health plan can send an explanation of benefits notice, a claim question or a bill to the policyholder, and a practice’s own statements can go to the guarantor on file. The federal tools to stop this are narrow:

• Under 45 CFR 164.522(b)(1)(i), a covered health care provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations, and under (b)(2)(iii) may not require an explanation for the request.
• Under 164.522(b)(1)(ii), a health plan must accommodate such a request only if the individual clearly states that disclosure could endanger them, and under (b)(2)(iv) the plan may require that statement in the request.
• Under 164.522(a)(1)(vi), a provider must agree to a request not to disclose information to a health plan for payment or operations when the service was paid in full out of pocket and the disclosure is not otherwise required by law. That keeps the claim, and the notice, from existing.

State law can go further. California Civil Code 56.107 requires a health care service plan to send communications about a protected individual’s sensitive services, including explanation of benefits notices and bills, to the individual, at an alternative address, email or phone number if they gave one, and not to disclose those services to the policyholder without the individual’s written authorization. Florida’s 384.30(2), above, bars indirect disclosure such as a bill to a parent for STD care. Check what your state requires of plans and of providers.

For marketing copy, the honest message is short: “If you use a parent’s insurance, they may get a notice. Ask us about your options before your visit.” Then have the options ready: a self-pay price, a request to the plan, and any program in your area that covers the service, with each confirmed by your billing team.

Portal proxy access

A parent with proxy access to a child’s portal can see what the portal shows: visit lists, messages, results, bills and notes. If your portal treats a teen’s confidential visit like any other visit, your website promise breaks the first time a parent logs in.

• Decide at what age the portal changes for teens, and what a parent proxy can see after that age. Base it on your state’s law and your attorney’s advice.
• Use the features your portal has for sensitive visits, such as hiding a visit, message or result from a proxy, and test them with a test account before you advertise the service.
• Give teens who can consent their own login where your state law allows it, and explain it at the visit.
• Write the rule down, so front desk and nurses answer a parent’s question the same way.

Under 164.502(g)(3)(ii), a parent’s access to a minor’s records for a service the minor consented to depends on state or other law and, where that law is silent, on a licensed professional’s judgment. Your portal settings should follow that rule, not override it. For how portal messages are sorted under HIPAA, see our guide to patient portal messages and HIPAA marketing.

Reminders, texts and calls

A text that says “Reminder: your visit at the teen sexual health clinic is tomorrow” on a phone a parent pays for, or shares, is a disclosure. Ask each teen patient how they want to be reached, record it, and send reminders for confidential services only by that route. Keep reminder text neutral: the practice name and a time, with no service named. Under 164.522(b), the request for a different phone, address or channel does not need a reason. For the FCC and HIPAA rules on reminder texts, see our guide to text message appointment reminders.

Do not add teen patients from confidential services to newsletters, recall campaigns or review requests unless they asked for them and chose the channel. A review request about a confidential visit is a message a parent could read.

Ads, forms and tracking that reach minors

Ads that reach teens bring three sets of rules: the ad platforms’ own policies, children’s privacy law and HIPAA for anything built from patient data.

• Platform policies. Ad platforms publish rules on ads shown to people under 18 and on targeting by health topics. They change, so read the current policy of each platform before a campaign, and expect less targeting, not more, for teen audiences.
• Children under 13. If a page or app is directed to children under 13, or you know a user is under 13, COPPA applies. See our COPPA guide for trackers, consent and notices.
• Teen privacy laws. State laws on minors’ online data differ, so check yours before you collect anything on a teen page.
• Tracking on confidential pages. Keep third-party pixels and session recording off teen service pages, the appointment form for those services and the confirmation page. See our guide to tracking pixels on practice websites.
• No patient lists. Do not upload teen patient lists to an ad platform or use them to build audiences. Using patient information for marketing under HIPAA can require an authorization under 45 CFR 164.508, and for a minor that question returns to who the personal representative is.

Ads that work for this audience are plain: what the service is, who can come, what it costs, how to book, and a link to the privacy page. Write them so a parent reading over a shoulder sees an ordinary health ad.

Crisis wording

Teen pages for behavioral health, substance use or sexual health should show where to go in a crisis. Under 47 CFR 52.200, 988 is the three-digit code for the national suicide prevention and mental health crisis hotline. Use: “If you are thinking about suicide or are in crisis, call or text 988. If you are in danger now, call 911.” Avoid listing your own office line as a crisis line, and avoid other hotline numbers you cannot keep up to date.

Notes by type of practice

• Pediatric and family practices: the parent books, pays and holds the portal. Write a teen privacy page, set portal rules before the patient turns the age you chose, and explain them at the visit before it. For school forms and checkup outreach, see our guide to school-based health center marketing.
• Sexual and reproductive health clinics: the minor consent statute for STD care, and Title X if you run a project, shape your wording. Check the ad rules in our sexual health clinic guide before you write ads.
• Behavioral health and substance use: state rules on minors consenting to counseling and to substance use treatment differ, and records from certain substance use programs fall under 42 CFR Part 2. Ask your attorney which rules apply to your program before you promise privacy.
• Dental and other specialties: confidential teen services are less central, but a teen with their own consent right under your state law may still ask for private contact. Your intake form should let them say so.

An illustration

This example is invented. [Practice name], a family practice in a state that lets minors consent to STI testing, wants to promote teen testing.

Before: a social ad reading “Totally confidential STI testing for teens. Your parents will never know!” links to a booking form with an analytics pixel, and the reminder text names the test.

After: the ad reads “Teens [age] and older can get tested here without a parent’s permission. See how we protect your privacy.” It links to a privacy page that lists the services, the insurance notice issue, the self-pay price and the limits on confidentiality. The booking form has no third-party tracking, the intake asks how the patient wants to be reached, and reminders say only “[Practice name]: appointment tomorrow at 3:30.” The portal hides the visit from the parent proxy, and the billing team marks the visit for self-pay or a plan request when the teen asks.

Checklist before you promote confidential teen services

• Written list from your attorney: services a minor can consent to in your state, ages, and when a provider may or must tell a parent
• Title X: if you run a project, current 42 CFR 59.10 and grant terms reviewed
• Privacy page with the promise and its limits on the same page
• Insurance notice wording and a self-pay price confirmed by billing
• Portal proxy settings tested with a test account
• Contact preference captured at intake, reminders neutral
• No third-party tracking on teen service pages and forms
• No patient lists in ad platforms
• Current platform policy read for each ad channel
• 988 and 911 wording on behavioral health pages

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. For confidential teen services, that means a clear privacy page, booking forms kept free of third-party tracking, and phone handling that asks how a patient wants to be reached. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Sources

• 45 CFR 164.502: Uses and disclosures of protected health information, including (g) personal representatives
• 45 CFR 164.522: Rights to request privacy protection for protected health information
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 42 CFR 59.10: Confidentiality (Title X family planning projects)
• 42 CFR 59.2: Definitions (Title X)
• 42 CFR Part 2: Confidentiality of substance use disorder patient records
• 47 CFR 52.200: Designation of 988 for a national suicide prevention and mental health crisis hotline
• Texas Family Code 32.003: Consent to treatment by child
• Florida Statutes 384.30: Minors’ consent to treatment
• California Family Code 6926: Consent by minor, infectious and sexually transmitted diseases
• California Civil Code 56.107: Confidentiality of sensitive services, health care service plans

More in Physician specialty marketing