Three rulebooks, then six parts. HIPAA: what tracking may run where, and what marketing may use patient data. The FTC: what you may claim and how reviews are handled. Canada: PIPEDA and the provincial health privacy laws. Then local search, a clean website, clinician-written content, lawful email, paid search without patient-data targeting, and measurement by booked patients.
Two things we never say: that any outcome is promised, and that we are HIPAA compliant or certified. We do sign HIPAA business associate agreements where our work touches protected health information; where data is hosted is settled in your contract and your security review.
Rule 1: HIPAA and website tracking
The U.S. Department of Health and Human Services' Office for Civil Rights explains, in its bulletin on online tracking technologies, that cookies, pixels, session replay and fingerprinting scripts on a regulated entity's website or app are subject to the HIPAA Rules when the information they collect or send to a vendor is protected health information. On authenticated pages such as a patient portal or telehealth platform, tracking technologies generally have access to PHI. On unauthenticated pages, the bulletin says tracking may still reach PHI where a page lets a person book an appointment or use a symptom checker, or where login or registration details are entered; a general page about visiting hours or job postings does not. A tracking vendor that receives PHI is a business associate and needs a business associate agreement, and the bulletin is explicit that a website banner asking users to accept cookies does not constitute a valid HIPAA authorization, and that a vendor's promise to strip or de-identify the data afterwards is not enough.
The same page carries a note on its own legal status: on 20 June 2024, in American Hospital Association v. Becerra, the U.S. District Court for the Northern District of Texas vacated the guidance to the extent it provides that HIPAA obligations are triggered where an online technology connects an individual's IP address with a visit to an unauthenticated public webpage addressing specific health conditions or providers, and HHS says it is evaluating its next steps. The practical rule for a marketing team is unchanged where it matters: keep ad pixels, retargeting tags and session recording off appointment forms, symptom checkers, portal login and registration pages and anywhere a person enters health details, and run analytics there only through a vendor under a BAA. Our guide to HIPAA-compliant website design sets out how to build that.
Rule 2: HIPAA and marketing with patient data
HHS's guidance on marketing under the Privacy Rule (45 CFR 164.501 and 164.508(a)(3)) defines marketing as a communication about a product or service that encourages recipients to purchase or use it, and says that, with limited exceptions, a covered entity needs an individual's written authorization before using or disclosing protected health information for marketing. The exceptions cover a covered entity's communications about its own health-related products and services, treatment communications such as refill reminders, and care coordination; face-to-face communications and promotional gifts of nominal value need no authorization. Selling or sharing a patient list with a third party for that party's marketing is marketing with no exception, and an authorization that involves payment must say so. For a practice this means: emailing your own patients about your own new service or location is generally within the exceptions, while using patient lists for a third party's offer, or uploading patient data to an ad platform for targeting, needs each patient's written authorization. Ask counsel before any campaign that touches the patient record.
Rule 3: The FTC on health claims, reviews and testimonials
The Federal Trade Commission's Health Products Compliance Guidance (December 2022) says that claims about health benefits require substantiation in the form of competent and reliable scientific evidence, which for health benefit claims will generally need to be randomized, controlled human clinical testing; that before-and-after images and testimonials convey claims the advertiser must be able to substantiate; and that a disclaimer such as “results not typical” does not cure the deception. For a practice or a med spa, that rules out promised outcomes, cure language and before-and-after photos presented as what a typical patient gets. Describe the procedure, who it is for and the risks, and let the clinician speak.
Reviews carry three rules. The FTC's Endorsement Guides, revised in 2023, require clear disclosure of any connection a reader would not expect, such as payment or a free treatment. The FTC's rule on fake reviews, announced in August 2024, bans fake, bought and undisclosed insider reviews with civil penalties. Google's Maps content policy forbids incentives for reviews and asking only happy patients. And under HIPAA, a patient's story, name or photo in your marketing needs the patient's written authorization. Ask every patient, offer nothing, reply to every review without confirming anything about the patient's care, and use stories only with signed authorization.
Rule 4: Apps outside HIPAA, and Canada
A health app offered by a company that is not a HIPAA covered entity or business associate falls outside HIPAA, and the FTC's Health Breach Notification Rule, amended in April 2024, applies to health apps and similar technologies not covered by HIPAA, requiring notification of individuals, the FTC and sometimes the media after a breach of unsecured health data. In Canada, the Office of the Privacy Commissioner's PIPEDA in brief explains that the federal private-sector law sets the rules for collecting, using and disclosing personal information in commercial activity, that Alberta, British Columbia and Quebec have substantially similar provincial laws, and that provincial health privacy laws, such as Ontario's PHIPA, apply to health information as well. Read the laws that apply to your province before any campaign.
Part 1: Local search for each location and service line
Most new patients find a practice on the map. Google's guidance on local ranking says local results rest on relevance, distance and prominence, that a complete and accurate profile is more likely to show, that replying to reviews helps a business stand out, and that there is no way to pay for a better local ranking. Each location gets a verified Business Profile with the practice's real name, the right category, hours, insurance accepted where you choose to show it, the services listed, photos of the real office and team, and a link to a booking page built as rule 1 requires; each clinician may hold a profile where the guidelines allow. Reviews follow rule 3. Our local SEO service page covers the work, and our healthcare SEO page covers the search side for health brands.
Part 2: A website built without pixels on patient forms
The website is where rule 1 is won or lost. Build the marketing pages and the patient pages so that analytics and ad tags run only where no health information is entered, keep appointment requests, symptom tools and portal links on pages with no third-party tags or under a BAA, and host and encrypt as your security review requires. Then make the site do its marketing job: a page per service line and per location, clinician pages with credentials, insurance and cost information where you choose to publish it, accessibility, and a booking path that works on a phone. Our guides to the HIPAA side of a practice website and medical website design cover the two halves.
Part 3: Content written or reviewed by clinicians
Health content is held to the highest standard by patients and by Google. Google's helpful content guidance asks whether a page shows first-hand expertise, is written or reviewed by someone who demonstrably knows the topic, and gives readers reasons to trust it, naming trust as the most important quality. For a practice that means pages that answer what patients ask before booking, each written or reviewed by a named clinician with credentials, dated, with sources, and with no promised outcome. Our content marketing page covers how we plan and draft with a clinical team, and our guide to medical practice marketing strategies covers the plan around the content.
Part 4: Email and messaging to patients, within three laws
Email to patients sits under HIPAA's marketing rules (rule 2), and under the FTC's CAN-SPAM guide in the USA, which requires accurate headers, a truthful subject line, identification as an advertisement where the message is one, a postal address and an opt-out honored within 10 business days, with penalties up to $53,088 per email, and under CASL in Canada, which requires consent before a commercial electronic message. Appointment reminders and recall notices are treatment communications; promotional messages about new services are within HIPAA's own-services exception but still need CAN-SPAM or CASL compliance; anything on behalf of a third party needs written authorization. Keep the kinds separate and recorded.
Part 5: Paid search and social without patient-data targeting
Paid search on service and location terms brings patients with a need now, and paid social reaches people by area and interest, but the audiences cannot be built from patient data without each patient's authorization, and the conversion tracking cannot send health details to the platform. Run campaigns by service line and location, land them on pages built as rule 1 requires, count booked appointments through a tracking method your compliance review has approved, and keep the creative inside rule 3. Our guides to med spa marketing ideas and physical therapy marketing ideas cover two specialties, and the kept guide to digital marketing for dentists covers a third.
Part 6: Apps and portals
A practice's app or portal is part of its marketing when it is how patients book, pay and come back, and it is regulated as rule 1 and rule 4 describe. Our guide to healthcare app development cost covers what drives the price of building one, including the compliance work.
How to measure healthcare marketing
Measure booked and kept appointments by source, location and service line, each month, through a method your compliance review has approved, and never by sending patient details to an ad platform. Add calls and booking requests from the Business Profile, reviews received and replied to, and website booking-path completion on a phone. Review monthly with the practice manager and move effort toward the locations and service lines with capacity. Visits, clicks and followers are context only.
If you want it run with you
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. Our local SEO and content planning and writing pages cover the work we do for practices and clinics, and our healthcare industry page list the sectors we work with. Our India company has worked for healthcare and wellness clients including Mega We Care, an international healthcare and wellness company, for its India business. We are a marketing company: we do not certify compliance and we do not call ourselves HIPAA compliant, and we sign HIPAA business associate agreements where our work touches patient data. This guide is general information, not legal advice.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.