This guide explains what HIPAA actually requires of marketers, which channels create the most risk, and what compliant campaigns look like in practice. It covers the rules around patient authorization, Protected Health Information (PHI) in digital contexts, and how to evaluate vendors before signing a contract.
Note: This article is for informational purposes only and does not constitute legal advice. Consult qualified healthcare legal counsel for guidance specific to your organization.
TL;DR: What You Need to Know
- HIPAA defines "marketing" narrowly — most use of patient data to promote products or services requires written patient authorization
- PHI includes IP addresses, device IDs, and appointment page visits, not just medical records
- Google, Meta, and LinkedIn do not sign BAAs and cannot be fully configured for HIPAA-compliant patient targeting
- Safer options include educational content, opted-in email newsletters, and inbox advertising with no patient data involved
- Civil penalties range from $145 to $2,190,294 per violation — ignorance is not a defense
What HIPAA Actually Says About Marketing
The Legal Definition (It's Narrower Than You Think)
Under 45 CFR 164.501, HIPAA defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service." It also covers arrangements where a covered entity discloses PHI to a third party in exchange for remuneration, so that third party can market its own offerings.
What Doesn't Count as "Marketing"
These communications generally fall outside the marketing definition and don't require patient authorization:
- Prescription refill reminders (when remuneration is reasonably related to communication cost)
- Treatment-related communications and care coordination messages
- Recommendations for alternative care settings or providers
- Health plan benefit communications
- Case management and care management outreach
The distinction matters practically. A reminder that a patient's follow-up appointment is due isn't marketing. An email promoting a new elective procedure to patients with a specific diagnosis on file almost certainly is.
The Authorization Requirement and Remuneration Trigger
The general rule under 45 CFR 164.508(a)(3) is clear: any use or disclosure of PHI for marketing purposes requires written patient authorization, with only two exceptions — face-to-face communications and promotional gifts of nominal value.
There's an additional layer when money changes hands. If a covered entity receives payment from a third party in exchange for making a marketing communication using PHI, the authorization form must explicitly disclose that remuneration is involved — a generic privacy notice doesn't satisfy this.
The authorization requirement is also just the starting point. Healthcare marketers operate under overlapping regulatory frameworks:
- FTC Section 5: Enforcement actions against GoodRx ($1.5M civil penalty) and BetterHelp show that health data shared for advertising can trigger federal action even outside HIPAA's direct reach
- State consumer protection laws: California, Washington, and others impose obligations that in some cases exceed HIPAA's requirements
Understanding PHI in a Marketing Context
What Qualifies as PHI
PHI is any individually identifiable health information held or transmitted by a covered entity or business associate. Data doesn't need to name a diagnosis or treatment to qualify — context and combination matter just as much as content.
The 18 identifier categories requiring removal under Safe Harbor de-identification include:
- Names, email addresses, phone numbers
- IP addresses and device identifiers
- URLs and geographic data below state level
- Medical record numbers and account numbers
- Dates (other than year) for individuals under 90
- Biometric identifiers, full-face photos, and any other unique identifying code
Explicit vs. Implied PHI
Explicit PHI directly states a health condition or treatment — a record showing a patient has diabetes, for example.
Implied PHI reveals health status through behavior. Consider a user who visits a fertility clinic's appointment booking page and whose IP address is captured by a tracking pixel. They haven't stated a diagnosis, but the combination of identifiers and health context can still constitute PHI.
Marketers often focus on explicit records and miss the implied category entirely — which is where most tracking-related violations originate.
De-identification: Stricter Than Most People Assume
Safe Harbor de-identification under 45 CFR 164.514(b)(2) requires removal of all 18 identifiers — not just names or email addresses. IP addresses, URLs, and device IDs are explicitly on the list. The covered entity must also have no actual knowledge that the remaining data could re-identify an individual.
Hashing emails or masking names while leaving device IDs intact is not Safe Harbor de-identification.
High-Risk Marketing Channels: Where Healthcare Marketers Get Into Trouble
The Tracking Pixel Problem
Third-party ad pixels (Facebook Pixel, Google Ads tags, and similar trackers) are the most common source of HIPAA marketing violations. When these run on healthcare websites — particularly on pages about specific conditions, appointment booking, or patient portals — they can collect and transmit identifiers alongside health-context signals, creating PHI even when no PHI was intentionally shared.
In July 2023, the FTC and HHS issued a joint warning to hospital systems and telehealth providers specifically about online tracking risks. Real enforcement followed: Manasa Health Center paid $30,000 after OCR found PHI was disclosed through responses to negative Google reviews. Cadia Healthcare Facilities paid $182,000 in 2025 after OCR identified 150 patients whose names, photos, and health information appeared in website "success stories" without valid written authorization.
Google Analytics
Google explicitly states it does not offer BAAs for Google Analytics and prohibits HIPAA-regulated entities from sending PHI to the platform. Two facts are worth understanding before assuming workarounds exist:
- IP anonymization is not a fix: Data transmits to Google's servers before anonymization occurs
- GA4 carries the same risk: The BAA gap and PHI prohibition apply to GA4, not just Universal Analytics
Other High-Risk Tools
| Tool/Channel | Risk |
|---|---|
| Meta Pixel / Facebook Ads | Meta prohibits Business Tool Data based on health information; no BAA available |
| LinkedIn Ads | Policy prohibits targeting based on health-related data |
| CRM and email platforms (without BAA) | Any platform handling PHI must sign a BAA |
| YouTube embeds on healthcare pages | Video embeds can pass visitor IP data to YouTube |
| UTM parameters with health-specific terms | Campaign names referencing conditions or treatments can become identifiable |
How to Run HIPAA-Compliant Marketing Campaigns
Content Marketing and SEO
Publishing educational blog posts, videos, and infographics about general health topics involves no PHI and carries minimal compliance risk. Content should address conditions or treatments generally — explaining what a procedure involves, not targeting patients who have a specific condition on file.
This approach also compounds over time. A well-optimized library of educational content generates organic traffic without the pixel risk that comes from paid campaigns — making it a strong foundation before layering in other channels.
Email Marketing
Compliant email campaigns require:
- Prior written patient authorization when emails use PHI to promote products or services
- Explicit opt-in consent from recipients
- A signed BAA with the email platform
- End-to-end encryption
- A clear, easy opt-out mechanism
General health newsletters sent to opted-in subscribers — where no patient record data is used in targeting — carry significantly lower risk than campaigns segmented by diagnosis or treatment history.
Social Media
Healthcare organizations can maintain active social media presences and post general wellness content without issue. The compliance risks arise at specific points:
- Never disclose PHI in public responses to patient comments or reviews (the Manasa case is the cautionary example)
- Obtain written authorization before sharing patient testimonials, photos, or case stories
- Train staff on these rules — a well-meaning response to a positive review can become an enforcement action
Newsletter and Inbox Advertising
Advertising in third-party newsletters is one of the most compliance-friendly channels available to healthcare brands. The mechanics explain why: the audience consists of general opted-in subscribers, not patients. No PHI is involved in the ad placement. No tracking pixel sits on the advertiser's healthcare website. The brand message reaches readers directly in the inbox.
When choosing targeting methods, the risk profile differs considerably:
- Contextual keyword targeting — reaching people actively searching a health topic — poses low compliance risk
- Behavioral retargeting built on patient website history carries significantly higher exposure
- Conversion pixels on confirmation or portal pages should be removed or scoped to non-PHI pages only
How to Vet HIPAA-Compliant Marketing Vendors
The BAA Test
Any vendor who creates, receives, maintains, or transmits PHI on behalf of a covered entity is a Business Associate and must sign a BAA before work begins. Under 45 CFR 164.504(e), a compliant BAA must:
- Define permitted and required PHI uses and disclosures
- Require appropriate safeguards
- Mandate breach reporting
- Flow down compliance requirements to subcontractors
- Require return or destruction of PHI at contract termination
Google Analytics, Meta Ads, and LinkedIn Ads do not offer BAAs. That single fact determines their compliance status for any use case involving PHI.
Technical Safeguards to Require
When evaluating vendors who will handle PHI, look for:
- Unique user authentication with two-factor authentication (2FA)
- Role-based access controls
- Audit logs that record system activity
- End-to-end encryption for PHI in transit and at rest
- Encrypted offsite data backups
When a BAA Isn't Available
If a vendor won't sign a BAA, you have two fallback options — each with real tradeoffs:
- De-identify all shared data under the Safe Harbor standard (all 18 identifiers removed). This satisfies the requirement but significantly limits campaign targeting precision.
- Use on-premises hosting to eliminate some BAA obligations entirely. This works, but it requires substantial internal IT infrastructure and dedicated security resources to maintain.
Neither option is frictionless. The right choice depends on how much targeting capability your campaigns require versus the IT overhead your organization can absorb.
Frequently Asked Questions
Do all healthcare marketing emails require patient authorization under HIPAA?
No. Authorization is only required when the email uses PHI to promote a product or service for purchase. General health education emails sent to opted-in subscribers, where no patient record data is used for targeting, don't require authorization.
Can healthcare organizations use Google Analytics on their websites?
Not safely on pages where PHI may be present. Google explicitly does not offer a BAA for Google Analytics and prohibits PHI exposure to its platform. Using it on appointment pages, condition-specific pages, or authenticated patient areas creates significant compliance risk.
What are the penalties for HIPAA marketing violations?
Civil penalties range from $145 per violation (no knowledge) to $2,190,294 per violation (willful neglect, uncorrected), with annual caps per tier. Criminal penalties can reach $250,000 and 10 years imprisonment for violations involving commercial intent.
Is it HIPAA compliant to run retargeting ads for a healthcare organization?
It depends on the targeting method. Broad retargeting of general website visitors using non-health-specific messaging is lower-risk. Retargeting based on visits to condition-specific pages, appointment booking flows, or patient portals is high-risk: those page interactions can constitute PHI, and running them without valid patient authorization creates direct exposure.
Does cookie consent through a GDPR or CCPA tool protect against HIPAA violations?
No. HHS OCR has confirmed that cookie banners, privacy notices, and terms-of-service acceptances do not constitute HIPAA marketing authorization. HIPAA requires specific written authorization with defined elements. A generic consent click does not meet that standard.
What is a Business Associate Agreement and why does it matter for marketing?
A BAA is a legally required contract between a covered entity and any vendor who handles PHI on its behalf. It defines each party's compliance obligations, mandates breach notification procedures, and establishes liability boundaries for PHI mishandling. Without one, a vendor relationship involving PHI puts the covered entity in direct violation of HIPAA.
