Case studies for healthcare vendors: FTC and HIPAA rules

A billing company publishes a page called “How a three-doctor orthopedic group cut denials.” An EHR vendor posts a video of a practice manager praising its scheduling module. A marketing agency shares a slide with a client clinic’s lead numbers before and after its campaign. A lab puts a physician’s quote on its trade show banner. Each of these is a case study, and each one is an advertisement.

This guide is for founders and marketing leads at companies that sell to practices: billing and revenue cycle firms, software vendors, agencies, labs, device and supply companies. It reads the federal texts that decide what a case study can say and what data it can be built from: the FTC’s Guides Concerning the Use of Endorsements and Testimonials in Advertising (16 CFR Part 255), and the HIPAA Privacy Rule provisions on business associates, marketing and de-identification (45 CFR 164.502, 164.504(e), 164.508 and 164.514). Related guides: LinkedIn marketing for healthcare companies, success rates and outcome claims, and affiliate links and commission disclosure. Research sites pitching sponsors have extra limits on naming studies and products; see marketing a clinical research site to sponsors and CROs.

The short version

• A client quote is an endorsement. 16 CFR 255.0(b) covers any message consumers are likely to believe reflects the opinions or experience of someone other than the advertiser, and 255.0(d) defines product to include a service, brand or company.
• The client must actually mean it, and still mean it. 16 CFR 255.1(a) and (c) require honest views from a bona fide user, and you may keep running it only while you have good reason to believe that is still true.
• A result you feature reads as typical. 16 CFR 255.2(b) says an endorser’s experience on a key attribute will likely be read as what others will generally achieve, unless you have proof or disclose the generally expected result.
• Disclose what you gave the client. A discount, free months, early access or a fee for the case study is a material connection under 16 CFR 255.5(a) and must be disclosed clearly and conspicuously.
• Patient data is not yours to publish. A business associate may use protected health information only as its contract permits (45 CFR 164.502(a)(3)), and using it for marketing needs patient authorization (164.508(a)(3)).
• De-identify by the rule, not by feel. 45 CFR 164.514(b) gives two methods: expert determination, or removing 18 listed identifiers with no actual knowledge that the rest could identify someone.

Why a case study is an endorsement

The FTC’s endorsement guides interpret section 5 of the FTC Act, which declares unfair or deceptive acts or practices in commerce unlawful (15 USC 45(a); 16 CFR 255.0(a)). The guides are not a rule, but they set out the principles the Commission uses to judge endorsements, and practices inconsistent with them may lead to action under section 5.

Under 16 CFR 255.0(b), an endorsement is any advertising, marketing or promotional message for a product that consumers are likely to believe reflects the opinions, beliefs, findings or experiences of a party other than the sponsoring advertiser. The definition names verbal statements, tags in social media posts, depictions of a person’s name or likeness, and the name or seal of an organization. The endorser can be an individual, a group or an institution. 16 CFR 255.0(d) says product includes any product, service, brand, company or industry.

So a practice manager’s quote, a physician’s video, a clinic’s logo in a “trusted by” strip and a named client in a story are all endorsements of your company. The definition does not limit endorsers to consumers buying for themselves; the example the guides give of an organization’s seal is an endorsement as well.

Honest, current and in context

16 CFR 255.1 sets the general rules that apply to every case study quote.

• Honest views only. Endorsements must reflect the honest opinions, findings, beliefs or experience of the endorser, and may not convey anything that would be deceptive if you said it yourself (255.1(a)). A quote your team wrote and the client approved without reading is weak ground.
• Edits must not distort. You do not have to use the client’s exact words unless you present them as exact, for example in quotation marks, but you may not take the endorsement out of context or reword it so it distorts the client’s opinion or experience (255.1(b)).
• Bona fide user, now. If the case study says the client uses your product, the client must have been a bona fide user when the endorsement was given, and you may run it only while you have good reason to believe they still are (255.1(c)). A practice that switched vendors last year should come off the logo strip and the case study page.
• Expert endorsers are checked again. For an expert or celebrity endorser, 255.1(b) says you may use the endorsement only while you have good reason to believe they still hold the views, which you can satisfy by checking at reasonable intervals, judged by factors such as new information about your product, a material change to it and your contract commitments. A physician quoted about clinical value is the closest case for a health vendor; we did not read 255.3 on expert endorsements for this guide.
• You answer for it. Under 255.1(d), you can be liable for misleading statements made through endorsements even when the endorser is not, and you should guide endorsers, monitor them and correct problems.

Results in a case study: the typicality problem

Case studies sell on numbers: fewer denials, faster payment, more booked visits, lower no-show rates. 16 CFR 255.2(a) says an ad using consumer endorsements about a product’s performance will be read as saying the product is effective for that purpose, and the advertiser must have substantiation for those claims just as if it made them directly. Endorsements themselves are not that evidence. When a case study sits inside a longer white paper, see our guide to healthcare white paper claims for the evidence side.

16 CFR 255.2(b) adds that an endorsement relating the experience of one or more consumers on a central or key attribute of the product will likely be read as representing what consumers will generally achieve. If you do not have substantiation that the featured result is representative, the ad should clearly and conspicuously disclose the generally expected performance in the depicted circumstances, and you need substantiation for that figure too. The guides’ examples say disclaimers such as “results not typical” did not work in the Commission’s testing (255.2(e), Example 2).

Section 255.2 is written about consumer endorsements, and whether a practice buying software is a consumer in that sense is a question for your counsel. The safer reading for a vendor is to treat the headline result the same way, because 255.1(a) and 15 USC 45(a) apply in any case. In practice:

• Keep the client’s own report behind every number: the period, the measure, the starting point and who calculated it.
• State the circumstances that drove the result, such as a clean-up project, extra staff or a payer mix the reader may not share. The guides’ weight-loss example treats clearly described exceptional circumstances differently from a bare result (255.2(e), Example 4(i)).
• If you have data across your client base for the same measure, show the typical result next to the featured one, and use the median when outliers pull the mean (255.2(e), Example 4(iv)).
• Do not pick only the best clients for a results page without saying so. 255.2(d) says advertisers should not take actions that distort what customers think, whether or not the reviews are endorsements.

Our guide to success rates and outcome claims covers denominators and how to present a figure so it reads correctly.

What you gave the client must be disclosed

Vendors often trade something for a case study: a discount on renewal, free months, a free add-on module, early access to a new feature, a speaking slot at the vendor’s event. 16 CFR 255.5(a) says a connection between the endorser and the seller that might materially affect the weight or credibility of the endorsement, and that the audience does not reasonably expect, must be disclosed clearly and conspicuously. It lists business, family or personal relationships, payment, free or discounted products, early access and the chance of appearing in media promotions, and it applies whether or not you required the endorsement in return.

A disclosure does not need every detail, but it must tell readers the nature of the connection well enough to judge it (255.5(a)). Under 255.0(f), clear and conspicuous means difficult to miss and easily understood; on a web page or social post it should be unavoidable, and a disclosure only a click away behind “more” fails (255.0(g), Example 9). For a case study page that means a line near the quote, such as “This practice received a discount on its subscription for taking part in this case study,” not a footnote at the bottom. Other connections to watch: a client that is also a reseller or referral partner, an investor, or a physician who is a paid adviser. The same section’s Example 1 says that when an advertiser funds research and cites its findings, the funding should be disclosed.

If a client is paid per referral, for example in a partner program, our affiliate disclosure guide covers that connection and the separate federal question when a referral involves services a federal health care program pays for.

Patient information in a case study

This is where a health vendor’s case study differs from any other B2B story. If your company creates, receives, maintains or transmits protected health information for a practice, you may be its business associate, and our guide to what makes a vendor a business associate covers that test.

• Your contract sets the limit. A business associate may use or disclose protected health information only as permitted or required by its business associate contract or as required by law (45 CFR 164.502(a)(3)). The contract must establish those permitted uses and may not let the business associate do what would violate the Privacy Rule if done by the practice, apart from its own management and administration and data aggregation for the practice’s health care operations (164.504(e)(2)(i)). Using client patient data to promote your own company is not on that list.
• Marketing needs authorization. Marketing means a communication about a product or service that encourages recipients to purchase or use it (45 CFR 164.501). A covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions for face-to-face communications and promotional gifts of nominal value (164.508(a)(3)). If the practice is paid for the disclosure, the sale of protected health information rules in 164.508(a)(4) also apply, and the authorization must say so.
• Screenshots count. A demo video recorded in a live client account, a screenshot of a claims queue or a dashboard export can show names, dates of service or account numbers. Use a test account with made-up records, and label it as sample data.

Patient stories a practice publishes about its own care follow different rules, covered in our testimonials and before-and-after guide.

De-identified data: the two methods

Aggregate results can usually be told without patient data at all. When a case study does rest on patient-level data, HIPAA’s de-identification standard decides whether it is still protected. Health information that does not identify an individual, and with no reasonable basis to believe it could be used to identify one, is not individually identifiable (45 CFR 164.514(a)), and the Privacy Rule does not apply to information de-identified under 164.514 (164.502(d)(2)). 164.514(b) allows a covered entity to reach that conclusion in only two ways:

1. Expert determination. A person with appropriate knowledge of statistical and scientific methods determines that the risk is very small that the information could be used, alone or with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results (164.514(b)(1)).
2. Safe harbor. Eighteen kinds of identifiers of the individual or of relatives, employers or household members are removed, including names, geographic units smaller than a state (with a narrow three-digit ZIP code exception), all elements of dates except year directly related to the individual, phone and fax numbers, email addresses, medical record and account numbers, device identifiers, URLs, IP addresses, full face photos and any other unique identifying number, characteristic or code, and the covered entity has no actual knowledge that what remains could identify someone (164.514(b)(2)).

Two points matter for vendors. First, the rule speaks to the covered entity: under 164.502(d)(1), a practice may use protected health information to create de-identified information or disclose it to a business associate for that purpose. Whether you, as the business associate, may de-identify client data and use the result for your own purposes depends on what your contract permits under 164.502(a)(3); read it before you build the case study. Second, small numbers in a small market can identify people. A rural single-specialty clinic’s “one patient with a rare condition” can fail the actual knowledge test even after the 18 identifiers are gone. A re-identification code disclosed with the data is itself protected health information (164.502(d)(2)(i)).

Naming the client practice

The name of a practice is not protected health information about a patient, but using it is still an endorsement under 16 CFR 255.0(b), so the points above apply. It is also a contract question: your service agreement may restrict using the client’s name or logo, so check it first. Get a written release from someone with authority at the practice that covers the name, the logo, each quote, each number and where the case study will run, and set a review date. When the client leaves or withdraws consent, take it down everywhere you control, including sales decks and partner pages.

An illustration

This is a made-up example, not a client. A revenue cycle company drafts a case study for a four-provider dermatology practice. The draft headline says “Collections up sharply in 90 days,” with a chart exported from the client’s live billing dashboard and a quote the marketing team wrote. The practice received three months free for agreeing to take part.

The fix: the chart is rebuilt from monthly totals the practice reported, with no patient rows, and the period and measure are stated under it. The headline names the metric and the practice’s starting point, and a line beside it says the practice also hired a second biller that quarter. The quote is rewritten from a recorded interview and approved in writing by the practice administrator. A line next to the quote discloses the three free months. The release covers the name, logo and quote for 12 months, and a calendar reminder asks the client to reconfirm before then. The business associate agreement is checked, and it does not permit using client data for the vendor’s marketing, so no patient-level data is used.

Checklist

• Every quote reflects the client’s honest view and is approved in writing (16 CFR 255.1(a), (b)).
• Client still uses the product; a review date is set (255.1(c)).
• Each number has a source report, period and measure on file (255.2(a)).
• Featured result is typical, or the generally expected result is shown beside it (255.2(b)).
• Discounts, free months, fees, early access and partner ties disclosed next to the quote (255.5(a)).
• No protected health information unless the contract permits it and patients authorized it (45 CFR 164.502(a)(3), 164.508(a)(3)).
• De-identified data meets expert determination or the 18-identifier safe harbor (164.514(b)).
• Demos and screenshots use test accounts with sample data, labelled as such.
• Client name and logo covered by a written release; removed everywhere when it ends.

How we help

We build websites, landing pages and content for health companies and independent practices as part of lead generation, search and Google Ads work, with claims and disclosures written against the rules as read on the day. We are not a law firm. Related guides: marketing for medical billing companies, EHR vendor marketing claims and our guide to healthcare marketing rules.

Sources

• 16 CFR Part 255: Guides Concerning Use of Endorsements and Testimonials in Advertising
• 15 USC 45: Unfair methods of competition unlawful; prevention by Commission
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.502: Uses and disclosures of protected health information
• 45 CFR 164.504: Organizational requirements (business associate contracts)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.514: De-identification and other requirements

More in Health companies, vendors and employers