Uploading patient lists to ad platforms: customer match, lookalike audiences and HIPAA

An ad platform offers a simple pitch: upload a list of your customers, and it will show your ads to those people, or find new people who look like them. For a shop, that list is a customer file. For a medical practice, it is a list of patients, and the act of uploading it tells a technology company who receives care from you.

This guide covers one step only: uploading a patient list, or a list built from patient records, to an ad platform for targeting, exclusion or lookalike audiences. Pixels and tags on your website are covered in our guide to tracking pixels on practice websites, the wider HIPAA marketing rules are in our HIPAA marketing rules guide, and Meta’s ad rules for health are in our guide to Facebook and Instagram ads for medical practices. For patient lists and audience signals in Google’s all-channel campaign type, see our guide to Performance Max for healthcare advertisers. For the audience limits in Google’s image and video campaigns, see our guide to Demand Gen campaigns for healthcare advertisers. Retargeting website visitors on Google and Meta is covered in our guide to healthcare remarketing ads.

The short version

• A list of your patients’ names, emails or phone numbers is individually identifiable health information when it relates to the provision of health care to them (45 CFR 160.103). In a covered practice’s hands, that is protected health information.
• Uploading it is a disclosure. A covered entity may disclose protected health information only as the Privacy Rule permits (45 CFR 164.502(a)). Without a permitted path, it needs each patient’s written authorization (45 CFR 164.508(a)(1)).
• Hashing the list before upload does not make it de-identified. The HIPAA safe harbor requires removing names, phone numbers and email addresses, and a code may stand in for them only if it is not derived from information about the person (45 CFR 164.514(b)(2) and (c)(1)).
• Google’s Personalized advertising policy lists health as a sensitive interest category, and advertisers promoting in those categories cannot use advertiser-curated audiences, including Customer Match and lookalike segments.
• Meta’s Business Tools Terms bar sharing data that includes or is based on health information, and bar custom audience names and criteria based on it.
• Our recommendation for practices: do not upload patient lists to ad platforms. Reach your patients through your own channels, and reach new patients with broad or contextual targeting.

Why a patient list is health information

HIPAA defines individually identifiable health information as information, including demographic information, created or received by a health care provider that relates to an individual’s health, to the provision of health care to the individual, or to payment for that care, and that identifies the individual or could reasonably be used to identify them (45 CFR 160.103). A name or email address on its own says nothing about health. The same name on a list exported from a practice’s patient records says that this person received care from that practice.

The list can say more than that. A list of patients seen for a particular service, a list of patients overdue for a screening, or a list from a specialty practice whose name reveals the condition tells the recipient something about each person’s health. A narrower list carries more risk, not less.

Is the upload a permitted disclosure?

A covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires (45 CFR 164.502(a)). Two paths come up when practices ask about ad platforms.

The first is a business associate. A vendor that creates, receives, maintains or transmits protected health information on a covered entity’s behalf for a regulated function is a business associate (45 CFR 160.103), and the practice may disclose to it with satisfactory assurances, documented in a business associate agreement (45 CFR 164.502(e)). We found no published offer from the major ad platforms to sign one for advertising audiences. If a platform will not sign, that path is closed. Our guide to business associate agreements with marketing vendors covers what to confirm.

The second is authorization. Except where the rule permits a use or disclosure without one, a covered entity needs an authorization that meets 45 CFR 164.508 (45 CFR 164.508(a)(1)). If the ads promote a third party’s product or service, the communication is marketing and needs authorization under 45 CFR 164.508(a)(3), and if a third party pays the practice, the authorization must say so.

HHS OCR’s bulletin on online tracking technologies takes the same view of tracking vendors: disclosures of protected health information to tracking technology vendors for marketing purposes, without HIPAA authorizations, are impermissible disclosures. A federal court vacated one part of that bulletin in 2024, the part about unauthenticated web pages; our tracking pixels guide explains what it covers. A patient list exported from your records is not an unauthenticated page visit.

Note what the marketing definition does not change. HIPAA excludes from “marketing” a communication that describes a health-related service the covered entity itself provides, unless a third party pays for it (45 CFR 164.501). That exclusion tells you whether an authorization is needed for the message. It does not make it permissible to hand the list to a company that is not your business associate.

Why hashing is not de-identification

Ad platforms ask you to hash contact details before upload, or hash them in the browser for you. Meta’s Business Tools Terms say contact information such as names, emails and phone numbers is used for matching, and must be hashed in the manner Meta specifies (Business Tools Terms, Section 1). The platform then matches the hashes against its own users. That is the point of the upload: to identify the people on the list.

HIPAA offers two ways to de-identify. The expert determination method needs a qualified person to find that the risk of identification by an anticipated recipient is very small, and to document it (45 CFR 164.514(b)(1)). The safe harbor method needs the removal of names, telephone numbers, email addresses and any other unique identifying number, characteristic or code (45 CFR 164.514(b)(2)(i)(A), (D), (F) and (R)). A re-identification code is allowed only if it is not derived from or related to information about the individual (45 CFR 164.514(c)(1)). A hash of an email address is derived from the email address, and the recipient is matching it to a person. It does not meet either method.

What the platforms’ own rules say

Platform policies change, so check them on the day you plan a campaign. As shown on October 31, 2026:

• Google’s Personalized advertising policy lists health among its sensitive interest categories. Advertisers promoting products and services in those categories cannot use advertiser-curated audiences, which the policy lists as Customer Match, your data segments, audience expansion and lookalike segments.
• Google’s Customer Match policy allows only customer information collected in a first-party context, requires a privacy policy that discloses sharing with third parties for services, and does not allow ad content that implies knowledge of sensitive information about customers.
• Meta’s Business Tools Terms (effective November 3, 2025) say you will not share data that includes or is based on, directly or otherwise, health information, and that the names and criteria for custom audiences must not reflect, imply or be based on it.

These are contract and policy terms, not law. They matter because breaking them can cost you the account, and because a practice that uploads a patient list against the platform’s own terms has a hard time arguing it acted with care.

Exclusion lists and lookalike audiences

A practice may ask whether an upload is safer when it is used only to exclude current patients, so ads reach new people. The Privacy Rule looks at the disclosure, not at how the recipient uses the list afterwards. An exclusion list still tells the platform who your patients are, so the same analysis applies.

Lookalike audiences work the same way. The platform needs your list to build the model, so the upload happens either way. The fact that the ads then reach strangers does not undo the disclosure of the seed list.

State consumer health data laws

State law can reach practices and data that HIPAA does not. Washington’s My Health My Data Act bars a regulated entity from sharing consumer health data without consent that is separate and distinct from the consent to collect it, unless the sharing is necessary to provide a product or service the consumer requested (RCW 19.373.030(1)(b)). The Act exempts protected health information under HIPAA (RCW 19.373.100(1)(a)(i)), so it applies chiefly to cash-pay businesses outside HIPAA, such as a med spa that is not a covered entity, and for data that is not protected health information. Our guides to the Washington My Health My Data Act and state consumer health data laws cover the details.

A practice outside HIPAA is still subject to the FTC Act’s ban on unfair or deceptive acts or practices (15 USC 45(a)(1)). If your privacy notice tells clients their information stays with you, uploading their contact details to an ad platform contradicts it.

What to do instead

No federal rule says how a practice should reach its patients. We recommend:

• Reach existing patients through your own channels: email and text messages they agreed to receive, covered in our guides to healthcare email marketing and business texting rules, and recall messages from your own system, covered in our patient recall guide.
• Reach new patients with keyword, location and contextual targeting that does not start from your patient records.
• Accept that existing patients may also see your ads. That is the cost of not disclosing the list.
• If you still want an upload, get a health care attorney’s written view first, and plan for a signed HIPAA authorization from each patient on the list.

Questions to ask your marketing vendor

• Do you upload any list built from our patient records to an ad platform, including for exclusion or lookalike audiences?
• Do your campaign settings use Customer Match, custom audiences or similar features for our account?
• Has the ad platform signed a business associate agreement with us, and what does it cover?
• Who in your team has access to exports from our practice management or scheduling system?
• Does our privacy notice match what you do with patient and client data?

Use and avoid

• Use: Keyword and location targeting for a new patient campaign.
• Avoid: Uploading an export of last year’s patients to build a lookalike audience.
• Use: An email to patients who agreed to receive it, sent from your own system.
• Avoid: A Customer Match list of patients overdue for a screening.
• Use: “We hashed it, but it is still patient information.”
• Avoid: “The list is hashed, so it is de-identified.”

An illustration

This example is invented. [Practice name], an independent dermatology practice, hires a new ad agency. In the first meeting, the agency asks for a spreadsheet of patient emails from the last two years to build a lookalike audience and to exclude current patients from a new cosmetic campaign. The agency says the file will be hashed before upload.

The practice manager asks the agency which business associate agreement covers the upload. The agency has one with the practice, but the ad platform does not. The manager declines the file. The agency builds the campaign on location and keyword targeting instead, and the practice sends its own email about the new service to patients who signed up for its newsletter. The manager also adds a line to the agency contract that no list built from patient records goes to any ad platform without the practice’s written approval.

Checklist

• No patient list, or list built from patient records, uploaded to any ad platform.
• Customer Match, custom audience and similar features checked off in each ad account.
• Agency contract says no patient data goes to ad platforms without written approval.
• Hashing not treated as de-identification.
• Existing patients reached through your own email, text and recall channels with their agreement.
• Privacy notice matches what you and your vendors do.
• State consumer health data law checked if you are a cash-pay business outside HIPAA.
• Attorney review before any exception.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For ad audiences, that means new patient campaigns built on keyword, location and contextual targeting, with no patient lists uploaded to ad platforms. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 160.103: Definitions (individually identifiable health information, business associate)
• 45 CFR 164.501: Definitions (marketing)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.514: Other requirements relating to uses and disclosures (de-identification)
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• Google Ads: Restricted targeting in Personalized advertising
• Google Ads: Customer Match policy
• Meta Business Tools Terms
• RCW 19.373: Washington My Health My Data Act
• 15 USC 45: Unfair methods of competition and unfair or deceptive acts or practices

More in Healthcare advertising guides