(786) 808-8288Book a consultation
ENES
A woman edits a photo on her smartphone above a white office desk

Compliance

Healthcare advertising and website compliance: HIPAA marketing rules for practices

HIPAA marketing rules start with a defined term: marketing is a message that encourages patients to buy or use a product or service, minus the exclusions below. Using patient information for marketing takes each patient's signed authorization, unless it is a face-to-face communication or a promotional gift of nominal value (45 CFR 164.508(a)(3)). We provide guidance on digital compliance, healthcare communications, accessibility standards and healthcare advertising requirements.

Book a consultationCall (786) 808-8288

The short answer

What do the HIPAA marketing rules require of a medical practice?

Using patient information for marketing takes each patient's signed authorization, except in a face-to-face communication or for a promotional gift of nominal value. Treatment and describing your own services are not marketing unless a third party pays you for the message, and a cookie banner is not a valid HIPAA authorization. The Advixor Group provides guidance on digital compliance, healthcare communications, accessibility standards and healthcare advertising requirements.

Sources45 CFR part 164, subpart EOCR online tracking bulletin

A marketing team gathers around a laptop to plan a campaign together

Marketing

HIPAA marketing rules: what counts as marketing, and what an authorization must say

Excluded from marketing, unless a third party whose product you describe pays you for the message: treatment, care coordination, recommending other providers or therapies, describing your own services and case management (45 CFR 164.501). Refill reminders for a current prescription stay excluded when any payment is reasonably related to your cost of sending them.

When a third party pays, the authorization must say so (164.508(a)(3)(ii)); selling patient information needs one stating that you will be paid (164.508(a)(4)). Each authorization, in plain language with a copy to the patient (164.508(c)):

  • names the information, who discloses and who receives it, each purpose and an expiration;
  • is signed and dated;
  • states the right to revoke in writing, whether treatment can be conditioned on signing and the risk of redisclosure.

Social Media

Social media compliance: testimonials, photos and replies to reviews

A patient’s name, story or photo tied to their care is protected health information, usable without a valid authorization only where HIPAA permits it (164.508(a)(1)): get the signed form before a testimonial or photo goes online.

The FTC’s reviews rule (16 CFR part 465), in force since October 21, 2024, bans (465.2 to 465.8):

  • fake reviews, including buying them;
  • incentives conditioned on a positive or negative review;
  • undisclosed reviews by officers and managers or by the staff and relatives they ask;
  • unfounded legal threats or intimidation to stop or remove a review;
  • hiding low-rated or negative reviews on your own review page while presenting the rest as most or all of them;
  • fake followers or views.

A general request to all patients for reviews is exempt from 465.2’s purchase and insider provisions (465.2(d)).

Your Website

On log-in pages such as a patient portal, telehealth or online scheduling, OCR says tracking technologies “generally have access to PHI.” Sending it to the vendor takes each patient’s authorization, or a signed business associate agreement plus a Privacy Rule permission. For marketing purposes, disclosures without authorizations “would constitute impermissible disclosures,” and a vendor’s promise to de-identify the data after receiving it is “insufficient.” An ad agency that receives patient information faces the same question (when a consultant becomes your business associate), and tracking tools belong in your risk analysis.

On June 20, 2024 a court vacated the bulletin’s view that an IP address plus a visit to an unauthenticated public page about specific health conditions or providers triggers HIPAA.

“Website banners that ask users to accept or reject a website’s use of tracking technologies, such as cookies, do not constitute a valid HIPAA authorization.”

HHS Office for Civil Rights, bulletin on online tracking technologies (2024)

Ads and Offers

Brand compliance: what a Florida practice’s website, ads and offers must carry

Item Applies to What it requires Rule
Notice of privacy practices HIPAA practices with a website about their services Posted prominently; available electronically 45 CFR 164.520(c)(3)
Nondiscrimination and language-help notices Recipients of HHS financial assistance, such as Florida Medicaid providers A conspicuous place on the website; the language-help notice in English and Florida’s 15 most common languages among people with limited English 45 CFR 92.10, 92.11
Good faith estimate notice Providers scheduling uninsured or self-pay patients Prominent and searchable online, in the office and where scheduling happens; the estimate in 1 or 3 business days 45 CFR 149.610
License type Every ad naming a practitioner The license type; for chapter 458 licensees, M.D., P.A. or A.A. (verify a license) s. 456.072(1)(t); Rule 64B8-11.001(7)
Therapist titles LCSWs, LMFTs, LMHCs and registered interns The title or initials on all promotional materials s. 491.0149
Free or discounted service Physicians, nurses, chapter 491 therapists and other listed licensees The 72-hour statement, in capital letters s. 456.062
Gifts to Medicare or Medicaid patients Any provider OIG’s nominal value: $15 a gift, $75 a year per patient; no cash or cash equivalents OIG, 81 FR 88368

Sources eCFR (current as of Oct 19, 2026); Florida Statutes (2026); Rule 64B8-11.001 (Mar 19, 2026); 81 FR 88368.

The 72-hour statement lets the patient refuse or recover payment for any other service performed as a result of, and within 72 hours of, answering the ad. A bill $400 or more above a good faith estimate opens federal dispute resolution (45 CFR 149.620).

Rule 64B8-11.001(2) deems a physician’s ad deceptive if it misstates facts or tells only part of them, “creates false or unjustified expectations of beneficial assistance,” quotes a fee without its variables, implies superiority over other physicians, omits the physician’s name or claims a specialty from an agency the Board hasn’t approved without the required disclaimer. For fraud or a false representation, the chart’s $10,000 per count is mandatory, not a cap (s. 456.072(2)(d)).

The most one violation can cost, by rule, in dollars (amounts in force in 2026; HIPAA’s uncorrected willful neglect tier reaches $2,190,294)
Florida board fine, per count$10,000
OIG penalty for inducing a Medicare or Medicaid patient, per item$25,595
FTC reviews rule, per violation$53,088
HIPAA, per violation (three lower tiers)$73,011

Sources s. 456.072(2)(d), F.S.; 45 CFR 102.3, Table 1 (2025 adjustment, no 2026 one); 16 CFR 1.98(d) (Jan 17, 2025).

Accessibility

ADA compliance and Section 504: do you need an accessibility consultant?

None of the three rules requires an outside reviewer.

Section 504: 45 CFR 84.84 requires recipients of HHS financial assistance to make their web content and mobile apps meet WCAG 2.1 Level A and AA.

  1. May 11, 2026An interim final rule (91 FR 25496) moved each date a year later; checklists citing 2026 and 2027 are out of date.
  2. May 11, 2027The requirement starts for recipients with 15 or more employees.
  3. May 10, 2028It starts for those with fewer.

Sources 45 CFR 84.84; 91 FR 25496.

  • ADA Title III: a “professional office of a health care provider” is a public accommodation (42 U.S.C. 12181(7)(F)). DOJ has no Title III web regulation; its guidance gives “flexibility in how they comply,” points to WCAG and has “no force or effect of law.”
  • ADA Title II: DOJ’s web rule, with its April 26, 2027 and 2028 dates, covers public entities: state and local governments and their agencies (28 CFR 35.200).

More than 1 in 4 U.S. adults have some type of disability (CDC, May 5, 2026).

Our Guidance

What our healthcare marketing compliance guidance covers, and what goes to your attorney

We review your website, ads and tracking set-up, draft testimonial authorizations, test the site against WCAG 2.1 AA and train staff on review replies.

We provide compliance consulting and coordination, not legal advice: whether an ad is deceptive, a vendor is a business associate, a program fits an exception or an accessibility rule reaches your practice is for your own attorney.

Marketing compliance

As part of your compliance program, we:

  • Develop, review and implement required patient notices and acknowledgments
  • Coordinate HIPAA training
  • Monitor rule changes

We also assist with audits and investigations.

Book a consultation

What’s included

What our brand and marketing compliance service includes

HIPAA compliance

HIPAA's documents and deadlines, from the privacy notice to breach response.

Learn more

HIPAA BAAs

When a vendor needs a business associate agreement, and what it must say.

Learn more

HIPAA risk assessment

What a security risk analysis covers and what OCR expects.

Learn more

HIPAA checklist

Every HIPAA task on one checklist, including your online privacy notice.

Learn more

Compliance training

HIPAA, OSHA and fraud, waste and abuse training by role, with records.

Learn more

Business development

The referral laws a paid marketing deal must clear, including Florida's Patient Brokering Act.

Learn more

Quick answers

HIPAA marketing rules: plan ads, before-and-after photos and staff posts

Brand compliance, advertising the plans you accept, before-and-after photos, staff posts about patients and the records that prove compliance. Bring your own ads to a consultation.

A designer reviews a web page on a laptop beside printed wireframe sketches
What does brand compliance mean for a medical practice?
Every ad, post, review reply and web page meeting the rules on this page, from HIPAA to Florida's advertising rules.
Can we advertise the Medicare Advantage plans we accept?
Naming the plans you contract with, and announcing an affiliation "through any means of distribution" once the plan contract is signed, are provider-initiated activities outside the Medicare Advantage marketing rules (42 CFR 422.2266(c)). When you act for a plan, the plan must ensure you don't collect enrollment or Scope of Appointment forms, urge patients to enroll or take its pay for marketing (422.2266(d)).
Can a dermatology or aesthetics practice post before-and-after photos?
The authorization rule under social media compliance above covers identifiable patient information, and HIPAA's de-identification list includes "full face photographic images and any comparable images" and any "unique identifying number, characteristic, or code" (45 CFR 164.514(b)(2)). Florida's advertising rules apply too.
What happens when an employee posts about a patient on social media?
An impermissible disclosure is presumed a breach unless a documented risk assessment shows a low probability of compromise (see HIPAA compliance). Apply and document a sanction (45 CFR 164.530(e)); see our HR guidance on corrective action.
Which records prove brand compliance if the Board or OCR asks?
Signed marketing authorizations and each privacy notice you issued, kept 6 years (45 CFR 164.508(b)(6), 164.520(e), 164.530(j)); for a physician advertising on electronic media, an exact copy of the audio or video for at least 6 months (Rule 64B8-11.001(4)).

Keep reading

Related

Compliance

Healthcare compliance consulting for practices: OIG's seven elements, policies, risk assessments, mock surveys, corrective action plans and training.

Learn more

Talk to an advisor

You care for patients. Who’s taking care of the business?

Tell us where your practice is today. We will tell you what we would do first.

Book a consultationor call (786) 808-8288

Official sources

All read Oct 20, 2026.