HIPAA-Aware Marketing: What Practitioners Need to Know

HIPAA is one of the most misunderstood topics in practitioner marketing. Most practitioners either over-comply (treating every marketing activity as if it were covered, missing opportunities) or under-comply (treating nothing as covered, exposing themselves). The reality is more nuanced — and once you understand it, it's not that hard.

First: are you a covered entity?

HIPAA applies to "covered entities" — health care providers who transmit health information electronically in connection with certain transactions, plus their business associates. If you bill insurance electronically, you're almost certainly a covered entity. If you're purely cash-pay and don't engage in those transactions, you may not be — but many state-level privacy laws (e.g., California's CMIA) apply similar obligations regardless. Treat yourself as covered to be safe.

What's covered (and what isn't)

Marketing activities — websites, ads, social media, email newsletters, blog posts — are generally not directly governed by HIPAA when they don't involve protected health information (PHI). The line is whether PHI is being created, transmitted, or stored.

• Public website content — not PHI. Not HIPAA-covered. But still subject to advertising standards and professional ethics.
• Email newsletter signups — name + email only is not PHI. Standard marketing rules apply.
• Lead intake forms — if a prospective client describes their condition, that becomes PHI the moment it's linked to them. Must be transmitted and stored on HIPAA-compliant systems.
• Booking confirmations — appointment date/time + name can be PHI depending on context. Safer to use compliant channels.
• Chatbots and intake assistants — if they collect health information, the entire system must be HIPAA-compliant.

The marketing-activity practical guide

• Keep marketing email (newsletters, lead magnets) strictly separated from clinical communication. Different tools, different rules.
• Never collect health information through a standard contact form. If you need it, route to a HIPAA-compliant intake form (e.g., covered SimplePractice, TherapyPortal, or Hushmail).
• Don't store client PHI in marketing CRMs (HubSpot, Mailchimp, etc.). They're not HIPAA-compliant without BAAs.
• Review your chatbot/intake assistant configuration to ensure it never asks for or stores health information.
• Be careful with testimonials — many licensing boards restrict them; HIPAA is separate but related.

Business Associate Agreements (BAAs)

Any vendor that touches PHI on your behalf must sign a BAA. This includes: your EHR, your telehealth platform, your secure messaging tool, your medical-grade intake form provider. It does not include your website host, your marketing email tool, or your analytics — as long as you're not putting PHI through them.

The chatbot / AI assistant question

This is where most practices get into trouble. A general-purpose chatbot collecting "what brings you in today?" responses is creating PHI the moment the visitor types "I've been struggling with anxiety after my divorce." Configure your intake assistant to redirect clinical questions to a secure form — never store the substance in the chat system itself.

What we do

When we build marketing systems for practitioners, we architect them with the compliance line clearly drawn: marketing tools handle marketing data only, clinical tools handle clinical data only, and the two never mix. We document where the boundaries are so you and your team know exactly what's safe to do where.

This post is general guidance, not legal advice. For your specific situation, consult a health care attorney. Book a free audit and we can help you identify where your current setup may have compliance gaps.