LGBTQ-inclusive medical practice marketing

Patients who are lesbian, gay, bisexual, transgender, queer or questioning look for signs, before they book, that a practice will treat them with respect. A line on the website saying “LGBTQ-friendly” or “affirming care” is one of those signs. It is also an advertising claim, and the intake form that follows it collects data that patients may share with no one else. The words, the form and the ads all have rules behind them.

This guide covers the Section 1557 nondiscrimination notice as it stands after the October 2025 court order, how to back up words like “affirming” and “trained”, why sexual orientation and gender identity count as sensitive data under state privacy laws, what Google Ads allows when you target these audiences, and how to word an intake form. For the notices themselves, see our guide to Section 1557 website notices. For state privacy law in general, see state consumer privacy laws and the HIPAA exemption. Audience settings by age, sex, race and language are covered in our guide to healthcare ad targeting rules.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: 45 CFR 92.3, 92.10 and 92.101, the HHS notification of court decision at 91 FR 32887 (June 2, 2026), 15 U.S.C. 45, the FTC Policy Statement Regarding Advertising Substantiation, 16 CFR 255.4, 45 CFR 164.508 and 164.522, Va. Code 59.1-575 and 59.1-578, C.R.S. 6-1-1303 and 6-1-1308, ORS 646A.570, 646A.572 and 646A.578, and the Google Ads personalized advertising policy pages and the Google Business Profile attributes page. State rules on nondiscrimination, privacy and professional advertising differ from state to state, so check yours, and have a health care attorney review your notices, your intake form and your claims before they go live.

The short version

The Section 1557 notice is still required for covered entities. On October 22, 2025, a federal court vacated the parts of the 2024 rule that read sex discrimination to include gender identity, and HHS says it will not enforce them. Sexual orientation is not on the vacated list. The rest of the rule remains in force.
“Affirming” and “trained” are claims you need to be able to prove. Under the FTC’s substantiation policy, an advertiser needs a reasonable basis for objective claims before they run. Keep the records that show what the claim rests on.
Sexual orientation and transgender status are sensitive data under state privacy laws in Virginia, Colorado and Oregon. Virginia, Colorado and Oregon name them, and each requires consent before a covered business processes sensitive data.
Google Ads treats sexual orientation, transgender identification and health as sensitive interest categories. If your ad promotes services in those categories, you cannot use advertiser-curated audiences such as Customer Match or remarketing lists.
Ask on the intake form only what you will use, and say why. Make the questions optional, offer “prefer not to answer” and let patients choose how you contact them.

Section 1557: what the notice says now

Section 1557 of the Affordable Care Act bars discrimination on the basis of race, color, national origin, sex, age and disability in covered health programs. The 2024 rule at 45 CFR 92.101(a)(2) says discrimination on the basis of sex includes discrimination on the basis of sex characteristics including intersex traits, pregnancy or related conditions, sexual orientation, gender identity and sex stereotypes. The notice of nondiscrimination in 92.10(a)(1)(i) tells patients the practice does not discriminate on the basis of sex, “consistent with the scope of sex discrimination described at 92.101(a)(2)”.

On June 2, 2026, HHS published a notification of court decision at 91 FR 32887. It reports that on October 22, 2025, the U.S. District Court for the Southern District of Mississippi, in Tennessee v. Kennedy, vacated a list of provisions to the extent they expand Title IX’s definition of sex discrimination to include gender identity discrimination. The list includes 92.101(a)(2)(iv), the gender identity item, and 92.10(a)(1)(i), the sex line in the notice. The notification says OCR cannot and will not enforce the vacated provisions to that extent, and that the other provisions of the rule remain in force.

Three points follow for a practice website.

The notice itself still applies to covered entities. A practice that receives federal financial assistance, which under the 2024 rule includes Medicare Part B payments, still needs the notice of nondiscrimination and the language assistance notice. Our Section 1557 notices guide covers both.
Sexual orientation is not on the vacated list. The notification names 92.101(a)(2)(iv), gender identity. Item (iii), sexual orientation, is not among the provisions listed. How to word the sex line in your notice today is a question for your attorney.
State law can add protections. 45 CFR 92.3(d) says nothing in the rule supersedes state or local laws that provide additional protections against discrimination. Your state’s public accommodation or health care nondiscrimination law may name sexual orientation or gender identity on its own terms.

This rule has been changed by a court order since 2024 and may change again. Put a review date on the notice page and check the Federal Register before each annual review.

Claims like “affirming”, “trained” and “safe space” need support

Section 5 of the FTC Act, 15 U.S.C. 45(a), declares unfair or deceptive acts or practices unlawful. The FTC’s Policy Statement Regarding Advertising Substantiation (1984) says advertisers must have a reasonable basis for objective claims, express or implied, before the claims are disseminated, and that when an ad says what support exists, the advertiser needs at least that level of support. A practice that writes “all our staff are trained in LGBTQ-affirming care” is making an objective claim about its staff.

Sort your claims into the ones you can prove and the ones you cannot.

Training claims. Say what the training was, who took it and when. If two of five clinicians completed a named course in 2025, say that, not “our team is trained”. Keep the completion records.
Certification claims. “Certified” implies a third party assessed you against a standard. Use it only when a named body issued a certification you hold, and say which. Our guide to board-certified claims on physician bios covers the same logic for clinicians.
Badges and directory listings. A badge from an organization implies the organization judged you. Under 16 CFR 255.4, an organization’s endorsement must come from a process that fairly reflects the collective judgment of the organization. A badge you bought with a directory listing, with no review behind it, should not be presented as an endorsement.
Service claims. If a page says you offer a service, you must offer it, at the locations and to the ages the page implies. Where your state limits certain treatments for some patients, the page has to match what you can lawfully provide there.
Policy claims. “We use the name and pronouns you give us” is a promise about how staff behave. Make it true in the scheduling system, the call script and the AI front desk before you publish it.
Ownership. Google Business Profile offers an “LGBTQ+ owned” attribute. Google says adding it tells everyone the business is owned by someone of that identity. Use it only when it is true and the owner chooses to disclose it.

Sexual orientation and gender identity as sensitive data

When the practice is a HIPAA covered entity, intake answers it holds as protected health information are governed by HIPAA. Outside that, state consumer privacy laws can apply to website forms, quizzes, newsletter sign-ups and ad data. Three examples:

Virginia. Va. Code 59.1-575 defines sensitive data to include personal data revealing sexual orientation. 59.1-578(A)(5) bars a controller from processing sensitive data without the consumer’s consent. Virginia’s law exempts HIPAA covered entities as entities.
Colorado. C.R.S. 6-1-1303(24) defines sensitive data to include personal data revealing sex life or sexual orientation, and 6-1-1308(7) requires consent before processing it. Colorado’s exemption is data-level, so non-PHI data a practice holds can still be covered.
Oregon. ORS 646A.570(18)(a)(A) defines sensitive data to include data revealing sexual orientation and status as transgender or nonbinary. ORS 646A.578(2)(b) bars processing sensitive data without consent. The exemption in 646A.572(2)(b) covers protected health information handled under HIPAA, not the practice as a whole.

These laws apply only above thresholds. Oregon’s, for example, applies to a business that controls or processes the personal data of 100,000 or more consumers in a year, or 25,000 or more while earning 25 percent or more of its revenue from selling personal data (ORS 646A.572(1)(a)). A single small practice may fall below them. The thresholds and exemptions in other states differ, so check the states where your patients and website visitors live. Even below the thresholds, treat these answers as sensitive: collect them only where you need them, keep them out of marketing tools, and do not put them in a URL, a page title or an analytics event.

That last point matters for tracking. A page titled “Gender-affirming care” or a form step called “sexual orientation” can reveal both health and identity when a tracking pixel sends the URL to an ad platform. Our guide to tracking pixels on practice websites explains how to check what your tags send.

Google Ads: sensitive interest categories

Google’s personalized advertising policy lists sensitive interest categories, including Health, Sexual orientation and Transgender identification. Google’s page on sexual orientation says the category covers using someone’s sexual orientation, such as lesbian, gay, bisexual, questioning or heterosexual orientation. Its page on transgender identification gives “information about gender-affirming care” as an example.

For ads that promote products or services in these categories, Google says you can use predefined Google audiences, because sensitive signals are excluded from them, and you cannot use advertiser-curated audiences. Google lists Customer Match, your data segments (remarketing lists), audience expansion and lookalike segments as advertiser-curated. In practice:

Use keywords, location and Google’s predefined audiences. Search ads matched to what people type, such as “LGBTQ primary care near me”, do not need an audience list.
Do not upload patient lists. Apart from Google’s policy, using a patient list for marketing raises HIPAA questions. Marketing uses of PHI need the patient’s authorization under 45 CFR 164.508(a)(3), with narrow exceptions.
Do not retarget visitors of identity or health pages. A remarketing list built from those pages is an advertiser-curated audience under the policy.
Write ad text that does not assert the reader’s identity. “Primary care for LGBTQ patients” describes the service. Text that tells the reader what you think they are can feel intrusive.
Check under-18 rules. Google says users under 18 are not eligible for personalized advertising of any kind. Our guide to confidential teen health services marketing covers the rest.

Other ad platforms keep their own lists of restricted targeting. Read the current policy for each one before you build audiences.

Intake form wording

Sexual orientation and gender identity questions can help a clinician give better care. They can also put off a patient who does not see why you are asking. A few rules make the form work for both.

Ask only where the answer will be used. If no clinician reads the answer, leave the question out. Our guide to online patient intake forms covers where answers travel once submitted.
Say why you ask. One sentence works: “Your answers help your clinician give you the right care. They are part of your medical record and are not used for marketing.” Make sure that sentence is true.
Make each question optional and include “prefer not to answer” and a free-text option.
Separate the name used from the legal or insurance name. Insurance claims may need the name on the card, while staff can use the name the patient gives. Say which name goes where.
Ask how and where to contact the patient. Under 45 CFR 164.522(b)(1)(i), a covered health care provider must permit patients to request, and must accommodate reasonable requests, to receive communications by alternative means or at alternative locations. A patient who is not out to their household may need texts to a personal phone instead of mail to home.
Keep these fields out of the contact form. A general website contact form is the wrong place for identity or health details. Route those questions to the intake process, under the agreements that cover it.

Questions to ask

Do we receive federal financial assistance, including Medicare Part B, so that Section 1557 applies to us?
Has our attorney reviewed the sex line in our notice of nondiscrimination since the 2026 HHS notification?
Does our state have a public accommodation or health care law that names sexual orientation or gender identity?
For each claim on the site, what record proves it, and who keeps that record?
Do any badges on the site come from an organization that reviewed us, or from a paid listing?
Which state privacy laws reach our website data, and do we pass their thresholds?
Do any of our tags send page URLs or form steps about identity or health to an ad platform?
Are any of our Google Ads campaigns using Customer Match, remarketing or lookalike audiences for these services?

Use and avoid

Training. Use: “Dr. [Name] and our front desk lead completed [course name] in [month, year].” Avoid: “Our whole team is trained in affirming care” unless each staff member completed it and you hold the records.
Certification. Use: “[Organization] lists us in its provider directory.” Avoid: “Certified LGBTQ-friendly” when no body certified you.
Services. Use: “We provide primary care, sexual health care and PrEP visits for adults.” Avoid: a list of services you refer out without saying so.
Welcome. Use: “We use the name and pronouns you give us, and you can update them at any visit.” Avoid: “a judgment-free zone for everyone” if nothing in your process backs it.
Ad text. Use: “Primary care for LGBTQ patients in [Town].” Avoid: “Are you gay? Book today.”
Intake. Use: “Optional. Your answer helps your clinician. Prefer not to answer is fine.” Avoid: required identity fields with no explanation.

An illustration

This example is invented. [Practice name], a family practice in [Town], wants more LGBTQ patients. Its first draft homepage says “Certified LGBTQ-affirming. All staff trained.” It has a badge from a paid directory, a remarketing campaign aimed at visitors of its new “Gender-affirming care” page, and an intake form with required questions on sexual orientation and gender identity.

The office manager checks each item. No body certified the practice, so “certified” comes out. Three of eight staff took a named online course; the page now says who took it and when. The badge stays in the footer with the words “Listed in [directory name]”, without the word “endorsed”. The remarketing campaign is paused, because it relies on an advertiser-curated audience for a sensitive interest category, and a search campaign on location and keywords replaces it. The form questions become optional, with “prefer not to answer” and a line on why they are asked. The page title changes, and the pixel is removed from the intake steps. The attorney reviews the Section 1557 notice wording before launch.

Checklist

Section 1557 notice of nondiscrimination and language notice in place, if you are a covered entity, with a review date.
Sex line in the notice reviewed by an attorney after the June 2026 HHS notification.
State nondiscrimination law checked.
Each claim about training, certification, services and policies matched to a record.
Badges and directory listings described as what they are.
Google Business Profile identity attributes used only when true.
State privacy law thresholds checked for each state your patients and visitors live in.
No identity or health terms in page titles, URLs or events sent to ad platforms.
No Customer Match, remarketing or lookalike audiences for these services in Google Ads.
Intake questions optional, explained, with “prefer not to answer” and contact preferences.
Staff, scripts and the AI front desk use the name and pronouns the patient gives.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For inclusive care pages, we write claims you can support, set up intake forms that ask only what is needed, keep identity and health terms out of ad tracking, and build Google Ads campaigns without sensitive audience lists. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Do we still need a Section 1557 nondiscrimination notice?

If you are a covered entity, yes. HHS’s June 2026 notification at 91 FR 32887 says a court vacated certain provisions to the extent they expand sex discrimination to include gender identity, and that the other provisions of the rule remain in force. The notice requirement in 45 CFR 92.10 remains. How to word the sex line is a question for your attorney.

Can we call our practice LGBTQ-friendly?

You can describe what you actually do. The FTC’s substantiation policy expects a reasonable basis for objective claims before they run, so tie the words to facts: who completed which training, which services you offer, and how staff handle names and pronouns. Avoid “certified” unless a named body certified you.

Can we target LGBTQ audiences in Google Ads?

Google lists sexual orientation, transgender identification and health as sensitive interest categories. For ads promoting services in them, Google allows its predefined audiences and keyword and location targeting, and does not allow advertiser-curated audiences such as Customer Match, remarketing lists or lookalike segments.

Is sexual orientation sensitive data under state law?

In Virginia, Colorado and Oregon, yes. All three include sexual orientation in their definitions of sensitive data, Oregon also names status as transgender or nonbinary, and each requires consent before processing it. Each law has its own thresholds and HIPAA exemption, so check whether it reaches your practice.

Should our intake form ask about sexual orientation and gender identity?

Ask only if a clinician will use the answer. Make the questions optional, offer “prefer not to answer”, say why you ask, and let patients choose how you contact them. Keep these fields out of general contact forms and out of any data sent to ad platforms.

Sources

More in Practice websites, privacy and tracking

LGBTQ-inclusive practice marketing: affirming care claims, Section 1557, sensitive data and ad targeting