HIPAA Marketing Rules Checker

What HIPAA says about marketing, and what the FTC adds.

Two different rulebooks reach a practice's marketing. HIPAA decides when you may use a patient's information in it. The FTC decides what you may claim. This page walks through both, the words each one catches, and where a phrase checker helps and where it stops.

This checks copy, not trackers

Search for a HIPAA marketing checker and most results scan a website for tracking pixels: the Meta pixel, analytics tags, session recorders, and whether they send visitor data from a patient portal or appointment page to a third party. That is a real question, and HHS's Office for Civil Rights has published separate guidance on online tracking technologies (paraphrased here; we could not load the HHS page when this was written). It is not what this tool does. This tool reads the words you paste and nothing else. It never visits your site, never loads a tag, and never sees your analytics.

What counts as marketing under HIPAA

HIPAA's definition of marketing is a term of art and much narrower than advertising. Under 45 CFR 164.501, marketing "means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service." The same definition then takes things back out. Communications made "for treatment of an individual by a health care provider", including recommending "alternative treatments, therapies, health care providers, or settings of care", are not marketing. Neither is a communication that describes "a health-related product or service" that is "provided by" the covered entity making it, nor a refill reminder about a drug currently prescribed.

Every one of those exceptions has the same condition attached: it holds only while no third party pays you to send the message. The rule defines that payment as "direct or indirect payment from or on behalf of a third party whose product or service is being described", and adds that it "does not include any payment for treatment of an individual." So a patient paying for their own care never turns a message into marketing. A device maker paying you to promote its product can.

HIPAA marketing authorization

The definition only settles whether a communication is marketing. The rule that bites is 45 CFR 164.508(a)(3): "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: (A) A face-to-face communication made by a covered entity to an individual; or (B) A promotional gift of nominal value provided by the covered entity." Read the object of that sentence. The authorization attaches to a use of protected health information, not to marketing as such. An article about root canals or sleep apnoea that names nobody uses none, so there is nothing for the authorization to attach to. A patient's story, a photograph, a quoted review or a before-and-after pair is where it lives.

When a third party pays, the form changes too: "If the marketing involves financial remuneration ... to the covered entity from a third party, the authorization must state that such remuneration is involved." And a valid authorization under 164.508(c) is not a checkbox. It must describe the information "in a specific and meaningful fashion", name who may disclose it and who may receive it, describe "each purpose", carry "an expiration date or an expiration event", and be signed and dated. It must also tell the patient about the right to revoke in writing, whether treatment can be conditioned on signing, and that the information may be redisclosed and "no longer be protected". It must be "written in plain language", and the patient gets a copy.

If an agency or a freelancer handles patient information to produce your marketing, HIPAA's business associate rules come in as well: 45 CFR 164.502(e) lets you share it with a business associate only if you obtain "satisfactory assurance that the business associate will appropriately safeguard the information", which in practice is the business associate agreement. None of this is visible in the words of an ad, which is why a copy checker cannot tell you whether you have it. Our rule explainer for practices works through the definitions with worked examples.

Testimonials, reviews and before-and-after photos

This is where most practice marketing questions end up, and HIPAA's answer turns on one thing: could a reader work out who the patient is? A quote with a first name, an age and a town, or a photograph of a face, is protected health information in marketing, and needs the patient's signed authorization first. Replies to online reviews are the same trap in a different place. A reply that confirms the reviewer is your patient, or mentions their visit or treatment, discloses their health information; that is our reading of the definitions above, and the safe reply stays general. This checker does not detect either. The product's own patient-identifier check looks only for a Social Security number or a date of birth written into the text, and it does not run in this free tool. Nothing here, or in the product yet, reads a named patient story as a problem.

FTC health claims: the second rulebook

Most HIPAA marketing guides stop at authorization. The claims inside the ad answer to the FTC, and its standard is strict. The FTC's Health Products Compliance Guidance, which the pack cites, says health benefit claims need "competent and reliable scientific evidence", and that "Randomized, controlled human clinical trials (RCTs) are the most reliable form of evidence and are generally the type of substantiation that experts would require for health benefit claims." Two further lines from the same guidance matter for practice copy. First: "Vague qualifying terms are inadequate. For example, it's not enough to say that the product 'may' have the claimed benefit or 'helps' achieve the claimed benefit." Second: "Anecdotal evidence about the individual experiences of consumers ... are never sufficient to substantiate claims," and "a healthcare practitioner's observation about the effect of a health product on patients is anecdotal." A glowing patient story, even a real and authorized one, does not prove the treatment works.

The guidance also shows that images make claims. Its example is an ointment whose "before" picture shows a woman with a walker and whose "after" picture shows her dancing, which it says "likely convey a claim that the product can dramatically improve the symptoms of arthritis." A before-and-after pair on a practice page carries a claim in the same way, and this checker cannot read images at all. The pack also cites the FTC's Endorsement Guides (16 CFR Part 255) and its rule on consumer reviews and testimonials (16 CFR Part 465); those are about how endorsements are obtained and disclosed, and no pattern here checks them. Our guide to FTC health claims goes further.

What the medical pack flags

The US Medical / Dental (HIPAA + FTC) pack carries 3 claim rules of its own and inherits 10 from the Base YMYL Foundation. Each phrase below was run through the rule beside it and matched; the tier is the pack's.

The cure rule names a long list of conditions a practice writes about, from arthritis and back pain to migraines, sleep apnea and gum disease, and it reads "cured my arthritis" and "cured of" as well as "cures arthritis". "Guaranteed results" trips both the cure rule and the base guarantee rule. A negation in front of the claim keeps it clean, so "there is no cure for arthritis" passes. A hedge does not: "may help cure arthritis" is flagged, which is the FTC line above in pattern form, since a vague qualifier does not substantiate the claim. The superiority rule is review tier rather than hard, because a real award can sit behind "best dentist" and a pattern cannot tell: in Verand it holds the draft until an operator overrides it and writes down why.

The medical disclaimer, checked by phrase

The pack carries one Medical Disclaimer block, meant to sit once at the end of a post, above its sources. Practices reword these constantly, so the checker does not demand the exact text. It looks for the five phrases that carry the weight: "informational", "substitute for professional medical advice", "physician-patient relationship", "seek the advice" or "consult", and "emergency" or "911". If any is missing, the block is flagged with a count.

Below is a real run: the opening and the Medical Disclaimer block from Verand's own disclaimer requirements page, pasted as published and checked against the pack. No claim rule matched and all five phrases were found. The citation row is advisory, and it is honest: a short excerpt with no links does not meet the pack's citation minimum for a full article. A clean card like this says the listed problems are absent. It does not say the post above the block is allowed.

Manual review versus a phrase checker

A reviewer reads for meaning: whether a patient could be identified, whether you hold their signed authorization, whether a third party paid for the message, whether a claim has trials behind it. None of that is a pattern. What a deterministic checker does well is the other half: it reads every occurrence of every rule the same way, every time, on every draft, and never skims the fourth paragraph. The price is literalness. It catches "cured my arthritis" and misses "my arthritis is gone for good". Treat a clean result as the absence of the listed problems, not as a green light.

Common mistakes

• Treating a clean scan as sign-off. No tool can tell you a piece is allowed. This one can tell you it did not find the patterns it knows.
• Swapping a name for initials. The question is whether a reader could work out who the patient is. Initials beside an age, a town and a photograph often do not change the answer.
• Hedging instead of substantiating. "May help reduce" passes the cure pattern, and the FTC says a vague qualifier is not enough on its own. The evidence has to exist.
• Leaving the disclaimer in the footer. A patient lands on one post from one search. Paste the whole post, disclaimer included, or it will read as missing.
• Pasting real patient details to test the tool. Nothing is stored, and the check never needs them. Use the words you plan to publish, with the patient left out.
• Confusing this with a tracker scan. A clean result here says nothing about the pixels on your appointment page.