Hospital marketing compliance: tracking, patient stories, fundraising, rankings and required notices

Hospital and health system marketing teams work under more rules than most practice marketers. The same HIPAA and FTC rules apply, but hospitals also have foundations that raise money from former patients, some are partly owned by physicians, many advertise rankings and awards, and their websites carry a set of required notices that a small practice may never need. Each of these has caught hospitals out.

This guide is a map for hospital marketing and web teams: where the tracking technology guidance stands, when patient stories need authorization, how foundation fundraising differs from marketing, the physician ownership disclosure some hospitals must put in their ads, how to handle rankings, and which notices belong on the website. Each section links to a deeper guide where we have one. Hospitals that run acute care at home should read hospital at home marketing, which covers the CMS waiver end date.

Tracking technologies: where the OCR guidance stands

The HHS Office for Civil Rights has published a bulletin on the use of online tracking technologies by HIPAA covered entities and business associates. On June 20, 2024, the US District Court for the Northern District of Texas, in American Hospital Association v. Becerra, declared unlawful and vacated a portion of it. The note HHS now carries on the bulletin says the court vacated the guidance to the extent it provides that HIPAA obligations are triggered when an online technology connects an individual’s IP address with a visit to an unauthenticated public webpage addressing specific health conditions or healthcare providers. The AHA reported on August 29, 2024 that HHS would not appeal.

For a hospital, that leaves a lot of the bulletin in place. The vacated portion is about public pages that a visitor reaches without logging in. The bulletin’s discussion of patient portals and other authenticated pages, appointment and intake forms, mobile apps and business associate agreements is outside that portion. Hospital websites tend to have all of those.

Regulators have also looked at hospitals specifically. On July 20, 2023, the FTC and HHS announced a joint letter sent to approximately 130 hospital systems and telehealth providers about the risks of tracking technologies, naming the Meta pixel and Google Analytics as examples. Our guides to tracking pixels on healthcare websites, cookie consent banners and HIPAA and website forms cover the practical setup.

Patient stories need authorization

Hospitals produce a lot of patient stories: service line campaigns, social video, donor reports and annual reports. Under 45 CFR 164.501, marketing means a communication about a product or service that encourages the recipient to buy or use it. Under 164.508(a)(3), a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except for a face-to-face communication or a promotional gift of nominal value. A patient’s story in a campaign for the hospital’s own service line is a typical case that needs a signed authorization before the story runs.

Three practical points for hospital teams:

• Get the authorization from the right person. For minors and patients who cannot sign, the authorization comes from the personal representative under 45 CFR 164.502(g) and state law.
• Make it specific. Name the uses: which campaign, which channels, for how long. A general media release signed at admission is a weak basis for a later ad campaign.
• The FTC rules apply too. Under 16 CFR 255.2(b), a story about a key result is likely to be read as what patients will generally achieve, unless the ad clearly discloses what patients can generally expect and the hospital can support that. Our guide to patient testimonials covers both sets of rules.

Staff and physician social media is the other common source of stories. Our healthcare social media policy guide covers what staff can post.

Foundation fundraising is not marketing, and has its own rules

Many hospitals have a foundation that writes to former patients. HIPAA treats this separately from marketing. Under 45 CFR 164.514(f)(1), a covered entity may use, or disclose to a business associate or an institutionally related foundation, a limited set of protected health information for raising funds for its own benefit without an authorization:

• Demographic information, including name, address, other contact information, age, gender and date of birth.
• Dates of health care provided.
• Department of service information.
• Treating physician.
• Outcome information.
• Health insurance status.

The conditions in 164.514(f)(2) are where marketing teams need to coordinate with the foundation:

• The notice of privacy practices must say so. The hospital may not use these rules unless its notice of privacy practices includes the fundraising statement required by 164.520.
• Every fundraising communication needs an opt-out. Each one must give a clear and conspicuous opportunity to stop further fundraising communications, and the opt-out method may not cause an undue burden or more than a nominal cost.
• Opt-outs must be honored across channels. No further fundraising communications may go to someone who opted out, though the hospital may offer a way to opt back in.
• No conditions on care. Treatment or payment may not depend on the patient’s choice about fundraising communications.

The line to watch is between fundraising and marketing. An appeal for donations to the foundation is fundraising. A message using the same patient list to promote a service line is marketing, and needs an authorization under 164.508(a)(3) unless an exception applies. Keep the lists, and the people who can use them, separate.

Physician-owned hospitals must say so in their advertising

Some hospitals are partly owned by physicians. Under 42 CFR 411.362(b)(3)(ii)(C), a hospital that relies on this section of the physician self-referral rules must disclose on any public website for the hospital and in any public advertising for the hospital that the hospital is owned or invested in by physicians. The regulation says any language that would put a reasonable person on notice that the hospital may be physician-owned is enough, and that a public website for this purpose does not include, for example, social media sites, patient payment portals, patient care portals or health information exchanges.

The same paragraph requires the hospital to have each referring physician owner or investor on its medical staff agree to give written disclosure of their ownership to patients they refer, in time for the patient to make a meaningful decision about care. For a marketing team, the practical step is a short ownership statement built into the website footer and ad templates, so it is not left to each campaign to remember.

Rankings, awards and “best hospital” claims

Hospitals advertise rankings, star ratings and awards more than any other part of health care. Under 16 CFR 255.0(b), the name or seal of an organization can be an endorsement. Under 255.4, an organization’s endorsement must be reached by a process sufficient to ensure that it fairly reflects the collective judgment of the organization. Example 3 in 255.4 describes a ranking website that accepts money for higher rankings, and says such rankings are deceptive and that disclosure of the payments would not cure it, because the payments determine the rankings.

• Name the source, year and category. “Ranked in [category] by [organization], [year]” is a claim a reader can check. An unqualified “best hospital in the region” is not.
• Do not stretch a narrow award. A recognition for one service line or one measure is not a ranking of the whole hospital.
• Retire expired claims. Remove last year’s award from ads and pages when it lapses.
• Support outcome comparisons. Claims that outcomes are better than elsewhere are health claims. The FTC Health Products Compliance Guidance says health-related claims must be supported by competent and reliable scientific evidence.
• Know what you paid for. If the hospital pays for an award, a seal license or a placement, review it against 255.4 and 255.5 before using it.

Our guide to top doctor awards, paid badges and star ratings covers these rules in more detail.

If your hospital publishes emergency department wait times, online check-in or online pre-registration, those pages sit next to EMTALA screening duties as well as advertising law. Our guide to ER wait time advertising covers labels, check-in wording and insurance questions.

Notices that belong on a hospital website

Several federal rules require specific content on a hospital’s website. Marketing and web teams usually own the pages they live on, so they belong on the marketing checklist.

• Price transparency. Hospitals must post a machine-readable file of standard charges and a consumer-friendly display of shoppable services or a price estimator. Our hospital price transparency guide covers what the website has to do.
• Financial assistance policy. A tax-exempt hospital must make its financial assistance policy, application form and plain language summary widely available on a website under 26 CFR 1.501(r)-4(b)(5). Our hospital financial assistance policy guide covers the web page, signs, bills and CHNA report.
• Language assistance notice. Under 45 CFR 92.11, a covered entity must provide a notice that it offers language assistance services and auxiliary aids and services free of charge, in English and at least the 15 languages most commonly spoken by people with limited English proficiency in the relevant state or states, including at a conspicuous location on its website. The notice also goes with documents such as the notice of privacy practices, intake forms, consent forms, discharge papers and billing materials. Our Spanish-language marketing guide covers the Section 1557 rules.
• Balance billing protections. Under 45 CFR 149.430, providers and facilities must post information about patient protections against balance billing on their public website. See our No Surprises Act website disclosure guide.
• Physician ownership statement, where 42 CFR 411.362 applies, as covered above.
• Accessibility. Our website accessibility guide covers the current federal rules for healthcare websites.

A redesign is when these notices most often go missing. Keep a list of each required page or element and check it before any new site or template goes live.

A review workflow for hospital marketing teams

1. Inventory tags by page type. Public pages, condition and provider pages, forms, portal and app pages. Decide what runs where, in writing, with the privacy officer.
2. Route patient stories through authorization. No story runs until a signed authorization covering that use is on file.
3. Separate fundraising and marketing lists. Confirm the fundraising statement is in the notice of privacy practices and that opt-outs are honored.
4. Check ownership disclosure. If 42 CFR 411.362 applies, build the statement into website and ad templates.
5. Source every ranking and outcome claim. Keep the source, year, category and any payment terms on file with the ad.
6. Check required notices after every launch. Price transparency, language assistance, balance billing and ownership statements.

How we help

We build and maintain healthcare websites with the required notices, tag decisions and patient story workflows planned in from the start, and we do not promise rankings or results. Our website work is built with HIPAA in mind, and we confirm in writing what a BAA covers before any patient information flows through a tool; if it is not covered, we do not route patient information through it. See our medical website design service for how we approach a build.

Sources

• HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (with the note on the June 20, 2024 court order)
• AHA News: HHS will not appeal AHA court victory in online tracking case (August 29, 2024)
• FTC: FTC and HHS warn hospital systems and telehealth providers about privacy and security risks from online tracking technologies (July 20, 2023)
• eCFR: 45 CFR 164.501, definitions (marketing)
• eCFR: 45 CFR 164.508(a)(3), authorization required for marketing
• eCFR: 45 CFR 164.514(f), fundraising communications
• eCFR: 42 CFR 411.362(b)(3), physician-owned hospitals: disclosure of conflicts of interest
• eCFR: 16 CFR Part 255, Guides Concerning the Use of Endorsements and Testimonials in Advertising (255.0, 255.2, 255.4)
• FTC: Health Products Compliance Guidance (December 2022)
• eCFR: 45 CFR 92.11, notice of availability of language assistance services and auxiliary aids and services
• eCFR: 45 CFR 149.430, disclosure of patient protections against balance billing

More in Facilities, care services and pharmacy