What a HIPAA-Compliant Marketing Setup Looks Like When It’s Done
When you finish the five steps below, your website will still show you which ads drive bookings. Your CRM will still send reminders and reactivation campaigns, and your Google Ads and Meta campaigns will keep running. The difference is that none of those systems will be quietly sending patient information to companies that never agreed to protect it. That’s what HIPAA-compliant marketing basics for healthcare practices come down to: keep the patient acquisition machine running and close the leaks.
In our experience, a practice that has never done a privacy review almost always has at least one leak. Usually it’s a Meta Pixel or Google tag on an appointment request page, installed years ago by a web developer who had no reason to think about HIPAA. Nobody meant to do anything wrong. The Office for Civil Rights won’t care much about that.
HIPAA-compliant marketing means promoting a healthcare practice without using or disclosing protected health information (PHI) in ways the HIPAA Privacy Rule doesn’t allow. In practice, that means no PHI goes to ad platforms or analytics tools unless a business associate agreement covers them, patients give written authorization before their PHI is used in marketing, and CRMs and web forms are set up so patient data stays contained.
One caveat before the steps. This is a marketing agency’s view of the rules, built from setting up campaigns for healthcare practices. It isn’t legal advice. HIPAA has gray areas, and state laws add their own layer (Washington’s My Health My Data Act, for one). Your compliance counsel should sign off on anything you’re unsure about. For a single-location practice, plan on two to four weeks to work through everything below.
Step 1: Map Every Place Patient Data Touches Your Marketing
Time: an afternoon. Who: your office manager, plus whoever controls your website and ad accounts.
You can’t fix leaks you haven’t found. PHI also covers more than most marketing teams assume. It’s any individually identifiable information related to a person’s health, their care, or payment for that care. A name on its own isn’t PHI. A name and email submitted through a form titled “Request a GI consultation” is.
Open a spreadsheet and list every tool that collects, stores, or sees information from prospective or current patients. For each one, write down what it captures and where that data goes next. Here’s where we usually find it:
| Touchpoint | How PHI gets in | What to check |
|---|---|---|
| Website forms | Names, contact info, and service interest submitted together | Where submissions are sent and stored |
| Tracking pixels and tags | Page URLs, form events, and IP addresses sent to ad and analytics platforms | Which pages each tag fires on |
| Online booking widgets | Appointment type tied to a person’s identity | Whether the widget loads its own analytics scripts |
| Call tracking | Recordings and transcripts of patients describing symptoms | Whether the vendor signed a BAA |
| Email and SMS tools | Patient lists, appointment details, segments by condition | BAA status and what fields are synced |
| CRM | Everything above, in one place | BAA status, user access, export history |
| Reviews and social media | Staff replies and DMs that confirm someone is a patient | Who has login access and what they’ve posted |
| Ad platform audiences | Uploaded patient lists for retargeting or lookalikes | Past uploads in Meta and Google Ads audience managers |
What can go wrong: third-party embeds. Your scheduling widget, chat bubble, or financing calculator may load its own scripts, including its own analytics. Those don’t show up in your tag manager, so they get missed. Load each page with your browser’s developer tools open (the Network tab) and look at every domain the page talks to. If facebook.com, doubleclick.net, or google-analytics.com shows up on a booking page, write it down.
Step 2: Pull Tracking Pixels Off the Pages Where They Leak PHI
Time: one to two weeks, depending on your developer. This step carries the most risk, and it’s where most practices are exposed without knowing it.
In December 2022, the HHS Office for Civil Rights published guidance on online tracking technologies, then updated it in March 2024. The short version: tracking code from Meta, Google, and others can collect PHI, and a practice that allows it without a business associate agreement may be making an impermissible disclosure. In June 2024, a federal court in Texas vacated part of that guidance. The part it threw out treated a visitor’s IP address combined with a visit to a public, unauthenticated page about a health condition as PHI. Patient portals, logged-in pages, and pages where people submit their information were not part of what the court vacated.
So the ruling gave practices some breathing room on blog posts and general service pages. It did not make your booking flow safe. HIPAA also isn’t your only exposure. Several large health systems have paid settlements in class actions over Meta Pixel use, many filed under state privacy and wiretap laws. And the FTC brought cases in 2023 against GoodRx and BetterHelp for sharing health data with advertising platforms.
Go page by page:
- Patient portal and any logged-in page: no third-party marketing or analytics tags at all.
- Appointment request forms, booking flows, and confirmation pages: remove the Meta Pixel, Google Analytics, TikTok pixel, and any other tag from a vendor that hasn’t signed a BAA.
- Condition-specific landing pages with forms: same treatment as booking pages.
- Thank-you URLs: make sure they don’t carry names, emails, or condition names in query strings. A URL like /thank-you?service=low-t&email=… hands that data to every tag on the page.
- Public blog and general service pages: lower risk after the 2024 ruling. Talk to counsel about where your practice wants to draw the line.
I’ll be blunt about the tradeoff. Meta’s ad algorithm learns from conversion signals. Strip the pixel from your booking page and your cost per lead on Meta will probably climb, because the platform stops learning who converts. Meta has also added its own restrictions on the website data health and wellness advertisers can send back, so the old setup is going away regardless. Rebuild it with a server-side setup, through a HIPAA-focused tag management vendor that will sign a BAA, and send a stripped-down conversion event: “lead submitted,” with no URL, no condition, and no contact details. You lose some precision. You keep a working campaign.
One related habit to break: uploading patient lists to Meta Custom Audiences or Google Customer Match. Hashing the emails doesn’t solve it. The platform hashes its own users’ emails to find the matches, which is the whole point, so it learns exactly who is on your list. A list of current patients tells the platform those people received care from you. Without written authorization from every person on the list, don’t upload it. Realistically, that means don’t upload it.
How to verify it’s done: open your booking page with developer tools running, submit a test request with fake data, and confirm that no requests go to facebook.com/tr, google-analytics.com, or any other vendor you don’t have a BAA with.
Step 3: Get a BAA From Every Vendor That Touches PHI (and Replace the Ones That Refuse)
Time: two to three weeks, mostly waiting on vendors.
A business associate agreement (BAA) is the contract that makes a vendor legally responsible for protecting the PHI it handles for you. If a vendor creates, receives, stores, or transmits PHI on your behalf, you need one. Your EHR vendor almost certainly signed one years ago. The gaps are usually in your marketing tools.
| Tool | Signs a BAA? | What to do |
|---|---|---|
| Meta ads and Meta Pixel | No | Keep PHI out completely. Use server-side events that contain no PHI. |
| Google Analytics | No (Google states this publicly) | Keep it off forms, booking flows, and the portal. |
| Google Workspace (Gmail, Drive) | Yes, for covered services, once accepted in the admin console | Accept the BAA. Free personal Gmail accounts aren’t covered. |
| Email marketing platforms | Varies. Many mainstream ones don’t. | Use a healthcare-focused platform or a covered CRM. |
| CRM and marketing automation | Varies, often only on higher tiers or as a paid add-on | Get it confirmed in writing before you import patient data. |
| Call tracking and recording | Several vendors offer HIPAA plans | Upgrade if your calls are recorded or transcribed. |
| Website chat and AI chatbots | Varies | Assume no until you see a signed BAA. |
| Your marketing agency | Should, if it accesses PHI | Get it signed before you give them CRM or call recording access. |
Software sales reps will tell you their tool is “HIPAA compliant.” Ask for the BAA. If they hedge, or tell you it’s only available on the enterprise plan at four times the price, you’ve learned what that tool will cost you to use the right way.
A signed BAA makes the vendor accountable for the PHI it handles. You’re still responsible for configuring the tool correctly, limiting who can log in, and sending it only the data it needs. (Side note: this goes double for AI tools. Plenty of practices paste call transcripts or patient emails into free AI chatbots to draft replies. Unless a BAA covers that tool, every paste is a disclosure.)
Step 4: Know When HIPAA-Compliant Marketing Requires Patient Authorization
Time: a one-hour policy review, then ongoing judgment calls.
The HIPAA Privacy Rule defines marketing as a communication about a product or service that encourages the recipient to buy or use it. Using PHI for marketing generally requires the patient’s written authorization. But the rule carves out a lot of what practices do every day.
Communications about your own health-related services, sent to your own patients, usually fall outside the definition as long as no third party pays you to send them. An email telling existing patients you now offer a new laser service generally doesn’t need HIPAA authorization. Neither does a reminder that they’re due for a cleaning. Face-to-face conversations and promotional gifts of nominal value are excluded too. The picture changes when money comes from outside. If a device manufacturer or drug company pays you, or subsidizes the campaign, to promote its product to your patients, that counts as marketing with financial remuneration, and you need authorization that discloses the payment.
Other laws still apply when HIPAA doesn’t require authorization. Text messages fall under the TCPA, which has its own consent rules. Marketing email has to follow CAN-SPAM, including a working unsubscribe link. Honor opt-outs quickly.
Testimonials, reviews, and before-and-after photos
Any patient story, video testimonial, or before-and-after photo you publish needs a signed HIPAA authorization covering that specific use. A verbal “sure, go ahead” at checkout won’t hold up. Many state medical boards also regulate testimonials and before-and-after images in medical advertising, and the FTC’s Endorsement Guides apply to claims about results. Have your compliance or legal counsel review your consent form and your advertising claims before you build a campaign around them.
Online reviews are where small practices get burned most often. A patient leaves a one-star review about a billing dispute, and someone at the front desk replies with details of the visit to set the record straight. OCR has reached settlements with several dental practices over review responses like that, five-figure amounts for small offices. A safe response never confirms the person is a patient:
“We take every concern seriously, and we can’t discuss anyone’s care online. Please call our office manager at [number] so we can talk directly.”
The same rule applies to social media comments and DMs. Move the conversation to a phone call or your secure portal.
Step 5: Set Up Your CRM and Lead Forms So PHI Stays Contained
Time: one to two weeks. Difficulty: moderate, depending on your CRM.
Say you run a two-location medical weight loss clinic. Your website form asks for name, phone, email, current weight, goal weight, and current medications. Submissions land in a shared Gmail inbox, get forwarded to the front desk, and get copied into a CRM that never signed a BAA. Every one of those hops is a problem. And nothing past name and phone helps you book the consult.
Here’s the setup we’d build instead:
- Collect the minimum. Name, phone, email, preferred location, preferred time, and the service they’re interested in. Health history belongs in intake, inside your EHR. Shorter forms also tend to get completed more often, so this helps conversion as well.
- Send form submissions straight to a covered system. The form should post to your BAA-covered CRM or a HIPAA-compliant form tool, never to an email inbox.
- Strip notification emails. Staff alerts should say “New consultation request, log in to view,” with no name or details in the body.
- Lock down access. Give each staff member their own login, use role-based permissions, turn on two-factor authentication, and remove access the day someone leaves.
- Keep segments inside the covered system. Tagging leads by service interest so you can send relevant follow-up is fine inside a covered CRM. Exporting those segments to an ad platform is where you get into trouble.
- Fix the texting habit. Front desk staff texting patients from personal phones is common and hard to defend. Use a texting tool your BAA covers.
What can go wrong: the CRM migration. When practices switch CRMs, someone exports the full patient list to a spreadsheet, emails it to the new vendor’s onboarding team, and leaves copies on three laptops. Use the vendor’s secure import process, and delete the exports when you’re done.
The Three Failures That Cost Practices the Most
In our experience, the expensive HIPAA marketing problems come from three places. None of them involves complicated legal theory.
The redesign that brings the pixel back
You clean everything up. Eighteen months later, you hire a new web firm, and its launch checklist includes “install Meta Pixel and GA4 on all pages.” Your booking page is leaking again, and nobody notices for a year. The cost is a potential breach assessment covering every form submission in that window, plus notification obligations if it qualifies as a breach. Write your tracking rules into every web and agency contract, and rerun the Network tab test every quarter.
The angry review reply
This is the cheapest failure to prevent, and it shows up again and again in OCR’s enforcement actions against small practices. Write the template response, train everyone who has access to your Google Business Profile, and remove access from anyone who doesn’t need it.
The panic purge
This one surprises people. A practice reads about pixel lawsuits, rips every tracking tag off the site, and keeps running ads with no measurement. Three months later, cost per lead has climbed, nobody can tell which campaigns produce booked consults, and the owner cuts the ad budget. The lost patients came from losing measurement, and that was avoidable. Rebuild measurement the compliant way first (server-side events, call tracking under a BAA, attribution inside your CRM), then turn the old tags off.
What to do once the five steps are done
Put a quarterly check on the calendar. Run the Network tab test on your booking flow, confirm every vendor on your data map still has a current BAA, and review who can log in to your CRM, ad accounts, and review profiles. Add a privacy review to your process for bringing on any new marketing tool or agency. When someone pitches you a new tactic, ask one question first: does patient data leave a system we have a BAA with?
If you’d like someone else to look first, book a free strategy call with PatientProcure. We’ll go through where your tracking tags fire, where your leads go after someone hits submit, and where your practice is losing patients before they book. That way you can fix the leaks without shutting down the campaigns that fill your schedule.