Announcing a new doctor, office move or practice sale to patients: HIPAA, Google and Medicare steps

Every practice changes. A new physician joins, an associate leaves, the lease runs out and the office moves across town, or the owner sells to another group. Each change has to reach patients, and each one touches rules that are easy to miss in the rush: which patient list you may use and for what, who may send the letter, what Google expects from your Business Profile, what Medicare wants to hear and when, and how patients get their records. This guide walks through four announcements a practice makes as it changes and the steps behind each one.

Some of this ground is covered elsewhere on our site, and we link to it rather than repeat it. Our HIPAA marketing rules guide explains the marketing definition and its exceptions in full, the multi-location practice SEO guide covers adding and moving locations on Google, and the insurance and provider directory guide covers telling health plans about provider changes. This guide stays on the announcement itself and the steps around it. If the practice is also changing its web address, see our guide to changing your website domain or host.

Why an announcement to your own patients is generally allowed

A letter, email or text to your own patients uses their contact information, which is protected health information if you are a HIPAA covered entity. 45 CFR 164.506(c)(1) says a covered entity “may use or disclose protected health information for its own treatment, payment, or health care operations.” The question is whether the announcement fits one of those purposes or counts as marketing, which needs a signed authorization under 45 CFR 164.508(a)(3).

45 CFR 164.501 defines marketing as a communication about a product or service that encourages recipients to purchase or use it, and then lists exclusions. Two matter here. A communication “to describe a health-related product or service (or payment for such product or service) that is provided by” the covered entity making the communication is not marketing. Neither is a communication for treatment of an individual, including one made “to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual.” Both exclusions stop applying “where the covered entity receives financial remuneration in exchange for making the communication”, and 164.501 defines financial remuneration as direct or indirect payment from or on behalf of a third party whose product or service is being described.

Put simply: when the practice tells its own patients about its own new doctor, its own new address or its own new hours, and nobody else pays for the message, the communication generally falls inside the exclusions. The harder cases are the ones where someone outside the practice is involved, which is exactly what happens when a doctor leaves or a practice is sold.

Announcing a new doctor or clinician

This is the simplest of the four. The new physician, nurse practitioner or therapist provides services through your practice, so a letter, email or portal message introducing them describes a health-related service the practice itself provides. Keep it factual: name, credentials, specialty, which location and days, whether they are accepting new patients and which plans they are in network with. Claims about training and certification should match what you can document. Our physician bio page guide covers how to word board certification and credentials on the bio page the letter links to.

A few checks keep the announcement accurate. Confirm the clinician’s start date and network participation before the letter goes out, because a patient who books on the strength of the letter and finds the clinician is not yet in network has a reason to complain. Send the new clinician’s directory information to each health plan you contract with. If you send by email or text, the rules for those channels still apply; our healthcare email marketing and text message reminders guides cover them.

On Google, Google’s guidelines for representing your business describe doctors and dentists as individual practitioners and say a practitioner should create a dedicated Business Profile only if they operate in a public-facing role and “can be contacted directly at the verified location during stated hours.” Where several public-facing practitioners work at one location, the guidelines say the organization should have its own profile for the location, separate from the practitioner’s, and the practitioner’s profile title “should include only the name of the practitioner.” Our Google Business Profile for doctors guide covers setup and verification.

When a doctor leaves the practice

A departure is where announcements go wrong. The practice wants to keep its patients, the departing doctor wants to tell patients where they are going, and the patient list sits in the middle. Three facts from the rule shape what can happen.

• The practice’s uses have to fit the rule. If the practice is the covered entity that maintains the records, every use and disclosure of the patient list and charts has to fit a permission in the Privacy Rule. Who keeps the charts after a departure is set by agreements and state law, not by who treated the patient.
• The practice can tell patients itself. A letter from the practice telling patients that a doctor is leaving, who in the practice can continue their care, and, if the practice chooses, where the departing doctor will practice, can fit the treatment exclusion in 164.501 for communications that recommend alternative health care providers or settings of care, provided nobody pays the practice to send it.
• Handing over the list is a separate step. Giving the patient list to the departing doctor’s new practice so it can send its own announcement is a disclosure to another entity. It needs its own basis under 45 CFR 164.506 or an authorization under 164.508, and if the practice receives payment in exchange for the list it is a sale of protected health information under 164.502(a)(5)(ii), which requires an authorization unless an exception applies.

The cleanest pattern is a single letter from the practice, agreed with the departing doctor in advance, sent to the patients that doctor treated. It tells patients they may stay with the practice or follow the doctor, and explains how to request a copy of their records or have them sent to a new provider. Employment contracts, non-solicitation clauses and state medical board rules can govern what each side may say and when; that is a question for your attorney before the letter is drafted.

Patients keep their right of access throughout. Under 45 CFR 164.524(b)(2), a covered entity must act on a request for access no later than 30 days after receiving it, with only one extension of no more than 30 days, if it gives the individual a written statement of the reasons and the expected date. Under 164.524(c)(2), copies must be provided in the form and format requested if readily producible. A departure is not a reason to slow a records request down.

On the website, update the provider page the day the doctor leaves. If the bio page URL will not come back, Google Search Central recommends a permanent server-side redirect when you need to change the URL of a page as it is shown in search results, and says to “use permanent redirects when you’re sure that the redirect won’t be reverted.” Point the old bio URL to the specialty page or the provider list, not to the home page, and remove the doctor from any structured data, booking widget and insurance directory entries. For the Business Profile, Google’s help page on closing a business says a profile marked permanently closed may still appear on Search and Maps for users who search for it and clearly shows that it is closed. Agree in writing who manages any practitioner profile before the departure date.

Moving the office

A move is an announcement about the practice’s own services, so the HIPAA analysis is the same as for a new doctor. The work is in the logistics: every place your address appears has to change at once, and the old address has to keep pointing patients to the new one for a while.

1. Google Business Profile. Edit the address on the existing profile. Google’s help page on editing your profile says that if you move your business to a new address after it is verified, you must verify your business again. Do not mark the profile permanently closed for a move. Google’s help page on reopening a business says that if a business was marked permanently closed as part of a location or name change, do not reopen it; instead add a new business, verify it, and contact Google if you want reviews moved.
2. Website. Update the address, map, directions, parking notes and hours on every page that shows them, and the LocalBusiness or MedicalClinic structured data. Our schema markup guide covers the fields.
3. Medicare enrollment. Under 42 CFR 424.516(d)(1), physicians, nonphysician practitioners and their organizations must report a change, addition or deletion of a practice location to their Medicare contractor within 30 days.
4. Health plans and directories. Send the new address to each plan and update directory listings. The provider directory guide has the checklist.
5. Patients with upcoming visits. Tell everyone booked after the move date directly, with the new address in the reminder itself, not only on the website.
6. Signage at the old address. Ask the landlord whether a notice with the new address can stay up for a period after you leave.

Google’s guidelines also say businesses showing their address on Google should maintain permanent fixed signage of their business name at the address. Plan the sign at the new location before the Business Profile address changes, not after.

Selling the practice or merging with another group

The Privacy Rule anticipates practice sales. 45 CFR 164.501 lists among health care operations “the sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity.” That means a seller may use and disclose protected health information for the transaction and for the buyer’s due diligence under 164.506(c)(1).

The transaction also has its own exception from the sale of protected health information rule. 45 CFR 164.502(a)(5)(ii)(B)(2)(iv) says sale of protected health information does not include a disclosure “for the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence.” The 2013 final rule explains that HHS retained this exception “to ensure that such disclosures may continue to occur in accordance with the Privacy Rule” (78 FR 5607), and that it reaches transactions with another covered entity or with an entity that will become one after the transaction (78 FR 5608). A buyer that is not and will not become a covered entity falls outside the definition, which is one reason the structure of the deal matters for the records.

The announcement is where the two sides need a plan. Before closing, a letter from the seller to its patients describing the change and introducing the buyer’s clinicians can fit the treatment exclusion for recommending other providers or settings of care. If the buyer pays the seller specifically to send it, the exclusions in 164.501 do not apply where the covered entity receives financial remuneration in exchange for making the communication, and 164.508(a)(3) then requires an authorization. After closing, the buyer that now provides the care is describing its own services. Have counsel look at the timing and who signs the letter as part of the purchase agreement, not after it.

Patients need four things from a sale announcement: who will provide their care and where, whether their plans are still accepted, who now holds their records and how to request them, and how to choose a different provider if they want to. State rules on patient notice and on who must keep records when a practice is sold or closed differ, so check your state’s board rules. Ask your attorney which apply before you set dates in the letter, and do not promise a notice period you have not checked.

Name changes come next. Google’s help page on editing your profile says your business name should appear exactly as it appears on your real world signage, stationery and other branding, and that if you change your business name after it is verified, you might need to verify your business again. Google’s guidelines add that your name should reflect your business’s real-world name as used consistently on your storefront, website, stationery, and as known to customers. Change the sign, the website and the profile in the same week. On Medicare, 42 CFR 424.516(d)(1) requires a change of ownership to be reported within 30 days, and 424.516(d)(2) requires all other enrollment changes within 90 days.

What to put in each announcement

• New clinician: name, credentials, specialty, location and days, start date, new patient status, plans accepted, how to book.
• Departing doctor: last day, who in the practice can continue care, the patient’s choice to stay or follow, how to request records or a transfer, a contact for questions.
• Move: new address, effective date, parking and access notes, phone number if it changes, what happens to appointments booked around the move date.
• Sale or merger: effective date, who provides care and where, plans accepted, who holds records and how to request them, how to choose a different provider.

Leave out anything that reads like a promise you cannot keep: no claims that wait times will drop, care will improve or costs will fall unless you can back them up. The FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce (15 U.S.C. 45). For claims about a practice’s services, the same caution makes sense: the FTC approach generally requires that health-related claims be backed by competent and reliable scientific evidence. Our healthcare marketing rules hub links to the guides on advertising claims.

Illustration: a two-doctor practice where one doctor retires and the practice moves

Illustration. A two-physician family practice learns that one physician will retire in the spring, and the lease on its building ends the same month. The remaining physician has hired a nurse practitioner and found a new office. The first draft plan has the retiring physician take a copy of the patient list to send a personal farewell letter, puts the new address only on the website, and marks the Google profile closed so a new one can be created.

1. One letter, from the practice. The practice sends a single letter to its own patients announcing the retirement, introducing the nurse practitioner as a provider of the practice and giving the new address. The retiring physician signs a farewell paragraph within it. No list leaves the practice.
2. Records. The letter explains how to request records or a transfer, and the front desk logs each request against the 30-day deadline in 164.524(b)(2).
3. Google. The practice edits the address on its existing profile and plans for re-verification instead of marking it closed, and decides with the retiring physician what happens to their practitioner profile.
4. Website. The retiring physician’s bio URL redirects permanently to the provider list, the nurse practitioner’s bio page goes live with documented credentials, and the address and structured data change on the move date.
5. Medicare and plans. The office manager reports the practice location change to the Medicare contractor within 30 days under 424.516(d)(1), and sends the provider and address changes to each plan.
6. State rules. The practice’s attorney checks whether any state notice or record custody rules apply to the retirement before the letter’s dates are set.

Checklist

• Decide who sends each announcement and confirm the practice, not a departing doctor or a buyer, controls the patient list until the agreement says otherwise.
• Check that the announcement describes the practice’s own services or recommends providers for patients’ care, and that no third party pays for it.
• Do not hand the patient list to another practice without a documented basis under 164.506 or an authorization under 164.508.
• Confirm credentials, start dates and network participation before announcing a new clinician.
• Tell patients how to request records and meet the 164.524 timelines.
• Edit the Google Business Profile address for a move rather than marking it closed, and plan for re-verification.
• Redirect old provider and location URLs permanently and update structured data the same day.
• Report location and ownership changes to your Medicare contractor within the 424.516(d) time frames.
• Update every health plan directory and your insurance page.
• Have counsel check state notice and record custody rules, contracts and timing before dates go in the letter.

How we help

We build practice websites, local search, Google Ads and AI front desk tools for independent practices. For a practice change, that can mean new and updated provider pages, redirects for retired URLs, address and structured data changes timed to the move, Business Profile edits and a clear records request page. We do not sell or rent patient lists. Our work is built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Sources

• 45 CFR 164.501: Definitions (health care operations, marketing, financial remuneration)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules (sale of protected health information)
• 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.524: Access of individuals to protected health information
• HHS: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, final rule, 78 FR 5566 (January 25, 2013)
• 42 CFR 424.516: Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program
• Google Business Profile Help: Guidelines for representing your business on Google
• Google Business Profile Help: Edit your Business Profile
• Google Business Profile Help: Mark your business as closed
• Google Business Profile Help: Mark your business as reopened
• Google Search Central: Redirects and Google Search (last updated April 14, 2026)
• 15 U.S.C. 45: Unfair methods of competition unlawful
• FTC: Health Products Compliance Guidance (December 2022)

More in Local SEO and reviews for practices