HIPAA-Aware Marketing Basics for Home Care Agencies

What HIPAA-aware marketing basics look like for a home care agency

Picture a happy Facebook post. A caregiver and a client at a 90th birthday party, cake on the table, the client’s first name in the caption, the town tagged. Everyone involved meant well, and the post may still have disclosed protected health information without permission. For a home care agency, that kind of post is the most common way marketing turns into a privacy problem. Hackers and stolen laptops cause trouble too, but well-meaning posts happen far more often.

This guide covers home care agency HIPAA-aware marketing basics: how to collect testimonials, build case studies, write referral materials, and run your website without exposing the people you care for. Once you’ve worked through the steps, you’ll have marketing that still gets attention, plus a paper trail that holds up if anyone asks questions.

HIPAA-aware marketing for a home care agency means producing testimonials, case studies, social posts, and referral materials that don’t reveal any client’s health information unless that client, or their legal representative, has signed a written authorization. It also covers the less visible parts of marketing: website tracking tools, review responses, and the vendors who handle client data.

One caveat before we start. PatientProcure is a marketing agency. We aren’t your lawyer, and nothing here is legal advice. Every step below should end with your compliance officer or a healthcare attorney looking over what you built. Our job is to make sure that review is short.

Step 1: Find out whether HIPAA covers your home care agency

A lot of home care owners skip this step, and it changes how you handle everything that follows.

HIPAA applies to covered entities, which include healthcare providers that transmit health information electronically in connection with standard transactions like billing claims. A Medicare-certified home health agency is covered. An agency that bills Medicaid waiver programs or the VA electronically is almost certainly covered. A small, private-pay companion care agency that never bills a payer might not be.

Here’s my opinion, and some attorneys may push back on it: run your marketing as if HIPAA applies even if you’ve decided it doesn’t. Three reasons:

• State privacy laws can reach agencies that HIPAA doesn’t, and some are stricter.
• Hospitals, health systems, and Medicare Advantage plans that refer to you often write HIPAA-level privacy expectations into their contracts and vendor reviews.
• Your clients are older adults, often living with dementia or a serious diagnosis. Their families will judge you by how carefully you treat their information, whatever the statute technically requires.

To do this step, write down which payers you bill, whether you bill electronically, and which states you operate in. Bring that list to your attorney and ask two questions: are we a covered entity, and which state privacy rules apply to our marketing? Have the answer in writing before you publish anything else. It takes about 30 minutes of attorney time.

Step 2: Get written authorization before any client story leaves the building

When a covered entity uses a client’s health information for marketing, HIPAA generally requires a signed authorization. For a home care agency, health information covers more than you’d expect. The client’s name combined with the fact that they receive care from you is already sensitive. Add a diagnosis, a photo, a hospital discharge date, or a neighborhood and you’re clearly in protected territory.

A valid HIPAA authorization has specific required elements: a description of the information being used, who is disclosing it, who receives it, the purpose, an expiration date or event, a signature and date, and statements about the right to revoke. Don’t write this form yourself. Have counsel draft a marketing authorization once and reuse it.

Home care adds a few complications that most generic templates don’t handle:

• Capacity. Many clients can’t legally consent on their own. The authorization then has to come from a personal representative, usually someone holding healthcare power of attorney. An adult child who says they handle mom’s affairs doesn’t automatically qualify. Get a copy of the document.
• Timing. Keep the marketing authorization out of your intake packet. You can’t make care conditional on signing it, and a family signing 14 forms on the day of a hospital discharge isn’t giving meaningful consent. Ask 60 to 90 days into a good relationship, as a separate conversation.
• Revocation. Clients and families can withdraw permission. Keep a simple log of every asset each authorization covers (website page, brochure, social post, video) so you can pull all of it within a day if someone asks.

Here’s how it can go wrong. Say you run a 60-caregiver agency, and your marketing coordinator gets a verbal OK from a daughter to post a video tribute after her father’s death. Six months later her brother, who held the healthcare POA, sees it and complains. A verbal OK from the wrong person doesn’t count as authorization, so you have no defense. A signed form from the right person settles it.

Step 3: Build testimonials and referral case studies nobody can trace back

Home care agencies run on two kinds of proof. Families want to hear from other families. Referral sources (hospital discharge planners, case managers, elder law attorneys, geriatric care managers) want evidence that you start care fast and keep clients stable at home. You can supply both without putting a single client at risk.

Family testimonials

Families often assume that because they’re telling their own story, privacy doesn’t apply. But when your agency publishes that story, the client’s information is coming from you. A quote like “Mom’s Parkinson’s was getting worse and we didn’t know where to turn” discloses a diagnosis tied to a client relationship.

The fix is simple, and it also makes for better marketing. Steer testimonials toward the family’s experience of working with you, and away from the client’s medical condition:

• How fast you returned the first call
• Whether the same caregiver showed up consistently
• How you communicated during a scheduling problem
• What it felt like to sleep through the night again

Those details persuade families more than diagnosis stories do anyway, because they answer the question every adult child is quietly asking: will this agency be reliable? Use a first name and initial for the family member, leave the client unnamed, and still get a signed authorization if anything in the story could identify the client.

Case studies and referral materials

Referral partners don’t need names. They need patterns. Aggregate data works well here: average hours from referral to first visit, the share of clients still at home after six months, the number of caregivers trained in dementia care. Track these numbers yourself and report them as totals.

If you want a story-shaped case study, HIPAA’s Safe Harbor de-identification method is the standard to know. It requires removing 18 categories of identifiers, including names, all date elements except the year, most geographic units smaller than a state, and ages over 89 (those get grouped as 90 or older). That last one matters for home care in particular, because a lot of your clients are in their 90s.

Watch small numbers too. A case study about “a retired pastor in a town of 4,000 who came home after hip surgery” has no name in it and is still identifiable to half the town. Composite stories, built from several clients and clearly labeled as illustrative, avoid that. Never present a composite as one real person. That creates an FTC endorsement problem on top of the privacy one.

Step 4: Answer reviews and police social media without confirming anyone is a client

This step causes more real-world trouble than any other, because it happens fast and it feels personal.

A family member leaves a one-star Google review about a missed shift. The owner, stung, replies with the full story: the caregiver called out sick, the client’s daughter didn’t answer her phone, the client’s needs had changed since the last assessment. Every sentence of that reply confirms a client relationship and discloses care details. The HHS Office for Civil Rights has taken enforcement action against providers for exactly this. A Texas dental practice paid a settlement in 2019 over patient information disclosed in responses to online reviews.

Write a review response template now, before you need it. Something like: “We take every concern seriously and want to understand what happened. Please call our director of client services at [number] so we can talk directly.” It says nothing about who the reviewer is or what care anyone receives. Use it for good reviews too. Thanking someone by name for “taking such good care of Dad” confirms Dad is your client.

Social media is the other leak, and most of it comes from caregivers rather than the marketing team. Caregivers love their clients, and some will post photos from inside client homes. Put three rules in writing and cover them during caregiver onboarding:

• No photos or video of clients, their homes, or their belongings on personal accounts.
• No posts mentioning a client’s name, condition, or location, even in a private group.
• Agency accounts post client content only after the marketing lead confirms an authorization is on file.

(Side note: a caregiver-of-the-month post is still some of the best recruiting content a home care agency can run. Shoot it in your office or outside, without clients in the frame, and you skip the authorization question completely.)

Step 5: Audit your website tracking and marketing vendors

Even agencies that handle testimonials perfectly can leak client information through their website without anyone noticing.

In December 2022, HHS OCR issued guidance warning that tracking technologies like the Meta Pixel and some analytics tools can send health information to third parties. OCR updated the guidance in March 2024, and a federal court in Texas vacated part of it in June 2024, the part dealing with tracking on public, unauthenticated pages. The rest still applies, along with the underlying risk. If your “request care” form asks families to check boxes for dementia care, post-surgery support, or hospice support, and an advertising pixel fires on that form, you may be sending a care need tied to an IP address and a Facebook profile to an ad platform.

Here’s how to audit it in about an hour:

• List every page where a family enters information: contact forms, care assessments, client portals, careers pages.
• Use your browser’s developer tools, or ask your web developer, to check which third-party scripts load on each of those pages.
• Remove ad pixels and session recording tools from any page that collects care details. Track conversions with a thank-you page that carries no health information, or use a server-side setup that your counsel has approved.
• Rewrite intake forms to ask only for name, phone, and a general inquiry type. Gather the clinical detail on the phone call.

Then look at your vendors. Any tool that stores or processes client information on your behalf needs a business associate agreement (BAA) if you’re a covered entity. In home care, that list usually includes your CRM, your call tracking platform (call recordings are full of health information), your texting tool, and any review-request software that pulls client contact lists. Plenty of popular marketing tools won’t sign a BAA. Google Analytics, for example, isn’t covered under Google’s BAA. Find that out before you connect a tool to client data.

You’ve probably talked to marketing agencies that never brought up any of this. That should worry you. An agency that runs retargeting off your intake form without asking these questions is creating risk for you while charging you for leads.

What to do after the basics are in place

Once you’ve finished the five steps, the work shifts to maintenance. Put a 20-minute privacy check on the calendar every quarter: review new website pages for tracking scripts, confirm every live testimonial still has a valid authorization, and spot-check caregiver social accounts if your policy allows it. Add the authorization log to your marketing coordinator’s onboarding so it survives staff turnover.

The failures that cost home care agencies the most are rarely complicated. They tend to be:

• A defensive review reply written at 10 p.m. by an upset owner. It can bring an OCR complaint and a second wave of bad reviews.
• A memorial or birthday post approved by the wrong family member. It can mean a family dispute, a takedown, and lost trust with a referral source who saw it.
• An ad pixel on a care-needs form nobody remembered installing. It creates potential exposure that grows with every form submission until someone finds it.
• A referral packet case study detailed enough that a discharge planner recognizes the client. The planner quietly stops sending you referrals, and you never find out why.

None of this means your marketing has to be bland. Home care agencies that handle privacy well usually end up with better testimonials, because the stories focus on reliability and communication, which are the things families are deciding on. The privacy work makes the marketing more specific.

Your next move: pull up your website’s request-care form today and check which scripts load on it. If you want a second set of eyes on your forms, tracking, and referral materials, book a free strategy call with PatientProcure. We’ll show you where your marketing could be exposing client information and where it’s losing families before they ever call.