HIPAA and Marketing: What Healthcare Marketers Need to Know

For nearly two decades, the Health Insurance Portability and Accountability Act (HIPAA) has protected patient privacy, reduced fraud and changed how healthcare providers interact with patients.

HIPAA also changed how healthcare systems and private practices attract and retain patients through various marketing channels.

We put together our top HIPAA marketing rules to help you, the healthcare marketer, stay effective and on-message with your content while remaining HIPAA-compliant.

Why? Because to create messaging without infringing on medical privacy, healthcare marketers need to know what data is covered by HIPAA.

And a quick note: We’re really good marketers but really bad and highly unqualified lawyers. Even if you’ve taken the time to read every word of this piece and have spent hours watching Matlock, always consult with a legal expert to keep your healthcare-related communications HIPAA-compliant!

First, What Private, Personal Information Is Covered By HIPAA?

HIPAA protects “individually identifiable health information,” otherwise referred to as “personal health information,” or PHI. But what is that, exactly?

PHI includes a range of personal medical information, including:

• Past, present or future physical or mental health condition.
• Past, present or future payment for the provision of health services to the individual.
• Medical records.
• Billing information.
• Demographic information, including name, address and date of birth.

HIPAA-Compliant Marketing: Your Restrictions and Best Practices

Regulators updated HIPAA in 2002 to specifically address the risks posed by the digital age. Email marketing, social media and other digital marketing channels created new vulnerabilities in patient privacy, which resulted in an expanded definition of marketing within HIPAA verbiage. And as you can see, it’s about as broad as can be:

“…a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.”

Follow our HIPAA tips to put your internal team or marketing vendor in a position to succeed without upsetting your audience or the federal government:

1. Understand patient authorization

Individual authorization must be received before using PHI for marketing. If your practice plans to market any medical goods or services based on PHI, any marketing uses must be specifically included in your practice’s HIPAA Authorization form.

There are only two exceptions to this rule:

• The marketing communication occurs in person between the healthcare provider and the patient.
• The communication includes a promotional gift.

The Department of Health and Human Services has a comprehensive guide to creating a HIPAA form, including one that includes marketing authorization. 

2. Use HIPAA-compliant marketing tools

Google Ads, Meta and even HubSpot are not HIPAA-compliant marketing tools. Several healthcare-specific marketing platforms have established a niche presence by offering HIPAA-compliant marketing analytics and automation tools for healthcare marketers. Companies like Improvado, Paubox and ActiveCampaign aggregate user data and remove identifying information automatically, and offer valuable engagement insights without crossing the privacy red line.

3. Use look-alike audiences (but make your own!)

While most marketers upload customer data to Facebook or Google, healthcare marketers must do their list-building offline. Instead, they use a spreadsheet to aggregate data by averaging demographic information based on age, gender, or history without uploading PHI to another platform. Instead of seeing a list of 100 users with a  gender assigned to each user ID, you might simply operate on the principle that 51% of users are male.

4. Regulate access

Two-factor authentication, unique login credentials and change logs are critical in protecting privacy data internally.

• 2FA – Two-factor authentication requires an individual account and secondary confirmation via email, authenticator app or text.
• Unique authentication – Controls access levels based on unique user credentials to gate the most sensitive data. For example, lower access levels may prevent users from exporting data to a spreadsheet or PDF or limit what information they can see within the marketing software.
• Audit changelogs – Check user logins, data downloads and other information to see who is accessing what within your team. You can prevent internal and external data breaches by tracking changes from new IP addresses or locations.

There’s considerably more “work around the work” for healthcare marketers, but it’s essential for protecting patient privacy and your practice.

Related: What Does an ADA-Compliant Website Look Like?

HIPAA Compliance: The Two Toughest Channels

There are platforms and workarounds for social media, SEO and paid search, but direct mail and email marketing are two marketing channels that are especially challenging for healthcare marketers.

HIPAA-compliant direct mail requires, at minimum, two closely guarded pieces of personal information: name and address. Email marketing offers more segmentation opportunities but depends on active authorization.

• Direct mail – While most marketing agents offer direct mail services, few are HIPAA-certified. Certification requires sophisticated printing equipment, end-to-end encrypted software and other measures to enhance security. Even conversions like QR code tracking or patient inquiries can’t be linked to specific campaigns, which makes measuring direct mail ROI especially challenging.
• Email marketing – HIPAA-compliant email marketing is all about authorization. Always obtain written or digital patient consent and provide clear opt-out options in every campaign. Like direct mail services, several HIPAA-compliant email marketing platforms have the authentication and encryption capacity to protect user privacy while generating actionable reports and metrics.

One Last Word of Advice

Make compliance a priority. Audits, compliance checks and proactive research to stay ahead of changing standards are smart ways to avoid costly fines and the loss of your patients’ trust. When in doubt, check with a Department of Health and Human Services representative to make sure your marketing efforts are above board.

A Healthy Dose of Healthcare Marketing Expertise

We’ve been in the game longer than HIPAA’s been on the books. Oneupweb has seen the marketing landscape shift gradually toward user privacy; a trend that puts healthcare marketers in a familiar position.

As your vendor, we’ll help create smart, HIPAA-compliant campaigns that drive results. Give your marketing a checkup today; get in touch or call (231) 922-9977 to schedule your appointment, er, conversation.