HIPAA marketing rules for medical practices: what counts as marketing, when you need authorization, and the exceptions

Most of what a practice does to attract new patients never touches HIPAA. A Google ad, a search-friendly website or a Business Profile reaches the public, not your patient records. HIPAA’s marketing rules start to matter the moment you use information about your own patients to promote something: an email to your patient list, a text campaign, a mailing about a new service, or a partner offer sent to people because they are your patients.

This guide explains how the HIPAA Privacy Rule defines marketing, which communications fall outside that definition, when a written authorization is required, the two exceptions to that requirement, and what the authorization itself has to contain. It is written for owners and managers of independent practices: dental, med spa, chiropractic, integrative and primary care.

First question: does HIPAA apply to your practice?

The Privacy Rule applies to covered entities. For a practice, that generally means a health care provider that sends health information electronically in connection with standard transactions, such as submitting insurance claims or checking eligibility. CMS publishes a short tool to help you decide whether you are a covered entity. Many practices that bill insurance are. Some cash-only practices are not.

If you are not a covered entity, the HIPAA marketing rules below do not apply to you, but that does not make patient information a free-for-all. The FTC enforces against unfair or deceptive use of health information by businesses outside HIPAA, and state health privacy laws add their own duties, which differ by state. Our healthcare marketing rules hub maps out which agency covers what.

If you are a covered entity, the next question is whether the campaign uses protected health information at all. Under 45 CFR 160.103, individually identifiable health information includes demographic information, such as a name and address, when it relates to the provision of health care to a person and identifies them. A list of your patients, built from your practice management system, generally fits that description: it shows who received care from you.

How HIPAA defines marketing

The definition is in 45 CFR 164.501. Marketing means “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” That is broad on purpose. It is not limited to ads, and it does not matter whether the message is a letter, an email, a text or a phone call.

The same definition then lists communications that are not marketing, and those carve-outs are where most everyday practice communications land.

Communications that are not marketing under HIPAA

Under paragraph (2) of the marketing definition, these are not marketing, as long as the conditions noted are met:

• Refill reminders and current prescriptions. Refill reminders, or other communications about a drug or biologic currently prescribed for the patient, are not marketing, as long as any payment the practice receives for sending them is reasonably related to the practice’s cost of making the communication.
• Treatment communications. Communications by a provider for the treatment of the patient, including case management or care coordination, or to direct or recommend alternative treatments, therapies, providers or settings of care.
• Your own health-related services. Communications describing a health-related product or service (or payment for it) that the practice itself provides. Telling your patients about a new provider joining the practice or a new treatment you now offer generally fits here.
• Care coordination and treatment alternatives. Case management, care coordination and contacting patients with information about treatment alternatives, to the extent these do not already count as treatment.

There is one important catch. The treatment and own-services carve-outs do not apply if the practice receives financial remuneration in exchange for making the communication. The rule defines financial remuneration as direct or indirect payment from or on behalf of a third party whose product or service is being described. Payment for treating a patient does not count. So a message that would normally be a treatment communication becomes marketing if a manufacturer or another company pays you to send it.

When you need a written authorization

Under 45 CFR 164.508(a)(3), a covered entity must obtain the patient’s authorization for any use or disclosure of protected health information for marketing, with two exceptions (covered in the next section). If the marketing involves financial remuneration from a third party, the authorization must state that such remuneration is involved.

Selling patient information is handled separately and more strictly. Under 164.508(a)(4), a disclosure that is a sale of protected health information needs an authorization that states the disclosure will result in remuneration to the covered entity. Handing or renting your patient list to another business for its own promotions requires authorization from each patient: under (a)(3) because it is a disclosure for marketing, and under (a)(4) as well if you are paid for it.

The two exceptions: face-to-face and gifts of nominal value

Section 164.508(a)(3)(i) lists only two situations where marketing does not need an authorization:

• Face-to-face communication. A communication made by the covered entity to the patient in person. A clinician or front desk team member talking with a patient in the office about a product or service fits here. A mailed letter, an email or a text message does not, because they are not face to face.
• Promotional gift of nominal value. A promotional gift of nominal value provided by the covered entity, such as a pen, a toothbrush or a calendar with the practice name on it. The regulation does not set a dollar limit for nominal value, so keep these items plainly small.

Keep in mind that these are exceptions to the HIPAA authorization requirement only. Gifts and free items for Medicare or Medicaid patients raise separate questions under the federal beneficiary inducement and anti-kickback laws, which our rules hub and guide to new patient offers cover.

What a valid marketing authorization must contain

A marketing authorization is a specific document, not a checkbox buried in intake paperwork. Under 45 CFR 164.508(c), it must contain at least:

1. What informationA description of the information to be used or disclosed, in a specific and meaningful way.
2. Who may use or disclose itThe name or specific identification of the person or class of persons authorized to make the use or disclosure.
3. Who receives itThe name or specific identification of the person or class of persons to whom the practice may disclose it.
4. The purposeA description of each purpose of the use or disclosure.
5. An expirationAn expiration date or an expiration event that relates to the patient or the purpose.
6. Signature and dateThe patient’s signature and date. If a personal representative signs, a description of that person’s authority to act for the patient.
7. Required statementsStatements putting the patient on notice of their right to revoke the authorization in writing and how to do it (or a reference to your Notice of Privacy Practices if it covers this), whether treatment, payment, enrollment or eligibility can be conditioned on signing, and that information disclosed under it may be redisclosed by the recipient and no longer protected by the Privacy Rule.
8. Remuneration, if anyFor marketing paid for by a third party, a statement that financial remuneration is involved (164.508(a)(3)(ii)).

The authorization must be written in plain language, and the practice must give the patient a copy of the signed form (164.508(c)(3) and (c)(4)). Under 164.508(b)(4), a practice generally may not condition treatment or payment on the patient signing a marketing authorization. Patients can revoke an authorization in writing at any time, except to the extent the practice has already acted on it (164.508(b)(5)). Signed authorizations must be kept as required by 164.530(j), which sets a retention period of six years from the date of creation or the date it was last in effect, whichever is later.

Testimonials, photos and review replies

Marketing is not only about mailing lists. A patient’s name, photo, story or before-and-after images on your website or social media are protected health information if they identify someone as your patient. Using them to promote the practice is outside treatment, payment and health care operations, so a covered practice generally needs the patient’s written authorization before publishing them.

Review replies are a common trap. Confirming that a reviewer is a patient, or describing their care in a reply, is a disclosure. Our guide to patient reviews and reply templates that protect privacy covers how to answer without disclosing anything, and our med spa website design guide covers before-and-after galleries, authorizations and FTC rules on typical results.

Patient lists, email platforms and tracking tools

When you send a campaign to patients, the patient list usually lives in a vendor’s system: an email platform, a texting service, a CRM or a patient reminder tool. HHS says a covered entity needs a business associate agreement with vendors that create, receive, maintain or transmit protected health information on its behalf. Before you upload a patient list anywhere, find out whether the vendor will sign one and what its terms cover. Many mass email tools are built for retail and do not offer one. The same applies to an AI phone service that takes patient calls; see our guide to HIPAA and AI receptionists.

Tracking is the less visible version of the same problem. Advertising pixels and analytics tags on patient-facing pages, such as appointment requests or a patient portal login, can send information about patients to ad platforms. HHS OCR has issued guidance on online tracking technologies; our guide to tracking pixels and Google Analytics on a practice website explains what it says, including the part a federal court vacated in 2024. Uploading patient lists to an ad platform for targeting is a disclosure of patient information and raises the same authorization and vendor questions covered above; our guide to patient list uploads and customer match covers it in detail.

Fundraising is a separate rule

If your practice is part of a nonprofit health system or has a related foundation, fundraising communications follow their own rule at 45 CFR 164.514(f). It permits limited information (such as demographics, dates of service, department, treating physician, outcome information and insurance status) to be used for the practice’s own fundraising without an authorization, but only if the Notice of Privacy Practices says so, and every fundraising communication must offer a clear and easy way to opt out of further ones. Fundraising is not a backdoor for promoting services; promoting services is marketing.

Marketing that does not use patient information

Most new patient marketing works without touching your records at all, and that keeps the HIPAA marketing rules out of the picture:

• A clear, fast website with treatment pages written for the people searching for them. See our medical website design service.
• Local search and Google Business Profile work, so your practice shows up for nearby searches. See healthcare SEO.
• Search ads aimed at people looking for the care you provide, within Google’s healthcare policies. See Google Ads for practices.
• Answering every call, so the demand you already have turns into visits. See our AI front desk.

Other rules still apply to these channels, such as the FTC Act on truthful advertising, the FTC’s endorsement guides and Google’s own ad and listing policies. The rules hub links to each.

A short check before any patient-list campaign

• Is the practice a covered entity? If not, check FTC and state rules instead.
• Does the message promote a product or service? If it only reminds, coordinates care or recommends treatment, it may fall outside the marketing definition.
• Is it about your own health-related services? If yes, it is likely outside the definition, unless a third party is paying.
• Is anyone else paying for it? Third-party payment usually turns it into marketing that needs an authorization stating remuneration is involved.
• Is it face to face or a small promotional gift? Those are the only two exceptions to the authorization requirement.
• Do you have signed authorizations that cover this use? Check the purpose, recipients and expiration on the form.
• Where does the list go? Confirm a business associate agreement with every vendor that will hold it.
• Can people opt out? Honor revocations and opt-outs before the next send.

Frequently asked questions

Sources

• 45 CFR 164.501: Definitions (marketing, financial remuneration)
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.514: Other requirements relating to uses and disclosures (including (f) fundraising)
• 45 CFR 164.530: Administrative requirements (including (j) documentation and retention)
• 45 CFR 160.103: Definitions (individually identifiable health information, protected health information)
• HHS: Marketing (HIPAA Privacy Rule guidance)
• HHS: Business Associates
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• CMS: Are you a covered entity?
• FTC: Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule

More in Healthcare marketing rules