Patient support groups: privacy and promotion

A practice decides to start a monthly support group: people living with a chronic condition, new parents, caregivers, or patients in recovery. A clinician or a trained staff member leads it, the practice lends its room or its video account, and the front desk mentions it to patients. The group can do real good. It also puts protected health information in a room with people who are not your staff, and it raises questions about records, online spaces, crisis moments and how you advertise it.

This guide covers support groups a practice hosts, leads or promotes. Rules for a practice’s own social media accounts are in our healthcare social media policy guide, public talks and classes are in our guide to patient education seminars, and the wider privacy picture for therapy practices is in our guides to therapist private practice marketing and addiction treatment marketing.

This is general information, not legal advice. Sources cited were checked on October 31, 2026: 45 CFR 160.102 and 160.103; 45 CFR 164.501, 164.502(a)(1)(iii), 164.508(a)(3), 164.510(b), 164.512(j) and 164.530(c); 42 CFR 2.11, 2.12 and 2.13; 47 CFR 52.200; and 15 USC 45 and 52. We found no federal rule or agency guidance written for patient support groups as such. State law can add confidentiality, mental health records, licensing and consumer protection rules, so have a health care attorney review your plan.

The short version

The HIPAA Privacy Rule applies to covered entities and, where stated, business associates (45 CFR 160.102). Your practice and your staff facilitator are bound by it. Group members, as members, are not.
Because members are not bound by HIPAA, a confidentiality ground rule among members is a request, not a legal duty under HIPAA. Say so plainly when the group starts. Whether a signed member agreement can be enforced is a question of state law.
Your practice must reasonably safeguard protected health information and limit incidental disclosures (45 CFR 164.530(c)). An incidental disclosure is permitted only when those safeguards and the minimum necessary rules are met (45 CFR 164.502(a)(1)(iii)).
If your practice is a federally assisted substance use disorder program, 42 CFR Part 2 restricts records that would identify a person as having a substance use disorder (42 CFR 2.12(a)). A recovery group roster can be such a record.
Telling your own patients about a group your practice runs is a description of your own health-related service, which falls outside the HIPAA marketing definition unless a third party pays you to send it (45 CFR 164.501). If a third party pays, an authorization is required and must say so (45 CFR 164.508(a)(3)).
Plan for a crisis before the first meeting: 988 is the national suicide and mental health crisis line (47 CFR 52.200(a)), and 911 is for emergencies.

Who HIPAA binds in a group room

The Privacy Rule applies to health plans, health care clearinghouses and health care providers who transmit health information electronically in connection with covered transactions, and, where the rule says so, to their business associates (45 CFR 160.102). A practice that bills insurance electronically is a covered entity. A staff member who leads the group on the practice’s behalf acts for the practice, so what that person writes down, shares or posts is the practice’s use or disclosure.

A group member is none of those things. When one member tells a friend what another member said, HIPAA does not reach that member. So a flyer that tells members “all that is said here is protected by HIPAA” is wrong, and a promise like that can mislead the people you are trying to help.

Health information under HIPAA includes information that relates to the provision of health care to an individual (45 CFR 160.103). That covers more than diagnoses. The fact that a person attends a group your practice runs for a named condition can itself reveal health information, so the roster, the sign-in sheet and the reminder list deserve the same care as a chart.

Ground rules for members

No federal rule sets the content of support group ground rules. We recommend a short written set that the facilitator reads at the first meeting and again when new members join:

What is said in the group stays in the group, and members use first names only.
Members do not record, photograph or screenshot meetings.
This agreement is a promise among members. It is not a legal duty under HIPAA, and the practice cannot control what other members will do. Share only what you are comfortable having repeated.
The facilitator will act if a member appears to be at risk of harm to themselves or others, which can include calling 988 or 911.
The group does not replace individual care. Questions about your own treatment go to your own clinician.

We recommend that you avoid the word “confidential” without a qualifier in flyers and sign-up pages, and say instead what the practice will do with its own records and what it cannot control. That keeps the description truthful, which matters under the FTC Act’s ban on deceptive acts or practices (15 USC 45(a)(1)).

Records the practice keeps

Your practice’s records about the group are protected health information in your hands: sign-up forms, attendance, facilitator notes, reminder lists and any recording. The safeguards standard asks for administrative, technical and physical safeguards that protect that information from uses or disclosures the rule does not permit, and that limit incidental disclosures (45 CFR 164.530(c)(1) and (2)).

No federal rule says what a support group’s records must look like. We recommend:

A sign-in sheet with first names only, kept by the facilitator, not left at the door.
Reminders that name the meeting time and room but not the condition, so a message seen on a lock screen reveals less.
Facilitator notes only when the group is part of treatment and the notes belong in the chart, and none when it is a peer group.
No recording of meetings unless each member has agreed in writing and you have a clear reason to keep it.

Family members and caregivers in the room

A caregiver may ask to attend. HIPAA lets a covered entity share with a family member, relative, close friend or other person the patient identifies the protected health information directly relevant to that person’s involvement in the patient’s care (45 CFR 164.510(b)(1)(i)). When the patient is present and able to make health care decisions, the practice may do so if it gets the patient’s agreement, gives the patient a chance to object and no objection is made, or reasonably infers from the circumstances that the patient does not object (45 CFR 164.510(b)(2)).

In a group, that rule covers what the facilitator says about a patient in front of the patient’s own caregiver. It does not cover what the facilitator says about one member in front of another member’s caregiver. We recommend that the facilitator not discuss any member’s treatment in the group at all, and keep those conversations for individual visits.

Substance use disorder groups and 42 CFR Part 2

42 CFR Part 2 adds its own layer for substance use disorder programs. A program is a person or an identified unit that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment, or medical staff in a general medical facility whose primary function is that work (42 CFR 2.11). The rules apply to a program that is federally assisted, which includes a participating provider in the Medicare program (42 CFR 2.12(b)(2)(i)).

For a covered program, the restrictions apply to records that would identify a patient as having or having had a substance use disorder (42 CFR 2.12(a)(1)). Those records may be used or disclosed only as Part 2 permits, and each use or disclosure must be limited to what is necessary for its purpose (42 CFR 2.13(a)). A list of who attends a recovery group run by such a program identifies each attendee, so the roster, reminders and any online membership list need Part 2 handling, not only HIPAA handling. If you run or refer to such a group, have a health care attorney confirm whether your practice is a Part 2 program before you set up sign-ups.

Online and video groups

Online groups raise two separate questions: who hosts the space, and what the practice posts in it.

If a vendor creates, receives, maintains or transmits protected health information on your behalf, such as a video service that holds your meeting roster, that vendor is a business associate under 45 CFR 160.103, and the rules on business associate agreements apply. Our guide to business associate agreements with marketing vendors covers what to confirm before patient information flows through a tool. Health companies that host their own member communities face a different set of rules, covered in our guide to brand-run patient communities.

A public or open social media group is a different matter. No federal rule bans a practice from running one, but anything a staff member posts there is a disclosure by the practice. We recommend:

Use public pages for announcements only: the topic, the time, how to sign up.
Do not confirm in comments or replies that anyone is a patient, and do not answer questions about a person’s own care in public.
Take sign-ups through your own form or phone line, not through comments.
If the group meets online, use a tool your practice has reviewed and send the link privately to each member.

Posts by members about themselves are their own choice. A staff reply that adds anything about that member’s care is not.

Promoting the group

HIPAA defines marketing as a communication about a product or service that encourages recipients to purchase or use it, and it excludes a communication that describes a health-related product or service provided by the covered entity making the communication, unless the covered entity receives financial remuneration in exchange for making it (45 CFR 164.501). A flyer in your waiting room or a message to your patients about a group your practice runs fits that exclusion.

The answer changes if someone pays you to promote the group. If the marketing involves financial remuneration from a third party, you need each patient’s authorization before using their information to send it, and the authorization must state that remuneration is involved (45 CFR 164.508(a)(3)(i) and (ii)). Before you accept a sponsor for a group, have a health care attorney look at the arrangement.

What you say about the group is advertising. The FTC Act prohibits deceptive acts or practices (15 USC 45(a)(1)) and false advertisements for services likely to induce their purchase (15 USC 52(a)). In practice that means:

Describe the facilitator’s credentials exactly as they are. A peer leader, a nurse and a licensed therapist are different, and your state licensing law controls who may use protected titles. Check with your state board.
Do not promise outcomes. Describe what happens at a meeting instead.
If a member’s story appears in your promotion, get that member’s written authorization first (45 CFR 164.508). Our guide to patient testimonials covers the endorsement side.

Crisis plans

A support group can bring up thoughts of self-harm or harm to others. 988 is the three-digit dialing code for the national suicide prevention and mental health crisis hotline system (47 CFR 52.200(a)). 911 is for emergencies.

HIPAA permits a covered entity, consistent with applicable law and standards of ethical conduct, to use or disclose protected health information when it believes in good faith that doing so is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to a person reasonably able to prevent or lessen the threat (45 CFR 164.512(j)(1)(i)). State law and professional duties can add to that, which is a question for your attorney and your licensing board.

No federal rule sets a crisis plan for a support group. We recommend a one-page plan the facilitator knows by heart: who in the practice to call, when to call 988 or 911, how to keep the member with someone while help comes, and how to follow up with the member afterwards. Put 988 and 911 on the handout members take home.

Questions to ask before you launch

Is the group part of treatment, with notes in the chart, or a peer group with no clinical notes?
Who facilitates, and do the flyer and website describe that person’s credentials exactly?
Does any part of the group touch substance use disorder treatment, and is the practice a Part 2 program?
Which tools will hold sign-ups, reminders and video meetings, and has each been reviewed for business associate status?
Does anyone outside the practice pay for or sponsor the group?
Does the facilitator know the crisis plan, and is 988 on the handout?

Use and avoid

Use: “What members share stays in the group. This is a promise among members, not a legal duty, so share what you are comfortable having repeated.”
Avoid: “All that is said here is protected by HIPAA.”
Use: “Led by [name], a licensed clinical social worker on our staff.” (only if true)
Avoid: A credential or title the facilitator does not hold.
Use: “Thursday 6 pm, Room B” in reminder texts.
Avoid: The condition name in reminders or in a public sign-up thread.
Use: “Members find it helpful to meet others in the same situation.”
Avoid: “Our group will reduce your symptoms.”

An illustration

This example is invented. [Practice name], an independent endocrinology practice, wants to start a monthly evening group for adults newly diagnosed with type 1 diabetes. Their nurse educator will lead it. The practice manager drafts a flyer that says “a confidential, HIPAA-protected space” and plans a public social media group for sign-ups.

Before launch, they change three things. The flyer now says that members agree to keep what is shared in the group, that this is a promise among members, and that the practice protects its own records. Sign-ups move to a form on the practice website, and the public page carries only the date, time and form link. The nurse educator gets a one-page crisis plan with 988 and 911 on it and a handout for members with the same numbers. The flyer names the nurse educator’s actual credential, and the practice declines an offer from a supply company to sponsor the group until their attorney has reviewed it.

Checklist

Written ground rules that say members are not bound by HIPAA.
First-name sign-in, kept by the facilitator.
Reminders that leave out the condition name.
Part 2 status checked if substance use is involved.
Business associate review for each tool that holds sign-ups or meetings.
Public posts limited to announcements, sign-ups taken privately.
Facilitator credentials stated exactly.
No outcome promises in flyers or ads.
Written authorization before any member story appears in promotion.
Sponsor or third-party payment reviewed by counsel.
Crisis plan written, facilitator briefed, 988 and 911 on the handout.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For support groups, that means a group page and sign-up form on your own site that describe the group truthfully and keep the condition out of public view. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Are support group members bound by HIPAA?

No. The Privacy Rule applies to covered entities and their business associates (45 CFR 160.102). A member who repeats what was said is not covered by it. Your practice and your staff facilitator are.

Can we promise members that the group is confidential?

You can promise what the practice will do with its own records. You cannot promise what other members will do. Ground rules among members are a request, and whether a signed agreement binds them is a question of state law.

Do we need patient authorization to tell patients about our group?

Not when you describe a health-related service your practice provides and no third party pays you to send the message, because that falls outside the HIPAA marketing definition (45 CFR 164.501). If a third party pays, you need authorization that states the payment (45 CFR 164.508(a)(3)).

Does 42 CFR Part 2 apply to our recovery group?

It applies when your practice is a federally assisted program that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral (42 CFR 2.11 and 2.12). Then records that identify someone as having a substance use disorder, such as a roster, are restricted. Have a health care attorney confirm your status.

What should the facilitator do if a member talks about suicide?

Follow the practice’s written crisis plan. 988 is the national suicide and mental health crisis line (47 CFR 52.200(a)) and 911 is for emergencies. HIPAA permits a good faith disclosure needed to prevent or lessen a serious and imminent threat (45 CFR 164.512(j)).

Sources

More in Mental and behavioral health marketing

Hosting and promoting a patient support group: privacy, crisis plans and marketing rules