Building compliant patient marketing under HIPAA and TCPA constraints

# Building compliant patient marketing under HIPAA and TCPA constraints

A hospital ran a Meta retargetingretargetingShowing ads to users who have previously visited your site or interacted with your brand, to bring them back and drive conversion.View full definition → campaign for its cardiology service line. It placed a tracking pixel (a small piece of code that reports visitor activity back to an ad platform) on its "Book a Cardiologist" page. Weeks later, it faced a federal investigation. The pixel had quietly sent identifiable data about which patients viewed which condition pages to a third party. That transmission became a HIPAA violation before a single ad even converted.

This is not a rare edge case. Between 2022 and 2024, dozens of US health systems disclosed similar pixel-related breaches, some affecting millions of patients. The lesson: in healthcare, the marketing tools that work everywhere else can quietly turn routine campaigns into reportable breaches.

The two rules that reshape everything

Two federal laws govern how you reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → patients. Learn them before you touch a campaign.

HIPAA (the Health Insurance Portability and Accountability Act) protects PHI, or Protected Health Information. PHI is any health information tied to an identifiable person: name, email, IP address, appointment type, condition, or even the fact that someone is a patient of your oncology clinic.

The trap: identity plus health context equals PHI. "John Smith" is not PHI. "John Smith viewed our diabetes page" is.

TCPA (the Telephone Consumer Protection Act) governs how you contact people by phone, text, and automated calls. It requires specific consent before you send marketing texts or place automated calls, and it is enforced through lawsuits with steep per-message penalties.

HIPAA controls what data you can use. TCPA controls how you can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → out. A compliant campaign satisfies both.

Why the pixel broke the law

Back to our cardiology campaign. Here is the mechanical failure.

A standard tracking pixel captures the visitor's IP address, the page URL, and often a device identifier, then sends it to the ad platform. On a retail site, that is fine. On a hospital site, the page URL ("/cardiology/heart-failure") plus the IP address becomes PHI, because it reveals a specific person's health interest to a company that is not authorized to receive it.

Under HIPAA, sharing PHI with a vendor requires a Business Associate Agreement (a BAA, a contract making the vendor legally responsible for protecting the data). Major ad platforms generally will not sign BAAs for their advertising pixels. So the moment the pixel fired on a health page, the hospital disclosed PHI to a party with no BAA and no patient authorization.

The US Department of Health and Human Services issued guidance on tracking technologies that spells this out. Worth reading in full before your next digital campaign.

What you can still do

Compliance does not kill marketing. It changes your inputs. Here is what stays open.

Market to audiences, not identified patients

You can advertise service lines to broad, non-patient audiences: people in your region interested in general health topics. What you cannot do is retarget based on which condition page someone visited on your authenticated or health-specific pages.

Concrete line: promoting a "Free Heart Health Screening" to a geographic audience is fine. Building a custom audience of "people who viewed our heart failure page" and uploading it to an ad platform is not.

Use PHI only with authorization

HIPAA lets you use PHI for marketing only with the patient's written authorization, with narrow exceptions. One key exception: you may send treatment and care reminders (appointment reminders, refill reminders, follow-up instructions) without marketing authorization, because those are healthcare operations, not marketing.

So "Your annual mammogram is due, call to schedule" is generally permitted as a care communication. "Our new med spa is offering 20% off Botox" to the same list is marketing and needs authorization.

Keep vendors under BAAs

Any vendor that touches PHI (your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, email platform, call center, analytics tool) must sign a BAA. Before adopting a martech tool, ask one question: will you sign a BAA? If the answer is no, that tool cannot touch patient data.

Handling phone and text under TCPA

TCPA layers on top of HIPAA. Even a HIPAA-permitted message can violate TCPA if you lack the right consent.

The rule of thumb:

• Appointment and care reminders by text or automated call generally require prior express consent (the patient gave you the number and agreed to be contacted for that purpose). Collecting a phone number at intake with a clear notice usually covers this.
• Marketing messages (promotions, new service announcements) by automated text or call require prior express written consent, a higher bar. The patient must specifically agree, in writing, to receive marketing.

Practical design: separate your consent checkboxes at intake. One for care communications. One for marketing. Never bundle them. Never pre-check the marketing box.

Also honor opt-outs immediately. A "STOP" reply must remove the person from all future texts. Log the timestamp.

A simple consent data model

If you build or buy a patient contact system, your records should distinguish consent types clearly:

patient_id: 48213
phone: +1XXXXXXXXXX
care_reminder_consent: true    (captured at intake 2026-02-10)
marketing_consent: false       (not obtained)
consent_source: "intake_form_v3"
opt_out_timestamp: null

This structure lets your team answer the only question that matters in an audit: for this exact message, to this exact person, did we have the required consent, and can we prove it?

Building the compliant campaign, step by step

Here is how a marketing lead should actually plan a patient-facing campaign in 2026.

Step 1: Classify the data. List every data element the campaign touches. Flag anything that combines identity with health context. That is PHI and triggers HIPAA.

Step 2: Choose the reach method and map the consent. Email, text, mail, and calls each carry different rules. Match each channel to the consent you actually hold. No marketing consent means no marketing text, full stop.

Step 3: Audit your website tags. Before running digital ads, inventory every pixel and script on your patient-facing pages. Remove or restrict tracking on any page that reveals a health condition or an authenticated patient area. Many systems now use a server-side approach or a HIPAA-compliant analytics vendor under a BAA to strip identifiers before any data leaves their control.

Step 4: Confirm every vendor has a BAA. No BAA, no PHI. Route non-compliant tools away from patient data entirely.

Step 5: Document the decision. Write down why the campaign is compliant: what data, what consent, what vendors. If a regulator asks, this record is your defense.

A quick contrast

Non-compliant: retarget heart failure page visitors with cardiology ads via an ad pixel and no BAA.

Compliant: run a geo-targeted awareness campaign for a heart health screening event to a general audience, drive traffic to a clean landing page with no health-condition URL, and capture separate marketing consent from anyone who registers.