HIPAA and dental marketing: what the rule says about patient information

Marketing for Dental is an independent referral service, not a marketing agency. When you send the form, your details go to an independent marketing agency that prepares any proposal and does any work.

What HIPAA calls marketing

The Privacy Rule defines marketing in 45 CFR 164.501 as making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. The definition has listed exceptions, such as refill reminders and some communications about a patient’s own treatment and the practice’s operations. Whether a particular message falls inside an exception is exactly the kind of question for the compliance advisor.

The authorization rule

Section 164.508(a)(3) says a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except when the communication is a face-to-face communication made by the covered entity to an individual, or a promotional gift of nominal value provided by the covered entity. If a third party pays for the marketing, the authorization must state that such remuneration is involved.

In plain terms: using patient information for marketing generally needs the patient’s written authorization under HIPAA. A practice’s marketing should be planned with its privacy officer or compliance advisor.

Where everyday marketing meets the rule

Email and text lists

A list built from patient records is patient information. Sending a promotional message to it can be marketing under the rule’s definition. Email campaigns also fall under the federal CAN-SPAM rules, which require a working opt-out and a valid physical postal address in each message.

Website forms

A request form on a dental website should ask only for what the front desk needs to call back: a name, a phone number, an email and the kind of appointment. It should never ask about symptoms, medications or medical history. The less a form collects, the less there is to protect. The dental website design guide covers form design in more detail.

Tracking tools and pixels

Many websites carry analytics and advertising pixels. Tracking tools on a dental website raise HIPAA questions; the practice decides with its compliance advisor. Agree on what any tool may record before it goes on the site, and keep a list of every tool installed.

Review replies

A public reply to a review is a communication from the practice. Never confirm that the reviewer is a patient or mention their care, even when the review itself does. A short thank-you, or an invitation to call the office, says enough. The dental reputation management page goes further, including the review rules Google and the FTC set.

Patient stories and photos

A patient’s face, story or smile in an ad is patient information used for marketing, which brings the authorization rule into play. Patient reviews and endorsements shown on a practice’s own site also fall under the FTC’s endorsement and review rules. Plan any of these with the compliance advisor first.

What an agency should and should not say

Be careful with any provider that calls its work HIPAA certified or promises that the practice will be compliant. The rule binds the practice, and no website, plugin or campaign can take that responsibility away. A careful agency explains what its tools collect, asks before anything touches patient information, and works with the practice’s privacy officer instead of around them.

• Ask which tools the agency will add to the site and what each one records.
• Ask whether any campaign will use patient lists or patient details.
• Ask who at the agency can see form submissions and where they are stored.
• Ask that the practice owns every account, so it can remove access at any time.

Ads and the rules beside HIPAA

HIPAA is about patient information. Other rules cover what the ads say. The ADA Code, binding on ADA members, says no dentist shall advertise in a manner that is false or misleading in any material respect. Google’s healthcare policy expects ads and their landing pages to follow the law and industry standards, and health is one of Google’s sensitive interest categories, so health-related ads face extra limits on audience targeting. Remarketing to people based on health interests is one of the places those limits bite. The dental advertising guide covers the ad rules side by side.

A short checklist for the practice

1. Name the person who approves anything that uses patient information.
2. Keep forms short and free of health questions.
3. List every tracking tool on the site and decide on each with the compliance advisor.
4. Get written authorization before any patient appears in an ad or story.
5. Reply to reviews without confirming anyone is a patient.

None of this stops a practice from marketing. It shapes how. A plan that keeps patient information out of campaigns by default, and brings the compliance advisor in when it cannot, lets the practice advertise with confidence. For a written plan that starts from these rules, get a proposal, or read the wider article on a dental marketing strategy.

Questions practices ask