Key takeaways
- Using a patient's name, photo, story or testimonial in marketing needs their signed, written HIPAA authorization.
- When you reply to an online review, do not confirm that the reviewer is a patient or mention their care.
- Keep advertising pixels and analytics tags off patient portals, logins and forms where patients share health information.
- Marketing email must follow the CAN-SPAM Act, and autodialed marketing texts generally need prior express written consent.
- Google and Meta limit how health ads can be targeted and worded, so target by location and service, not by health.
- The FTC bans fake reviews and rewards tied to a review's sentiment, and Google does not allow rewards for any review.
Most practice marketing, such as a website, Google Business Profile, social posts and service ads, needs no patient information at all. The risk starts when it does. This guide explains the HIPAA marketing rules for medical practices, and the FTC, FCC and advertising platform rules that sit beside them.
What counts as marketing under HIPAA?
Under the HIPAA Privacy Rule, marketing is a communication about a product or service that encourages people to buy or use it. A practice generally needs a patient's written authorization before using their protected health information for marketing. Messages about your own health-related services, treatment and care coordination are usually not marketing, unless a third party pays for them.
The rule has two exceptions that need no authorization: a face-to-face conversation with the patient, and a promotional gift of nominal value. If a third party pays for a marketing message, the authorization must say so. Selling protected health information, such as a patient list, also needs authorization.
Can we use patient testimonials, photos and stories?
Yes, with the patient's signed, written HIPAA authorization. A verbal yes, a patient tagging you on social media, or a general consent form without the required elements is not enough. A valid authorization describes what will be shared, with whom and why, has an expiration date or event, and tells the patient they can revoke it in writing. Keep each signed authorization for at least six years from when it was signed or last in effect, whichever is later.
It must be in plain language, and you cannot make treatment depend on signing it. Under the Privacy Rule's safe harbor method, full-face photos are one of the identifiers that must be removed before health information counts as de-identified, so leaving out a name does not make a story anonymous. Check office photos for patients, schedules and screens before posting them.
The HHS Office for Civil Rights (OCR), which enforces HIPAA, has acted on this. Complete P.T. agreed to pay $25,000 in 2016 after posting testimonials with patients' full names and full-face photos without valid authorizations. Cadia Healthcare Facilities agreed to pay $182,000 in 2025 over patient success stories with names, photos and care details.
How should we reply to online reviews?
Reply briefly and politely, without confirming that the reviewer is a patient and without mentioning any visit, diagnosis, treatment or bill, even if the reviewer shared those details first. Thank them, and invite them to call the office so the conversation can continue privately.
OCR has settled with practices whose replies disclosed patient information. New Vision Dental paid $23,000 in 2022 over replies on Yelp, and Manasa Health Center paid $30,000 in 2023 over replies to Google reviews. The FTC says you may respond publicly, but not with intimidation, groundless legal threats or accusations you know are false.
A reply that protects privacy: "Thank you for sharing this. We take all feedback seriously, but privacy rules mean we cannot discuss anyone's care online. Please call our office manager so we can talk it through."
Can we use tracking pixels and analytics on our website?
Only with care. HHS guidance says tracking tools on pages behind a patient login, such as patient portals, generally have access to protected health information. Sharing that data with a tracking vendor needs a business associate agreement or the patient's HIPAA authorization, and a cookie banner does not count as an authorization.
The HHS bulletin on online tracking technologies was last updated in March 2024. It also covers tracking on a portal login or registration page once a visitor enters details such as a name or email address. In June 2024, a federal court in American Hospital Association v. Becerra set aside one part: that HIPAA applies when a tool links a visitor's IP address to a visit to a public page about specific health conditions or providers. HHS withdrew its appeal in August 2024, and the guidance on logged-in pages still stands.
Google does not offer a business associate agreement for Google Analytics, and tells customers not to place its tags on authenticated pages, which are likely to be covered by HIPAA. The safest approach: no pixels or analytics tags on patient portals, logins, appointment requests or intake forms.
What are the basics for email and text marketing?
Emails and texts about your own services, such as a new location or a flu shot clinic, are usually not HIPAA marketing unless a third party pays you to send them. Marketing email must still follow the CAN-SPAM Act, and marketing texts sent with an autodialer generally need the patient's prior express written consent.
- Email. The FTC's CAN-SPAM guide calls for accurate sender details and subject lines, a clear disclosure that the message is an ad, a postal address, an easy way to opt out, and opt-outs honored within 10 business days.
- Texts. The FCC generally treats texts as calls. Its rules under the Telephone Consumer Protection Act (TCPA) require prior express written consent for marketing texts and calls to mobile numbers sent with an autodialer or a prerecorded voice, and consent cannot be a condition of purchase. Some states add stricter rules of their own.
- Separation. Appointment reminders and other health care messages from your practice are treated differently from marketing under both HIPAA and the TCPA, so keep promotions out of them, and keep diagnoses and recent visits out of marketing messages.
How can we target health ads?
Target ads by location and by the services you offer, not by anyone's health. In personalized advertising, Google treats personal health as a sensitive category, so ads about health conditions and their treatment cannot use customer lists or lookalike audiences. Meta does not allow ads that assert or imply that the viewer has a medical condition.
Google's health in personalized advertising policy covers topics such as treatments for long-term conditions and mental health counseling, and rules out Customer Match, your data segments, audience expansion and lookalike segments for those ads. Meta's personal attributes standard allows an ad announcing a new diabetes treatment, but not one asking viewers whether they have diabetes. Meta also removed targeting options based on health causes in January 2022. And because a patient list shows who receives care from you, keep it out of ad accounts.
What do the FTC rules say about reviews?
The FTC's Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, bans fake reviews, rewards for reviews that must be positive or negative, reviews from insiders that hide their connection to the business, suppressing reviews with threats or intimidation, and buying fake social media followers or views. The FTC can seek civil penalties for knowing violations.
In December 2025, the FTC sent warning letters to 10 companies about possible violations of the rule. The rule does not ban every incentive, but the FTC warns that undisclosed incentives, and asking only happy customers, may still violate the FTC Act. Google's Maps content policy bans incentives for any review and selectively asking for positive ones. The simplest approach is to ask every patient the same way and offer nothing in return.
A practical checklist
- Signed HIPAA authorization on file for every patient name, photo, story or testimonial
- Office photos checked for patients, schedules and screens before posting
- Review replies that never confirm someone is a patient
- No pixels or analytics tags on portals, logins, appointment requests or intake forms
- A business associate agreement with any vendor that receives patient information
- Ads targeted by location and service, with no patient lists uploaded
- Email opt-outs honored, and written consent on file for marketing texts
- The same review request for every patient, with no rewards and no fake reviews
How Masscare can help
Our digital marketing team plans every piece of work for U.S. medical practices around patient privacy and health advertising rules, from websites and search to ads and online reviews.
You approve everything before it goes live, and your practice remains responsible for its own HIPAA compliance and advertising decisions. If a task would involve patient information, such as an appointment request form, we agree with you how it is handled before we start. We plan our work around these rules:
- Patient stories and testimonials only with a signed HIPAA authorization
- Review replies, drafted for your approval, that never confirm someone is a patient
- No advertising pixels on portals, logins or forms where patients share health information
- Ads targeted by location and service, never by health information
Frequently asked questions
Is a patient's verbal permission enough to share their story online?
No. HIPAA requires a signed, written authorization before a practice uses a patient's protected health information in marketing, including their name, photo or story. Keep the signed form for at least six years, as HIPAA requires, note when it expires, and remember that the patient can revoke it in writing at any time.
Can we reply to a review if the patient already shared their own details?
You can reply, but do not confirm that they are a patient, and do not repeat or add any details about their care. A short, polite reply that invites them to call the office is the safest approach. OCR has settled with practices whose replies to online reviews disclosed patient information.
Can we use a Meta Pixel or Google Analytics on our practice website?
It depends on where the tag runs. HHS says tracking tools on patient portals and other logged-in pages generally have access to protected health information, so keep them off those pages, and off logins and health forms, unless the vendor signs a business associate agreement. Google does not offer one for Google Analytics.
Can we offer patients a gift card for leaving a review?
It is best not to. The FTC rule bans incentives tied to positive or negative reviews, and the FTC says failing to disclose an incentive could violate the FTC Act. Google's Maps policy goes further and bans incentives for any review, so a gift card for a Google review is not allowed even if every patient gets one.
Do newsletters to our own patients need HIPAA authorization?
Usually not, if they describe your own health-related services and no third party pays you to send them. If an outside company pays for the message, it counts as marketing and needs authorization. Promotional email must still follow the CAN-SPAM Act, including a postal address and an easy way to opt out.
This page is general information about HIPAA, FTC, FCC and advertising platform rules, not legal advice. Rules, guidance and platform policies change, and state laws can add their own requirements, so talk to a qualified attorney or compliance professional before you act on it. Sources last checked in October 2026.