HIPAA Marketing Rules Explained: Authorization, Exceptions, Pixels, and Patient Communications

HIPAA treats a message as "marketing" when it encourages someone to buy or use a product or service, and a covered entity generally needs the patient's signed authorization before using protected health information (PHI) for it 12. Most routine provider and plan messages are exempt (treatment, care coordination, the entity's own health services, refill reminders), unless a third party pays for the message. This guide covers the rules and how to enforce them in a customer data platform (CDP).

Who this is for: privacy officers, marketing operations leads and data architects at hospitals, clinics, payers and their vendors. Part of the regulation hub; see also the healthcare hub.

HIPAA marketing definition (45 CFR 164.501)

The Privacy Rule defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service" 1. Three consequences matter in practice:

• Content decides, not channel. An email, text, letter or portal banner is a "communication"; the test is whether it pushes a product or service.
• Payment decides the exceptions. Most carve-outs stop applying when the covered entity receives "financial remuneration," defined as direct or indirect payment from or on behalf of a third party whose product or service is described 1. Payment for treating a patient is not remuneration.
• Business associates are caught too. HHS clarified in the 2013 Omnibus Rule that if a business associate (including a subcontractor), rather than the covered entity, receives financial remuneration from a third party for a communication, prior authorization is still required 3.

HHS also confirmed two categories that are not marketing at all: communications promoting health in general without promoting a particular provider's product or service (its examples: a healthy diet, routine screening such as annual mammograms), and communications about government programs such as Medicare, Medicaid and CHIP 3.

HIPAA marketing authorization (45 CFR 164.508(a)(3))

A covered entity must obtain an authorization for any use or disclosure of PHI for marketing, with two exceptions: a face-to-face communication to the individual, and a promotional gift of nominal value 2. If the marketing involves financial remuneration to the covered entity from a third party, the authorization must say so 2.

What a marketing authorization must contain

A valid authorization needs the 164.508(c) core elements and statements, plus the remuneration statement for subsidized marketing 2:

1. A specific, meaningful description of the information to be used or disclosed.
2. Who may make the use or disclosure, and who may receive it.
3. A description of each purpose.
4. An expiration date or event.
5. The individual's signature and date.
6. The right to revoke in writing, and how.
7. A statement on whether treatment, payment, enrollment or eligibility can be conditioned on signing. For marketing, the covered entity generally may not condition treatment or payment on the authorization 2.
8. The potential for redisclosure by the recipient.
9. For subsidized marketing, a statement that the covered entity receives remuneration from a third party.

HHS added two practical points in 2013. The authorization does not have to be limited to one product or one sponsor; it may cover "subsidized communications generally" if it describes the purposes adequately and states the right to revoke 3. And once an individual signs, the covered entity may send until the authorization is revoked or expires; if the individual does not sign, it may not use PHI for subsidized communications at all 3.

HIPAA marketing exceptions

HHS also placed adherence messages, generic-equivalent communications and self-administered delivery systems (an insulin pump, for example) inside the refill-reminder exception 3. Its cost illustration: a drug maker funding a pharmacy's cost of drafting, printing and mailing reminders is fine; an extra incentive to keep sending them is not 3. In-kind benefits are not "financial remuneration," so a sponsor supplying materials without paying for the mailing does not trigger authorization 3.

Can hospitals send marketing emails?

Yes, within limits. A hospital can email patients about its own services, such as a new service line, without authorization when no third party pays for the message, because that is a communication describing a health-related service the covered entity provides 1. Authorization is needed when:

• a third party (a device maker, a pharmacy, an insurer, a donor-funded partner) pays, directly or indirectly, for the communication;
• the product or service is not the sender's own and not treatment-related; or
• the email goes to a sponsor's list built from PHI.

Fundraising is a separate regime. The notice of privacy practices must tell individuals they have a right to opt out of fundraising communications 4. Email and text law outside HIPAA also applies; see consent withdrawal and suppression.

HIPAA patient communications and email marketing: worked examples

Sale of PHI, minimum necessary and de-identification

Sale of PHI (164.502(a)(5)(ii))

Covered entities and business associates may not sell PHI without an authorization under 164.508(a)(4), which must state that the disclosure results in remuneration 52. A "sale" is a disclosure where the entity directly or indirectly receives payment from or on behalf of the recipient in exchange for the PHI. Exceptions include treatment and payment disclosures, public health, cost-fee research disclosures, payment from the covered entity to its own business associate, disclosures to the individual, and those required by law 5. The preamble to the 2013 rule explains that an arrangement where a covered entity discloses PHI for remuneration so another entity can market its own product "would now constitute a prohibited 'sale'" 3. If a partner or data broker pays for a patient list, you are in sale territory.

Minimum necessary (164.502(b))

When using, disclosing or requesting PHI, make reasonable efforts to limit it to the minimum needed. The standard does not apply to disclosures to a provider for treatment, to the individual, or under a 164.508 authorization 5. For email service providers and ad platforms, this means sending the fields the send needs (address, first name, language, preferences) and not diagnoses, visit types or free text.

De-identification (164.514)

Information that meets 164.514(a) is not individually identifiable, so marketing analytics can use it without authorization. There are two methods: expert determination, or the safe harbor, which removes 18 identifiers (including names, email addresses, telephone numbers, dates other than year, geographic units smaller than a state with limited three-digit ZIP exceptions, medical record numbers, account numbers, device identifiers, URLs and IP addresses) and requires no actual knowledge that the rest could identify the person 6.

Two consequences. First, outreach to a named person cannot use de-identified data, because reaching them requires an identifier; de-identification serves aggregate reporting, modelling and testing. Second, a re-identification code must not be "derived from or related to information about the individual" 6, so a hash of an email address is hard to defend as a compliant code (our reading; confirm with counsel).

Pixels, tags and third-party tracking

OCR's December 2022 bulletin on online tracking technologies was revised on 18 March 2024, and on 20 June 2024 the Northern District of Texas in American Hospital Association v. Becerra vacated the part treating an IP address plus a visit to an unauthenticated public page as PHI (the "Proscribed Combination"); HHS withdrew its appeal on 29 August 2024 789. The rest of the bulletin was not vacated, and OCR's view that identifiable health information collected through a regulated entity's website or app generally counts as PHI stands 8.

Enforcement examples

| Complete P.T., Pool & Sports Injury Physical Therapy | Posted patient testimonials with full names and full-face photographs on its website without HIPAA-compliant authorizations 12 | $25,000, corrective action plan, one-year reporting | | Northcutt Dental-Fairhope (announced April 2022) | Gave a campaign manager nearly 4,000 patients' names and addresses and a marketing company patients' names and email addresses for the owner's political campaign; no designated privacy official 13 | $62,500 and corrective action plan | | FTC v. GoodRx (not HIPAA; Health Breach Notification Rule) | Shared users' medication and condition data with Facebook, Google and Criteo for advertising 14 | $1.5 million civil penalty (proposed order, 1 Feb 2023), permanent ban on sharing health data for advertising |

These are the clearest marketing-centred matters we could confirm; the pattern is unauthorized use of patient identifiers to promote something. GoodRx sits outside HIPAA but shows other regulators policing ad-tech sharing of health data.

How the rules map to customer data platform (CDP) configuration

A customer data platform (CDP) is where audiences are built and pushed to email, SMS, ads and analytics, so it is the place to enforce purpose limits. The configuration pattern below works in any platform that supports attributes, audiences and audit logs.

1. Purpose tags. Tag every attribute and every audience with its purpose of use: treatment, operations, marketing, sale. Block marketing audiences from drawing on attributes not tagged for marketing.
2. Authorization state as data. Store authorization ID, scope (for example "subsidized communications generally"), expiry date or event, revocation timestamp, form version and source document. Evaluate it at activation time, not only at ingestion.
3. Remuneration flag on campaigns. Any campaign with third-party funding requires a valid authorization on every recipient. The face-to-face exception never applies to digital sends, so the rule is simple: no valid authorization, no send.
4. Suppression. Propagate revocations, expirations and fundraising opt-outs to every destination before the next send, with a tested maximum propagation time.
5. Field allowlists per destination (minimum necessary). Each destination receives only the named fields it needs; free text and clinical fields are never mapped to marketing tools.
6. Destination register. Record, per destination, whether a BAA exists, which product it covers, and its stated limits; use the BAA checklist for martech vendors.
7. Separate de-identified zone. Keep aggregate analytics in a zone holding only data that meets 164.514, with any re-identification key held separately.
8. Audit trail. Log who activated which audience for which purpose and under which authorization version. An append-only ledger makes the record hard to alter.
9. Tracker governance. Inventory tags on authenticated and scheduling pages, and route events through a controlled server-side layer rather than loading ad-platform scripts.

A customer-owned deployment of PrivyCDP keeps PHI in the provider's own environment with an append-only audit ledger; the pattern applies to any platform. For vendor choice see HIPAA-compliant customer data platforms, and for the security side see the HIPAA Security Rule update tracker.

See the HIPAA-ready architecture page for how a customer-owned deployment of PrivyCDP is designed to support these controls, and return to the regulation hub for related trackers.