Practice Growth · For clinicians
HIPAA-Compliant Marketing Basics for OB/GYN and Midwifery Practices
HIPAA doesn't stop a practice from marketing. It restricts using patients' protected health information (PHI) for marketing without written authorization. General advertising, your website, directory listings and educational content are fine. The risk comes from patient data: testimonials and photos without authorization, review replies that confirm someone is a patient, tracking pixels that pass health information to ad platforms, and vendors without business associate agreements.
Most HIPAA marketing problems don't start with anyone deliberately cutting corners. A front-desk staffer reposts a patient's birth announcement, a web vendor drops a Meta pixel on the booking page, or an office manager uploads the patient list to an ad platform for a "lookalike audience." Each feels like ordinary marketing. Each can be a disclosure.
What HIPAA treats as marketing
Under the Privacy Rule, marketing generally means a communication about a product or service that encourages the recipient to buy or use it. When a practice uses PHI to send that kind of communication, it typically needs the patient's written authorization.
Authorization is generally not required for:
- Face-to-face communications between the practice and the patient
- Promotional gifts of nominal value from the practice
- Treatment and care coordination communications, like recommending a treatment or another provider, as long as no third party is paying you for the communication
- Refill reminders about currently prescribed medicines, within limits on payment
- Communications about the practice's own health-related products or services, in many circumstances
If a third party pays you to send a communication about its product to your patients, the rules tighten considerably, and the authorization must disclose the payment. Run any sponsored communication past counsel.
A quick risk map
| Activity | Uses PHI? | What to do |
|---|---|---|
| General ads, billboards, radio | No | Standard advertising rules apply |
| Website content and blog posts | No (unless patient stories) | Clinician-reviewed, accurate content |
| Directory and Google listings | No | Keep information accurate |
| Email or text to your patient list | Yes | Usually allowed for your own services; follow TCPA/CAN-SPAM; vendor BAA |
| Patient testimonials and photos | Yes | Written HIPAA authorization |
| Responding to reviews | Can be | Never confirm patient status |
| Retargeting ads from patient visits | Can be | High risk; review with counsel |
| Uploading patient lists to ad platforms | Yes | Generally requires authorization; avoid |
| Tracking pixels on portals or booking | Can be | High risk; avoid or use compliant tools |
Tracking technology: the biggest current exposure
Pixels, tags and session-replay tools from advertising and analytics companies collect what visitors do on your site. On a women's health site, that can include which service page someone viewed (fertility, pregnancy loss, abortion care), what they typed into a booking form, or that they logged into the portal.
HHS's Office for Civil Rights issued guidance in 2022 (updated in 2024) explaining that these technologies can result in impermissible disclosures of PHI. In June 2024, a federal court vacated part of that guidance as it applied to certain tracking on unauthenticated public pages. Even so:
- Tracking inside patient portals and authenticated areas remains a significant HIPAA risk.
- Booking forms and symptom checkers that collect health information are sensitive.
- The FTC and state attorneys general have pursued health data privacy cases under consumer protection law.
- Privacy litigation over website trackers has been active.
What to do this quarter:
- Inventory every third-party script on your site. Your web vendor should be able to produce the list; if they can't, that's an answer in itself.
- Remove advertising pixels from portal, booking and form pages.
- Use analytics configured to minimize data collection, or vendors willing to sign a BAA.
- Re-check the inventory whenever your site changes. Redesigns are when pixels quietly come back.
Testimonials, stories and photos
Patient stories are powerful in obstetrics and fertility, and patients often offer them. To use one:
- Get a written HIPAA authorization that names the specific information, the use (website, social, print) and an expiration date or event.
- Make it clearly voluntary and not a condition of care.
- Treat photos as identifying: a newborn, a patient in your office, or a patient with a clinician can all identify someone.
- If a patient tags your practice, you can thank them in ways that don't confirm care details. Resharing their post is a separate use that should be covered by authorization.
The FTC also expects testimonials to reflect typical experiences or be clearly qualified, and it prohibits fake reviews and undisclosed material connections.
Reviews
Never confirm that a reviewer is a patient or discuss their care, even to correct the record. See getting more reviews ethically, and HIPAA-compliant review responses.
Email and text
Newsletters and service announcements to your own patients are usually permissible when they promote your own health-related services, but:
- Use a vendor that signs a BAA if the list comes from patient records.
- Honor opt-outs promptly.
- Follow CAN-SPAM for email and the Telephone Consumer Protection Act for texts, which can require prior express consent depending on content.
- Keep sensitive details out of subject lines and previews. "Your fertility consultation follow-up" on a shared family iPad is a disclosure.
Vendors and BAAs
Any vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate. In practice marketing, that commonly includes:
- Online scheduling and reminder platforms
- Email and SMS platforms using patient lists
- Review request tools
- Call tracking and call recording
- Website hosting for forms that collect health information
- Marketing agencies with access to patient data
Get a signed BAA before sharing PHI. If a vendor won't sign one, it doesn't get PHI.
Train the people who actually do the marketing
Front-desk and marketing staff make most day-to-day calls. Train them to:
- Check every in-office photo for patients, charts and screens before posting
- Never confirm patient status online
- Route testimonial offers through the authorization process
- Ask the privacy officer before trying a new tool
Our guide to women's health practice website must-haves includes a privacy checklist, and the patient portal and telehealth best practices piece covers the portal side.
Claim your free listing
Directory listings are a low-risk, high-value channel because they describe your practice without using patient data. Claim your free listing on our New York women's health directory. Practices seeking more visibility can explore featured placement at /advertise/.
Frequently asked questions
Does HIPAA prohibit medical practices from marketing?
No. HIPAA restricts using or disclosing protected health information for marketing without a patient's written authorization, with some exceptions. General advertising that does not use patient information is not restricted by HIPAA.
Can we post a patient testimonial or birth photo on social media?
Only with a valid, written HIPAA authorization from the patient that covers that specific use. A verbal OK or a patient tagging you is not enough.
Are Facebook and Google tracking pixels allowed on a medical website?
HHS has warned that tracking technologies can disclose protected health information to third parties. A 2024 court ruling vacated part of that guidance for certain public pages, but trackers on appointment, portal and symptom pages remain high risk. Review them with counsel.
Sources
- HHS Office for Civil Rights — HIPAA Privacy Rule: Marketing
- HHS Office for Civil Rights — Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
- Federal Trade Commission — Health Breach Notification Rule and health privacy guidance
- Federal Trade Commission — Health Products Compliance Guidance
This article is for general education and is not medical advice. It does not replace an evaluation by a licensed clinician who knows your history. If you think you have a medical emergency, call 911.