Patient portal and app messages: when HIPAA treats them as marketing

A patient portal or practice app used to carry lab results and appointment confirmations. Today it often carries much more: refill reminders, care plan nudges, newsletters, banners for new services, satisfaction surveys and push notifications to the patient’s phone. Because every one of those messages reaches a patient who is logged in as a patient, it is worth knowing which of them HIPAA treats as care and which it treats as marketing.

The short answer is that the channel does not decide it. A portal message is judged by the same HIPAA marketing definition as a letter, an email or a phone call. What decides it is what the message encourages the patient to do, whose product or service it describes, and whether anyone pays the practice to send it. This guide applies that test to the messages practices actually send through portals and apps, and covers the parts that are specific to these channels: banners and sponsored content, tracking inside logged-in pages, and what shows up on a lock screen. For the full walk through of the definition and the authorization form, see our guide to HIPAA marketing rules for medical practices. When a patient wants to move the conversation to WhatsApp, read our guide to WhatsApp and messaging apps for medical practices. For reminders sent through the browser instead of the portal, see our guide to web push notifications for practices. Newsletters sent by email rather than through the portal are covered in the newsletter section of our guide to email marketing for practices.

The test, in one paragraph

Under 45 CFR 164.501, marketing means “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” Under 45 CFR 164.508(a)(3), a covered entity must obtain the patient’s authorization for any use or disclosure of protected health information for marketing. There are only two exceptions to that authorization requirement: a face-to-face communication by the covered entity to the individual, and a promotional gift of nominal value provided by the covered entity. A portal message, an in-app card and a push notification are not face to face, so neither exception helps with them.

The HHS Marketing guidance page explains the purpose of the structure: the rule “distinguishes marketing communications from those communications about goods and services that are essential for quality health care.” That is why the definition comes with exclusions. Most of what a practice sends through its portal falls inside those exclusions. The work is in noticing the messages that do not.

What the definition excludes

The same definition in 45 CFR 164.501 says marketing does not include a communication made for these purposes.

1. Refill reminders and current prescriptions. A refill reminder, or another communication about a drug or biologic currently being prescribed for the patient, is not marketing, as long as any financial remuneration the practice receives for making it is reasonably related to the practice’s cost of making the communication.
2. Treatment. A communication for the treatment of the patient by a health care provider, including case management or care coordination, or to direct or recommend alternative treatments, therapies, health care providers or settings of care.
3. The practice’s own health-related products and services. A communication that describes a health-related product or service, or payment for it, that the practice itself provides.
4. Care coordination and treatment alternatives. Case management, care coordination, contacting patients with information about treatment alternatives, and related functions, to the extent these do not already count as treatment.

Exclusions two to four carry a condition. They apply “except where the covered entity receives financial remuneration in exchange for making the communication.” That condition is the most important sentence in this guide, and it has its own section below.

Separately, 45 CFR 164.506(c)(1) lets a covered entity use or disclose protected health information for its own treatment, payment and health care operations. That is the permission that lets a practice use its patient list to send care messages through a portal in the first place. It does not turn a marketing message into a treatment message.

Sorting the messages a portal or app usually sends

Here is how common portal and app messages tend to sort under the definition. These are general patterns, not conclusions about any particular message.

• Results, visit summaries and care plans. These are communications about the patient’s own care. They are treatment, not marketing.
• Appointment reminders. HHS answers this in its FAQs: appointment reminders are considered part of treatment of an individual and can be made without an authorization.
• Refill reminders for current prescriptions. Excluded from marketing, as long as any payment you receive for sending them is reasonably related to your cost of sending them.
• Recall and follow-up nudges. A message telling a patient they are due for a visit or a follow-up with you is about their care and your own services. Our guide to patient recall systems covers recall in detail.
• Announcements of your own services. A new provider, new hours, a new location, or a new treatment the practice itself provides generally fall within the own services exclusion.
• A third party’s product or service. A message encouraging patients to buy or use something another business provides, such as a partner’s product or an outside program, is marketing and needs authorization.
• Anything a third party pays you to send. Even a message that would otherwise be treatment or an own services announcement becomes marketing when the practice receives financial remuneration for sending it.

Two kinds of message need more care than they first appear to. The first is a mixed message, such as a care reminder with a promotional offer added at the bottom. The definition looks at what the communication encourages, so a promotional add-on can change how the whole message is judged. Keep care messages and promotional messages separate. The second is a message about a product the practice sells that may not be health related. Whether it fits the own services exclusion depends on whether it is a health-related product or service, and that is a question to put to counsel rather than assume.

If the practice participates in a Medicare accountable care organization, a portal message that describes the ACO or the Shared Savings Program can also be ACO marketing under CMS rules, which is a separate test from the HIPAA one. Our guide to ACO marketing rules covers that test and the notice CMS requires.

Financial remuneration: the payment that changes the answer

Under paragraph (3) of the marketing definition in 45 CFR 164.501, financial remuneration means “direct or indirect payment from or on behalf of a third party whose product or service is being described.” Payment for treating a patient does not count. Indirect payment counts, so a payment routed through an intermediary on behalf of the company whose product is described is still remuneration.

In a portal, this matters because portals and apps are a natural place for sponsorship: a manufacturer’s education program, a partner’s offer, a co-branded campaign. If the company whose product or service is described pays the practice, directly or indirectly, to send the message, the treatment and own services exclusions do not apply. The message is marketing, and under 45 CFR 164.508(a)(3)(ii) the authorization must state that remuneration is involved.

The refill reminder exclusion has its own rule. Payment is allowed only to the extent it is reasonably related to the practice’s cost of making the communication. A payment beyond that cost takes the reminder out of the exclusion.

If you sell or share patient information with a third party in exchange for payment, separate rules on sale of protected health information apply as well. Our HIPAA marketing rules guide covers those.

Banners, tiles and sponsored content inside the portal

Portals and apps often have space for content beyond messages: a banner on the home screen, a tile in a news feed, a card under the appointment list. The marketing definition is about communications, not about message boxes, so the same sorting applies to these spaces. An announcement of your own new service in a banner is judged like an own services message. A banner promoting a third party’s product, shown to patients because they are your patients, should be treated as marketing.

Ask your portal or app vendor three questions before anything other than your own content appears in those spaces. Who decides what content shows there. Whether any content is paid for by a third party, and who receives that payment. And whether any patient information is used to choose who sees what. A vendor that handles protected health information for you is generally your business associate, and our guide to whether marketing agencies need a BAA explains what that relationship requires.

Tracking inside portals and apps

The less visible marketing risk in a portal is not a message at all. It is the tracking code that may run on logged-in pages or inside an app. The HHS Office for Civil Rights bulletin on online tracking technologies says that tracking technologies on user-authenticated webpages, which require a user to log in, “such as a patient or health plan beneficiary portal,” generally have access to protected health information. It gives examples including IP address, medical record number, appointment dates, and potentially diagnosis, treatment, prescription and billing information.

The bulletin says the same about mobile apps a regulated entity offers to individuals: the information the app collects generally is protected health information, and the HIPAA Rules apply to any of it the app uses or discloses, including disclosures to a tracking technology vendor. It also says that disclosures of protected health information to tracking technology vendors for marketing purposes, without individuals’ HIPAA-compliant authorizations, would be impermissible disclosures.

The bulletin notes that on June 20, 2024, a federal district court vacated part of the guidance. The vacated part concerns certain tracking on unauthenticated public webpages. It does not concern logged-in portal pages. Our guide to tracking pixels on practice websites explains the ruling and a practical setup.

For a practice, the practical rule is simple. No advertising or social media tags on portal login pages, logged-in pages or inside a patient app, unless counsel has reviewed the setup and the vendor relationship. Ask the vendor what analytics the portal or app runs, and who receives that data.

Push notifications and the lock screen

A push notification or a portal alert by text or email is a disclosure to the patient. The minimum necessary standard does not apply to disclosures made to the individual, under 45 CFR 164.502(b)(2)(ii). That does not mean anything goes. Under 45 CFR 164.530(c), a covered entity must have appropriate safeguards to protect the privacy of protected health information and must reasonably safeguard it to limit incidental uses or disclosures.

A phone screen is a place where incidental disclosure happens: a notification preview appears while the phone sits on a table, or a family member uses the same tablet. A notification that says the patient has a new message in the portal, without the content, is a reasonable default. The detail can wait behind the login.

Patients can also ask for confidential communications. Under 45 CFR 164.522(b), a covered health care provider must permit patients to request, and must accommodate reasonable requests, to receive communications by alternative means or at alternative locations. A provider may require the request in writing and may ask for an alternative address or method of contact, but may not require an explanation for the request. A patient who asks for no push notifications, or for portal only contact, is making that kind of request. Make sure the front desk knows where to record it and that the portal settings actually follow it.

Texts and emails that point to the portal

Many portal messages arrive with a text or email that says a new message is waiting. Those texts and emails bring their own rules on top of HIPAA. Texts fall under the FCC rules covered in our guide to text message appointment reminders, and promotional emails fall under the rules covered in our guide to healthcare email marketing. A notification that only says a message is waiting is the simplest to defend under all of them.

When you do need authorization

If a portal message is marketing, the practice needs the patient’s written authorization before using protected health information to send it. The authorization must contain the core elements and statements in 45 CFR 164.508(c), and if a third party pays the practice, it must say that remuneration is involved. Under 45 CFR 164.508(b)(5), a patient may revoke an authorization at any time in writing, except to the extent the practice has already acted in reliance on it.

In practice, that leads to a clean setup inside the portal: clinical notifications on one side, and a separate, clearly labeled marketing preference on the other, which is off unless the patient has signed an authorization. Keep the signed authorizations and any revocations on file. Under 45 CFR 164.508(b)(6) and 164.530(j), signed authorizations are documents the practice must retain.

Illustration: three messages from one practice

Illustration, hypothetical and simplified, to show how the definition works rather than to give a legal conclusion. A dermatology practice uses its portal for three messages in the same month.

• Message one. A reminder that the patient is due for a skin check, with a link to book. This is about the patient’s care and the practice’s own services. No authorization is needed.
• Message two. An announcement that the practice now offers a procedure it performs in house. This describes the practice’s own health-related service. No authorization is needed, as long as no third party pays for the message.
• Message three. A message about a sunscreen brand, sent because the brand pays the practice a fee for each campaign. A third party pays for the communication and the message describes its product, so this is marketing. It needs each patient’s authorization, and the authorization must state that the practice is paid.

If the same sunscreen note appeared at the bottom of message one, the reminder itself would now carry a paid third party promotion. That is why the safest habit is to keep paid or third party content out of care messages entirely.

A short checklist before a portal message goes out

• Is it about the patient’s own care, or about a service the practice itself provides?
• Does it describe or promote anything a third party provides?
• Is anyone other than the patient paying the practice, directly or indirectly, in connection with it?
• If it is a refill reminder and payment is involved, is the payment reasonably related to the cost of sending it?
• Is it a care message with a promotional add-on that should be split out?
• Does the notification preview show only that a message is waiting?
• Has the patient asked for confidential communications that this message must follow?
• Are any advertising or analytics tags running on the page or screen where it will be read?

How we help

We are a marketing studio, not a law firm, and we do not build or configure patient portals. We work on the public side. Our medical website design work keeps advertising tags off appointment, intake and portal login pages, and our healthcare SEO work helps patients find the pages that describe your own services, which is where promotion belongs, rather than inside the portal. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We do not promise rankings, leads or results.

Frequently asked questions

Sources

• 45 CFR 164.501: Definitions (marketing, financial remuneration, treatment)
• 45 CFR 164.502: Uses and disclosures, general rules (minimum necessary exceptions)
• 45 CFR 164.506: Uses and disclosures for treatment, payment and health care operations
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.522: Rights to request privacy protection (confidential communications)
• 45 CFR 164.530: Administrative requirements (safeguards, documentation)
• HHS: Marketing (content last reviewed July 26, 2013)
• HHS FAQ: Are appointment reminders allowed under the HIPAA Privacy Rule without authorizations? (content last reviewed December 28, 2022)
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (content last reviewed June 26, 2024)

More in Phones, front desk and patient messages