Under HIPAA, most marketing uses of protected health information require the patient’s written authorization before you send a single email or letter. Only a few narrow exceptions exist, such as face-to-face communications and promotional gifts of nominal value. Disclosing PHI to a third party for its own marketing, or accepting payment to market on someone else’s behalf, always requires authorization, no exceptions apply, and the authorization must disclose the remuneration involved.
TL;DR:
- Communicating about a practice’s own health services without third-party payment is not considered marketing under HIPAA and does not require authorization.
- Written authorization must include specific details such as the PHI description, recipient, purpose, expiration, and remuneration disclosures to be compliant.
- Email, SMS, and social media marketing pose significant PHI leakage risks, requiring strict consent and encryption measures, especially on digital platforms.
- Selling or sharing patient lists for marketing or accepting any form of payment for PHI disclosures is strictly prohibited without proper authorization and BAAs.
- Ongoing workflows should include proper classification, consent capture, BAA confirmation, pre-publish compliance scans, and thorough recordkeeping to maintain HIPAA compliance.
Table of Contents
- HIPAA Marketing Rules: How the Privacy Rule Defines Marketing
- When You Can Skip Authorization: The Narrow Exceptions
- What a Valid Marketing Authorization Actually Requires
- Digital Channels Carry Their Own PHI Risks
- The Remuneration Rule: Why You Can’t Sell Patient Data
- Building a HIPAA-Safe Marketing Workflow
- Enforcement Risk Extends Beyond HIPAA Alone
- Balancing Patient Trust With Effective Outreach
- Get Your Marketing Copy Reviewed Before It Publishes
- Sources
HIPAA Marketing Rules: How the Privacy Rule Defines Marketing
The Privacy Rule defines marketing as any communication that encourages someone to purchase or use a product or service. That single sentence carries enormous weight in healthcare marketing regulations, because it determines whether you need a signed authorization or can proceed on the strength of your existing patient relationship.
The line that matters most: communications about a covered entity’s own health-related products or services don’t count as marketing, as long as no third party pays for them. A dermatology practice reminding patients about its own skin cancer screening service is operating inside patient care. The same practice selling its patient list to a skincare manufacturer, or forwarding a manufacturer’s coupon using patient contact information, has crossed into marketing that HIPAA and marketing rules treat very differently.
Common scenarios that meet the legal definition of marketing include:
- Selling or renting a patient list to an outside company for its promotional use
- Sending a drug manufacturer’s coupon or discount offer using PHI, when the manufacturer pays or provides something of value
- Recommending a specific pharmacy or product line in exchange for payment from that vendor
- Any communication where a third party compensates the covered entity, directly or indirectly, for reaching patients
Digital marketing in healthcare makes this distinction easy to blur. A “wellness newsletter” that quietly promotes a sponsor’s supplement line isn’t a newsletter under HIPAA. It’s a marketing communication requiring authorization, regardless of how the content reads to the patient receiving it.
When You Can Skip Authorization: The Narrow Exceptions
HIPAA compliant marketing doesn’t always require a signed form. The Privacy Rule carves out specific, limited situations where you can communicate without prior authorization. None of them are as broad as marketers tend to assume.
- Face-to-face communications. A physician recommending an over-the-counter product during an office visit, or a nurse discussing a specific therapy option in person, falls outside the authorization requirement. The exception covers the moment of direct interaction, not a follow-up email sent later referencing that conversation.
- Promotional gifts of nominal value. Branded pens, magnets, or a small item handed out at a health fair qualify. The moment a “gift” starts to look like compensation for a referral or a way to move PHI to a manufacturer, it stops being nominal and starts being marketing.
- Treatment communications. Refill reminders, information about drug alternatives that are currently prescribed, and case management or care coordination messages are healthcare operations, not marketing, provided no third party pays to influence the content.
- Healthcare-operations communications. General health education, patient satisfaction surveys, and quality improvement outreach fall under operations rather than marketing when they serve the practice’s own care functions.
The HHS FAQ on distinguishing health care from marketing exists precisely because this boundary trips up compliance teams constantly. Getting it wrong in one direction means unnecessary authorization friction that annoys patients. Getting it wrong in the other means an unauthorized marketing communication with your organization’s name on it.
What a Valid Marketing Authorization Actually Requires
Once you’ve determined a communication is marketing, 45 CFR 164.508 sets the bar for what the authorization form has to contain. A vague “we may contact you about offers” checkbox on an intake form will not survive an audit.
A compliant authorization must include:
- A specific, meaningful description of the PHI to be used or disclosed
- The identity of the person or entity authorized to use or disclose the information
- The identity of who will receive it
- A clear description of the purpose of the requested use or disclosure
- An expiration date or event
- The individual’s signature and date
- A statement disclosing any remuneration the covered entity receives from a third party, when that remuneration exists
That last point is where most homegrown authorization templates fail. If a pharmaceutical company or device manufacturer is paying, directly or indirectly, for the communication, the HHS marketing FAQ requires the form to say so in plain language the patient can understand, not buried in a privacy policy the patient never opens.
Pro Tip: Build your authorization language once, have counsel approve it, and lock the wording in a template. The most common audit finding isn’t a missing signature. It’s inconsistent remuneration disclosure across different campaigns run by different team members.
Store signed authorizations for the full retention period your state requires, and log the date, scope, and any revocation request against the specific campaign it applied to. A generic “authorization on file” note doesn’t hold up when an investigator asks which campaign a specific patient consented to.
Digital Channels Carry Their Own PHI Risks
Every mainstream marketing channel creates a distinct way to leak PHI, and email is the most common offender — learn practical tactics for maintaining compliance in patient email marketing. Subject lines and preview text get pulled into unencrypted notification systems, meaning a subject line like “Your diabetes test results are ready” can expose a diagnosis before the patient even opens the message. Metadata in tracking pixels and open-rate analytics can carry the same risk if it’s tied to identifiable patient data.
SMS carries similar exposure with less room for nuance, since text previews appear on lock screens regardless of who’s holding the phone. Opt-in consent has to be explicit and documented, message content should never include diagnosis, treatment, or medication specifics, and delivery should route through a platform covered by a signed business associate agreement. Guidance on HIPAA SMS marketing walks through the opt-in language that holds up under review.
Social media is where patient stories do real marketing work, and also where PHI mistakes become permanent. Testimonials require a documented, specific release, not a verbal “sure, go ahead” during a good visit. Never post identifiable details, before-and-after imagery, or condition-specific language without that signed release on file.
Ad platforms and remarketing pixels present the least obvious risk and the biggest downside. Sending a visitor’s email or condition-related browsing behavior to an ad network can constitute a PHI disclosure the platform was never authorized to receive. The HIPAA Journal’s guidance on digital marketing rules recommends treating any identifier headed to a third-party ad network as a risk by default. Cookieless, consent-based targeting using hashed and aggregated audiences avoids the exposure entirely, an approach detailed in AdJet’s guide to PHI-safe remarketing.
CRM platforms and contact forms round out the risk list. Every vendor touching patient data, from the marketing automation platform to the form plugin on your landing page, needs a signed business associate agreement, encryption in transit and at rest, and a minimal-data-collection policy that only asks for what the campaign actually needs. A telehealth email marketing compliance guide covers subject-line and metadata handling in more depth for teams building out email workflows.
The Remuneration Rule: Why You Can’t Sell Patient Data
The OCR’s marketing guidance treats any disclosure of PHI to a third party in exchange for remuneration as marketing, with no exceptions available. That single rule kills a huge category of “growth hacks” that other industries use freely.
Selling a patient list to a marketing firm, letting a manufacturer pay you to distribute its coupons using patient contact data, or accepting a referral fee tied to steering patients toward a specific product all fall squarely inside this prohibition. It doesn’t matter whether the payment is cash, free equipment, or a discounted service. Indirect remuneration counts the same as a direct check.
Business associates can perform marketing communications on your behalf, but only within the scope your business associate agreement defines, and only using PHI for the purposes that agreement specifically authorizes. Before signing any third-party marketing arrangement, run it through a short evaluation:
- Does the vendor receive PHI, and if so, is a BAA in place covering that exact use?
- Is any party being paid, directly or indirectly, to influence which patients get contacted or what they’re offered?
- Does the arrangement require a new or updated patient authorization?
- Can you document, in writing, exactly what data moves and why?
If you can’t answer all four cleanly, the arrangement isn’t ready to launch.
Building a HIPAA-Safe Marketing Workflow
A repeatable workflow beats a one-time policy document, because policies get read once and workflows get followed every campaign. Structure the process around five checkpoints:
- Classify the PHI risk of the campaign before writing a word of copy. Is this treatment communication, healthcare operations, or marketing requiring authorization?
- Build consent capture into the intake process itself, with authorization language that already meets the 164.508 checklist rather than something legal has to patch later.
- Confirm business associate agreements are current for every vendor touching the campaign, from the CRM to the SMS platform to the ad network.
- Run a pre-publish compliance scan on the actual copy, subject lines, and landing pages before anything goes live, catching PHI in metadata or risky claims a rushed reviewer might miss.
- Retain records of authorizations, revocations, and vendor agreements in a format that can produce an audit trail on demand, not just a folder of unsorted PDFs.
Automated scanning tools can flag risky language patterns and PHI exposure before publication and generate a documented review trail, which shortens the gap between “campaign drafted” and “campaign approved” without skipping the review itself. A pre-publish compliance check guide and regulatory review checklist both offer templates you can adapt into your own SOPs.
Pro Tip: Put revocation instructions directly in every marketing communication, not just the original authorization form. Patients who can’t find how to opt out will complain to OCR before they complain to you.
Quick checklist items worth pinning into your campaign template: authorization wording that matches 164.508, an explicit expiration date, remuneration disclosure language pre-approved by counsel, a vendor BAA status field, and a logged timestamp for every scan and approval.
Enforcement Risk Extends Beyond HIPAA Alone
OCR enforcement actions involving marketing typically center on unauthorized disclosure of patient lists, missing remuneration disclosures, or PHI sent to advertising vendors without a BAA. Penalties scale with willfulness and the volume of records exposed, and a pattern of repeated violations draws far harsher scrutiny than a single documented mistake.
HIPAA marketing rules aren’t the only law in play. State privacy statutes, including comprehensive consumer privacy laws now active in a growing number of states, frequently impose stricter consent standards or grant individuals a private right of action HIPAA doesn’t provide. A campaign that clears HIPAA can still violate a state law with a lower disclosure threshold.
Marketing arrangements involving referral incentives or preferred-vendor payments can also implicate anti-kickback and Stark Law concerns, particularly when a marketing fee looks like compensation for patient referrals. When a potential violation surfaces, the immediate steps are consistent: notify counsel, preserve every record related to the communication and consent, and assess remediation before any further campaigns go out under the same process.
Balancing Patient Trust With Effective Outreach
Conservative defaults beat clever workarounds. The teams that get burned aren’t usually the ones asking whether something is marketing. They’re the ones who assumed a gray area would resolve in their favor and never wrote the assumption down.
Automation earns its place here specifically because human reviewers get fatigued, and fatigue is when a risky subject line slips through. Documentation and review speed matter as much as the rules themselves. If it takes three weeks to get a campaign cleared, teams will find shortcuts around the process. Pilot new outreach ideas in small, tightly consented batches with a scanning step built in before scale, not after.
— Compliant Team
Get Your Marketing Copy Reviewed Before It Publishes
Manual compliance review means a legal or regulatory reviewer reading every subject line, landing page, and ad by hand, and that approach doesn’t scale once your campaign volume grows past a handful of emails a month. Some platforms scan your marketing content for risky language and PHI exposure in minutes, flagging what a tired human reviewer might read past on the fifth pass of the day.
The platform checks against a database of more than 1,000 risk terms, explains each flag in plain language, suggests a compliant rewrite, and logs the whole review as a documented audit trail your compliance team can produce on request. More than 200 telehealth and DTC health brands already run their content through it before it ever reaches a patient inbox or an ad platform. Visit the Scancompliant platform to see how the scan works on your own content, or check current plans and start a free trial on your next campaign before it goes live.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.