Patient satisfaction surveys: running them under HIPAA and using the results in ads

A satisfaction survey looks like the safest marketing asset a practice can have. The patients wrote the answers, the practice only counted them, and “98 percent of our patients would recommend us” reads well on a homepage or in a search ad. The trouble sits on both ends. Sending the survey uses patient information and, if it goes by text or automated call, phone consent rules. Quoting the result turns a private quality tool into an advertising claim the practice has to be able to prove, and the way the survey was sent can make the number misleading before anyone reads it.

This guide covers where a survey fits under HIPAA, why a sales pitch inside a survey changes the analysis, the consent rules for survey texts and calls, how to quote a result so it holds up, and how a survey can turn into review gating. Government star ratings such as the CMS hospital stars are covered in our guide to hospital star ratings in ads, and success rates and outcome numbers in our guide to success rates and outcome claims. How to ask for public reviews is in our guide to patient review requests and replies.

The short version

• A survey about the care you gave is part of running the practice. The HIPAA definition of health care operations includes quality assessment and improvement activities, and a covered entity may use patient information for its own operations without an authorization under 45 CFR 164.506(c)(1).
• Keep selling out of the survey. If the survey message promotes a product or service, check it against the HIPAA marketing definition. Third-party promotion, or any promotion the practice is paid for, needs a written authorization under 45 CFR 164.508(a)(3).
• Texts and automated calls need consent. 47 CFR 64.1200(a)(1) requires prior express consent for autodialed or prerecorded calls to mobile numbers, and the rule applies to texts. Adding an advertisement raises the bar to prior express written consent unless the HIPAA health care message exception applies.
• A quoted result is an objective claim. Under the FTC Policy Statement Regarding Advertising Substantiation, you need a reasonable basis for it before the ad runs.
• Show what the number is. Print the question, the number of responses and the survey period next to the result, so the reader can judge it.
• Do not use the survey as a filter for public reviews. Ask each patient for a review whatever their survey answer, and never tie a reward to a positive review.

Where a satisfaction survey fits under HIPAA

A list of patients to survey, with their names, contact details and visit dates, is protected health information when a covered practice holds it, because 45 CFR 160.103 defines health information to include information that relates to the provision of health care to an individual. The question is which HIPAA permission covers sending the survey.

The definition of health care operations in 45 CFR 164.501 starts with “conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines”, provided that obtaining generalizable knowledge is not the primary purpose. It also covers evaluating practitioner and provider performance. The definition does not name satisfaction surveys. In our reading, a survey a practice sends to learn how patients experienced their visit and to fix what went wrong fits the first item, and under 45 CFR 164.506(c)(1) a covered entity may use or disclose protected health information for its own treatment, payment or health care operations. Confirm the reading with your privacy officer, and note it in your HIPAA policies.

Three practical consequences follow. First, a survey tool or vendor that receives patient names and contact details on the practice’s behalf is a business associate under the 45 CFR 160.103 definition. Under 45 CFR 164.502(e), the practice may share the list only after obtaining satisfactory assurance that the vendor will safeguard it, which is done through a business associate agreement. Second, 45 CFR 164.502(b) requires reasonable efforts to limit protected health information to the minimum necessary for the purpose, so send the vendor what the survey needs, which is a name, a contact channel and a visit date, not diagnoses or procedure codes. Third, a survey that asks about a condition makes the replies themselves health information, so keep questions about the service, the wait, the staff and the explanation of care, and leave clinical detail to the clinical record.

When a survey turns into marketing

Under 45 CFR 164.501, marketing means a communication about a product or service that encourages recipients to purchase or use it. The definition then lists exceptions. A communication made for treatment or health care operations is not marketing if it describes a health-related product or service provided by the covered entity itself, or recommends alternative treatments, therapies, providers or settings of care, unless the covered entity receives financial remuneration in exchange for making it.

So a line at the end of a survey that says “we now offer evening hours” or “ask us about our new physical therapy service” describes the practice’s own services and can fall within the exception, as long as no third party pays for it. A survey that ends with a coupon from a supplement maker, a partner spa or a device company is different. Under 45 CFR 164.508(a)(3), a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, and if the marketing involves financial remuneration from a third party, the authorization must say so. The only exceptions in that paragraph are face-to-face communications and promotional gifts of nominal value.

The cleaner path is to keep the survey a survey. Put news about your services in a separate message that goes to people who have agreed to receive it, and keep sponsor content out of anything that goes to a patient list.

Consent for survey texts and automated calls

Under 47 CFR 64.1200(a)(1)(iii), no one may make a call using an automatic telephone dialing system or an artificial or prerecorded voice to a mobile number, other than for emergency purposes or with the prior express consent of the called party. Paragraph (a)(10) of the same rule refers to calls or text messages made under paragraphs (a)(1) through (3), so these consent rules reach texts. A survey text sent by a platform to a list of patient mobile numbers is the clearest case for checking consent. A staff member calling patients one by one by hand is outside this paragraph.

If the survey message includes or introduces an advertisement, paragraph (a)(2) applies instead: autodialed or prerecorded calls that include an advertisement or constitute telemarketing need the prior express written consent of the called party, except for a call that delivers a “health care” message made by or on behalf of a covered entity or its business associate as HIPAA defines them. That is one more reason to keep promotions out of the survey message.

The FCC also has a narrower exemption for healthcare calls and texts that are free to the patient, in 47 CFR 64.1200(a)(9)(iv). It lists its purposes: appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications and home healthcare instructions. A satisfaction survey is not on that list, so do not rely on that exemption for it.

Patients can say no. Under 47 CFR 64.1200(a)(10), a reply of “stop”, “quit”, “end”, “revoke”, “opt out”, “cancel” or “unsubscribe” to a text is a reasonable way to revoke consent, the caller may not designate an exclusive means to revoke, and revocation requests must be honored within a reasonable time not to exceed ten business days. Your survey tool needs to feed those replies into the same opt-out list your reminders use.

Email surveys are under CAN-SPAM only to the extent they are commercial. 15 U.S.C. 7702 defines a commercial electronic mail message by its primary purpose, the commercial advertisement or promotion of a product or service, and treats transactional or relationship messages separately. A plain survey email is not built to sell. An email whose main purpose is a promotion, with a survey link at the bottom is, and then 15 U.S.C. 7704 requires an opt-out mechanism and a valid physical postal address, along with the other requirements of that section.

Quoting a result in an ad

Section 5 of the FTC Act, 15 U.S.C. 45(a)(1), declares deceptive acts or practices in commerce unlawful. The FTC Policy Statement Regarding Advertising Substantiation, dated November 23, 1984, says advertisers must have a reasonable basis for objective claims before the claims are disseminated, and that when an ad states its level of support, the advertiser is expected to have at least that level. “98 percent of patients would recommend us” is an objective claim, and it states its own support: a measurement of patients.

So before a number goes in an ad, check four things against your survey records:

• Who answered. “Of patients” reads as patients in general. If the number comes from the people who chose to answer, say “of patients who answered our survey”.
• The count. A result from 40 responses and one from 4,000 do not carry the same weight, and the reader cannot tell unless you print the count. These figures are invented to show the point.
• When. A result from a survey period two years ago describes the practice two years ago. Print the period and replace the number when it ages.
• What was asked. “Would you recommend us to a friend or family member?” and “Were you satisfied with your visit?” are different questions. Quote the result for the question that was asked, in its own words.

The FTC Policy Statement on Deception adds two points. The FTC looks at the net impression of the whole ad, and an ad can mislead through what it leaves out. A satisfaction figure placed next to a procedure name and a before-and-after headline can read as a statement about results, which the survey did not measure. Keep a satisfaction figure apart from outcome claims, and see our outcome claims guide before you put a result number in an ad.

No federal rule tells a practice to print the response count and the survey dates. We recommend it because it is the shortest way to make the claim match the evidence: “[X] percent of [number] patients who answered our [month and year] to [month and year] survey said they would recommend [Practice name].” Keep a dated file for each published figure with the survey questions, the send method, the response count, the calculation and the ad copy it supports, with counts and no patient names.

Google applies its own rules on top. The Google Ads Misrepresentation policy covers ads that make claims that are unrealistic or that deceive users. A survey figure in an ad, a sitelink or an asset is a claim Google can review, so the landing page should carry the same figure with the same count and dates.

Surveys, reviews and gating

A survey becomes a problem when it decides who gets asked for a public review. The pattern looks harmless: ask “How did we do?”, send people who answer with four or five stars to a review site, and send the rest to a private feedback form. The Google Maps user contributed content policy says merchants may not “discourage or prohibit negative reviews, or selectively solicit positive reviews from customers”. The same policy bars offering incentives such as payment, discounts or free services for posting a review.

The FTC rules point the same way. Under 16 CFR 255.2(d), in procuring, suppressing, boosting, organizing or publishing consumer reviews, advertisers should not take actions that have the effect of distorting or otherwise misrepresenting what consumers think of their products. Under 16 CFR 465.4, a business may not provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, reviews expressing a particular sentiment. A raffle entry offered only to patients who leave a five-star review is the plainest example.

Part 465 also covers what you show on your own site. 16 CFR 465.1(d) defines a consumer review as an evaluation published to a website or platform dedicated in whole or in part to receiving and displaying such evaluations, and says ratings count even with no text. If you publish survey answers as a ratings page, 16 CFR 465.7(b) makes it unlawful to misrepresent that the reviews shown represent all or nearly all of those submitted while reviews are being suppressed based on their ratings or negative sentiment. Withholding a review is not suppression under that paragraph when you apply criteria equally to all reviews regardless of sentiment, such as content that is defamatory, harassing or obscene, the personal information of another person, content that is clearly false, a review you reasonably believe is fake, or one that is unrelated to your services. A satisfaction page that shows only the happy comments is the pattern to avoid.

Questions to ask before a survey result goes in an ad

• Which HIPAA permission covers sending the survey, and is it written into our policies?
• Does the survey vendor have a signed business associate agreement with us?
• Does the survey message promote anything, and if so, whose product, and is anyone paying us?
• Do we have the consent our send method needs for each number on the list?
• Do STOP replies and other opt-outs reach our master opt-out list?
• Which question does the figure come from, what was the response count, and over what dates?
• Does the ad wording match that question and that group of patients?
• Is the public review request sent to each patient, whatever their survey answer?

Use and avoid

• Use: “[X] percent of [number] patients who answered our [period] survey said they would recommend us.” Avoid: “98 percent of patients love us.”
• Use: a survey that asks about the visit, the wait and the explanation of care. Avoid: questions about the patient’s condition.
• Use: a separate, consented message for news about your services. Avoid: a partner’s coupon at the end of a survey.
• Use: one review request sent to each patient. Avoid: a review link shown only after a high score.
• Use: a figure that is replaced when it ages. Avoid: a figure with no date that stays on the site for years.
• Use: a satisfaction figure on its own. Avoid: a satisfaction figure placed next to outcome or results wording.

An illustration

This example is invented. [Practice name], a chiropractic office in [Town], sends a text after each visit through its scheduling platform: “Thanks for visiting [Practice name]. How likely are you to recommend us? Reply 0 to 10. Reply STOP to opt out.” Patients agreed at intake, in writing, to receive texts about their care and the practice’s services. Patients who reply 9 or 10 get a second text with the Google review link.

The office manager reviews the setup before a new ad campaign that will say “97 percent of patients recommend us”. Three things change. The review link now goes in a separate text to each patient a day after the visit, whatever the score. The practice checks its vendor agreement and confirms a business associate agreement is in place. And the ad wording becomes “[X] percent of [number] patients who answered our [period] text survey said they were likely to recommend us”, with the same line on the landing page. The figure is pulled again each quarter and the ad is updated.

Checklist

• Survey purpose written down as quality improvement, approved by the privacy officer.
• Business associate agreement with any survey vendor that receives patient details.
• Survey list limited to name, contact channel and visit date.
• No clinical questions, no third-party offers, no paid content in the survey.
• Consent records match the send method for each mobile number.
• Opt-out replies honored within ten business days and shared with the reminder system.
• Each published figure has the question, the response count and the dates beside it.
• A dated substantiation file for each figure, with counts and no names.
• Review requests go to each patient, with no incentive tied to a rating.
• Any on-site ratings page shows reviews on criteria that ignore sentiment.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For patient surveys, we write survey and review request flows that ask each patient the same way, keep promotions in separate consented messages, and set up Google Ads and landing pages that quote a result only with its count and dates. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 160.103: Definitions (health information, business associate)
• 45 CFR 164.501: Definitions (health care operations, marketing)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 47 CFR 64.1200: Delivery restrictions
• 15 U.S.C. 7702: Definitions
• 15 U.S.C. 7704: Other protections for users of commercial electronic mail
• 15 U.S.C. 45: Unfair methods of competition unlawful; prevention by Commission
• FTC Policy Statement Regarding Advertising Substantiation (November 23, 1984)
• FTC Policy Statement on Deception (October 14, 1983)
• 16 CFR 255.2: Consumer endorsements
• 16 CFR Part 465: Use of consumer reviews and testimonials
• Google Maps user contributed content policy: prohibited and restricted content
• Google Ads policy: Misrepresentation

More in Healthcare marketing rules