HIPAA Marketing Rules: Email, Ads and TestimonialsWhat counts as marketing under HIPAA, what needs a signed authorization, and where FTC rules add to it.

HIPAA requires a patient's written authorization before a practice uses or discloses protected health information (PHI) for marketing, with a few narrow exceptions. The rule covers email lists, ad audiences and testimonials alike. FTC rules apply on top of HIPAA. We read HHS, eCFR and FTC pages on October 9, 2026.

HIPAA marketing rules at a glance

• HIPAA defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service."
• Marketing with PHI needs written authorization. The rule names two exceptions: a face-to-face communication and "a promotional gift of nominal value."
• Messages about a patient's treatment, or about the practice's own health services, fall outside the definition unless a third party pays for them.
• HHS says "covered entities may not sell lists of patients or enrollees to third parties" without authorization.
• Each email that breaks the CAN-SPAM Act can cost up to $53,088, according to the FTC.

What does HIPAA say about marketing?

The Privacy Rule defines the term at 45 CFR 164.501. Marketing means "to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service." Section 164.508(a)(3) then sets the rule: "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing."

Payment from a third party adds a duty. If a third party pays the practice for the marketing, "the authorization must state that such remuneration is involved." The rule defines financial remuneration as "direct or indirect payment from or on behalf of a third party whose product or service is being described."

What is not marketing under HIPAA?

The rule carves out five cases. The first three fall outside the definition of marketing. The last two are marketing that needs no authorization.

The first two rows have a limit. They apply "except where the covered entity receives financial remuneration in exchange for making the communication." A message paid for by a drug or device company is marketing again.

Can a practice email patients about its services?

Yes, in many cases. A message about the practice's own health services falls outside the HIPAA definition of marketing. Three conditions still apply.

1. The list is PHI when it shows who is a patient. The email platform that holds it needs a Business Associate Agreement (BAA).
2. HHS expects safeguards. Its email FAQ says providers may communicate electronically with patients "provided they apply reasonable safeguards when doing so."
3. The CAN-SPAM Act covers commercial email. The FTC states: "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088." It also states: "You must honor a recipient's opt-out request within 10 business days."

Can a practice use patient data for ads?

Not without authorization. HHS says "covered entities may not sell lists of patients or enrollees to third parties" without authorization from each person. Uploading a patient list to an ad platform hands PHI to that platform. Treat the upload as a disclosure and get advice before you do it.

Website trackers raise the same issue. An HHS Office for Civil Rights bulletin says: "Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures." It names "disclosures of PHI to tracking technology vendors for marketing purposes" without authorization as one such case. A federal court vacated part of that bulletin on June 20, 2024. HHS says it "is evaluating its next steps in light of that order." Our guide Is Your Website's Tracking HIPAA-Compliant? shows how to check your own site.

Can a practice use patient testimonials?

Yes, with a signed authorization. A testimonial that names or shows a patient uses PHI for marketing, so section 164.508(a)(3) applies. Get the authorization in writing before you publish. Keep it on file.

FTC rules cover the content. The FTC says: "An endorsement must reflect the honest opinion of the endorser." If a result is exceptional, the ad "must make clear to the audience what the generally expected results" are. The FTC's rule on fake reviews and testimonials "went into effect on October 21, 2024."

Online reviews differ. The patient posts the review, not the practice. The risk sits in the reply. HHS announced in June 2023 that a psychiatric practice paid $30,000 after it disclosed a patient's information in a reply to a negative review. See Can You Reply to Patient Reviews Under HIPAA? for safe wording.

How does HIPAA compliant marketing work in practice?

Sort each campaign before it launches. The test comes from the rule's definition. Does the message encourage people "to purchase or use the product or service"? Does it use patient information? Five steps cover the rest.

1. 1

   List the data

   Write down which patient information the campaign uses and where that information goes.

2. 2

   Apply the definition

   Decide whether the message is treatment, the practice's own service, or marketing. Note any third-party payment.

3. 3

   Get authorization where needed

   Use a written HIPAA authorization for marketing uses, testimonials and patient photos.

4. 4

   Check each vendor

   Confirm a BAA with every platform that holds patient data, such as email and CRM tools.

5. 5

   Check the FTC rules

   Add an opt-out and your location to commercial email. Keep testimonials honest and typical.

How Webpatch helps

Webpatch builds websites for healthcare practices and manages their security, HIPAA compliance, SEO and AEO. For marketing, we check what the website sends to ad and analytics vendors. We run The Webpatch Tracker Check to find trackers on pages that patients use. We review forms, email sign-ups and testimonial pages for missing authorizations and missing BAAs. We are not a law firm. We flag the issues, and your attorney or compliance adviser makes the legal call. Contact Webpatch to review your marketing setup.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.