Healthcare marketing compliance

HIPAA (the Health Insurance Portability and Accountability Act) protects patients' protected health information (PHI). In a marketing context, the core rule is simple to state and easy to violate: you may not use or disclose PHI for marketing without the patient's written authorization.^[1] PHI is broader than most people assume – it includes any information that identifies a patient and relates to their care, not just diagnoses or records.

Patient testimonials and case studies are the most common exposure point. Publishing a testimonial that identifies someone as your patient requires explicit written authorization, and even with consent, some sensitive details should never be shared.^[1] A before-and-after photo, a first name plus a condition, or a detail that makes a patient identifiable can each constitute a disclosure.

Online review responses carry the same risk in a less obvious form. Publicly replying to a review in a way that confirms the person is your patient – "Thanks for trusting us with your procedure" – can itself disclose PHI, even if the reviewer identified themselves first. Compliant responses stay generic and never confirm a treatment relationship.

The safest default is to build marketing around de-identified, educational content and to treat any patient-specific material as requiring a signed authorization before it is published.

A modern compliance risk that many marketing teams still overlook is website analytics and advertising tracking. Federal guidance has made clear that tracking technologies – analytics tags, advertising pixels, and similar tools – can transmit PHI to third parties when they run on pages tied to an individual's health, and that doing so without proper safeguards can violate HIPAA.^[2]

The exposure is easy to create unintentionally. A retargeting pixel on an appointment-booking page, a condition-specific landing page, or a patient-portal login can send identifiers plus the health context of the page to an ad platform. Practices should audit which trackers run on health-related pages, avoid placing advertising pixels on pages that reveal a condition or a care relationship, and put Business Associate Agreements in place with vendors where required.

Separately, the FTC's Health Breach Notification Rule can apply to health apps and connected websites that are not covered by HIPAA, extending breach-notification obligations to some digital health tools.^[3] The practical takeaway is that "we're just running ads" is not a safe assumption on health-related pages – the tracking layer is a compliance surface, not a neutral utility.

The FTC requires that advertising claims be truthful, not misleading, and substantiated by competent evidence before they are made.^[4] For medical marketing, this bites hardest on outcome claims: "guaranteed results," "cure," or "pain-free" language for treatments is generally prohibited unless it is rigorously supported.^[5]

Testimonials are governed by the FTC's Endorsement Guides. A testimonial must reflect the honest experience of a real patient, and if the result is not typical, that must be disclosed clearly and conspicuously – a fine-print "results may vary" is often not enough.^[4] Fabricated, incentivized-but-undisclosed, or cherry-picked testimonials are exactly what the FTC pursues.

Material connections must be disclosed. If an endorser was paid, given free services, or has any relationship that would affect the weight a consumer gives the endorsement, that connection has to be disclosed plainly.^[4] This applies to influencer content and staff posts as much as to formal ads.

Because health content is classified as "Your Money or Your Life," search engines and AI systems also scrutinize these claims – exaggerated or unsupported medical assertions hurt both compliance and visibility.^[6]

Federal rules are a floor, not a ceiling. State medical, dental, and other professional boards impose additional advertising restrictions that vary significantly by state and specialty, and they enforce them against licensees directly.

Common state-level restrictions include limits or disclosure requirements on price advertising, rules governing how board certifications and specialties may be described, and constraints on superiority claims. Statements like "best" or "#1 in the city" frequently require substantiation or are prohibited outright.

Credentials must be represented accurately and precisely. Describing a provider as "board certified" in a specialty they are not certified in, or implying a specialty designation the state does not recognize, is a common and serious violation. When in doubt, describe training and certifications in the exact terms the certifying body uses.

The same rules apply to search-optimized and AI-optimized content, and they happen to align with what earns visibility. Educational, evidence-based content about conditions and treatments is both the safest form of marketing and the most citable by search engines and AI answer engines.^[7] Compliance and performance point in the same direction here.

Accurate credentials and honest, substantiated claims are also E-E-A-T signals: search and AI systems reward demonstrable expertise and penalize exaggeration, so writing within compliance boundaries strengthens rankings and citation odds rather than limiting them.^[6] For the fuller quality picture, see the related guidance on E-E-A-T for healthcare and YMYL content standards.

Where content invites patient interaction – FAQ sections, comment fields, review widgets – build in the same HIPAA discipline: never surface patient-identifying material, and keep any user-generated content moderated so a well-meaning patient comment does not create a disclosure on your page.

Center marketing on de-identified, educational content rather than promotional or outcome-based claims.

Obtain signed written authorization before publishing any patient testimonial, photo, or case study, and omit unnecessary identifying details even when authorized.^[1]

Never confirm a treatment relationship in public review responses; keep replies generic.

Audit tracking pixels and analytics on health-related and booking pages, remove advertising trackers that could transmit PHI, and put Business Associate Agreements in place where required.^[2]

Avoid "cure" and "guaranteed" language, disclose atypical results clearly, and disclose any material connection behind an endorsement.^[4]

Represent credentials, certifications, and affiliations exactly as the certifying bodies state them, and check your state board's specific advertising rules.

Train front-desk and social-media staff on HIPAA for review responses and posts – most violations are unintentional and staff-driven.