Building compliant patient marketing under HIPAA and TCPA constraints

# Building compliant patient marketing under HIPAA and TCPA constraints

In June 2022, Novant Health notified roughly 1.36 million patients that a Meta pixel added to its website and scheduling pages during a COVID-19 vaccine promotion had been transmitting their data to Meta. Marketing installed the tag to measure ad performance. Nobody involved thought of it as disclosing health information. The class action that followed settled for several million dollars, and the incident sits permanently on a public federal breach list.

Every stage of the acquisition funnelfunnelThe customer journey from awareness to purchase, typically Awareness, Interest, Consideration, Decision, Action, with prospects narrowing at each stage.View full definition → the mapping lesson describes has a mechanic underneath it: a tag, an audience list, a text message, a recorded call. This lesson is about which of those mechanics survive contact with two federal statutes, settled before anyone writes a campaign brief.

The two rules that reshape everything

HIPAA (the Health Insurance Portability and Accountability Act) protects PHI, Protected Health Information: health information tied to an identifiable person. The regulation lists 18 identifiers, and the ones that catch marketers are IP address, device identifiers, email address and URLs. "John Smith" is not PHI. An IP address landing on /cardiology/heart-failure is.

TCPA (the Telephone Consumer Protection Act) governs phone, text and automated calls. It requires specific consent before marketing texts or autodialed calls, and it is enforced mostly by private lawsuits carrying statutory damages of $500 per message, up to $1,500 where the violation is willful.

HIPAA controls what data you may use. TCPA controls how you may reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → out. A campaign has to clear both.

Why the pixel broke the law

A tracking pixel (a snippet of code that reports visitor activity back to an ad platform) captures the visitor's IP address, the full page URL and usually a cookie or device ID, then posts all of it to the platform. On a retail site that is unremarkable. On /cardiology/heart-failure it hands a named person's health interest to a company with no right to receive it.

Sharing PHI with a vendor requires a Business Associate Agreement (a BAA, the contract that makes a vendor legally accountable for the data it handles). Meta does not sign BAAs for its advertising products. Its business tools terms take the opposite approach: they forbid advertisers from sending sensitive health data and place the obligation on the advertiser. Meta also runs automated filtering meant to catch some potentially sensitive data. Treating that filter as your control is the failure mode. It protects Meta from Meta's exposure; it is not evidence that you met yours, and it does not appear in any regulator's analysis of what you disclosed.

The US Department of Health and Human Services issued guidance on tracking technologies in December 2022. In June 2024, a federal court in Texas vacated the part of that guidance covering unauthenticated public pages, after a challenge brought by the American Hospital Association. That narrowed the enforcement theory. It did nothing to the state wiretapping and privacy class actions, which are now the bigger financial risk for most systems and which do not turn on whether a page was authenticated.

What you can still do

Market to audiences, not identified patients

Geographic and general-interest targeting stays open. Promoting a free heart health screening to adults over 50 within 25 miles is fine. Building a custom audience of people who viewed your heart failure page and uploading it is not. Meta removed detailed health-related targeting categories in January 2022, so a good part of that door closed on the platform side regardless of what you would have been willing to do.

Use PHI only with authorization

Treatment and healthcare operations communications (appointment reminders, refill reminders, follow-up instructions) do not need marketing authorization. "Your annual mammogram is due, call to schedule" is a care communication. "20% off Botox at our new med spa" to the same list is marketing and needs written authorization. The line moves the moment money changes hands: if a third party funds a refill reminder, the payment has to stay reasonably related to the cost of sending it, or the communication turns into paid marketing.

Keep vendors under BAAs, then check whether the BAA is even the question

CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, email platform, call center, analytics tool: anything touching PHI signs a BAA or it does not touch patient data. Ask the question during vendor selection, not after the contract.

The counter-example matters more than the rule. GoodRx and BetterHelp are not HIPAA covered entities, so no BAA analysis applied to them at all, and both were penalised anyway. In February 2023 the FTC fined GoodRx $1.5 million in the first case brought under the Health Breach Notification Rule, for sending user health data to Meta, Google and others for advertising. The month after, BetterHelp agreed to pay $7.8 million for handing email addresses and intake questionnaire answers to advertising platforms, including to build custom and lookalike audiences, after telling users it would not. Hospital marketing teams running telehealth brands, wellness apps or symptom quizzes often sit under both regimes at once, and the FTC route has no BAA to hide behind.

Handling phone and text under TCPA

Even a HIPAA-permitted message can violate TCPA if the consent is wrong.

• Appointment and care reminders by text or automated call generally require prior express consent: the patient gave you the number for that purpose. A phone number collected at intake with clear notice usually covers it.
• Marketing messages by automated text or call require prior express written consent, a higher bar the patient must clear specifically and in writing.

Separate the checkboxes at intake. One for care communications, one for marketing. Never bundle them, never pre-check the marketing box.

Opt-outs are absolute and fast. Under the FCC's revocation rules, a request to stop must be honoured within ten business days, and revocation carries across channels rather than sitting in the silo where it arrived. A patient who replies STOP to a text has also withdrawn consent for marketing calls.

Run the arithmetic before any list is loaded. A 40,000-recipient promotional text blast sent without written marketing consent is $20 million of statutory exposure at the floor, before anyone argues willfulness. That single number ends most debates about whether the list is clean enough.

A simple consent data model

If you build or buy a patient contact system, your records should distinguish consent types clearly:

patient_id: 48213
phone: +1XXXXXXXXXX
care_reminder_consent: true    (captured at intake 2026-02-10)
marketing_consent: false       (not obtained)
consent_source: "intake_form_v3"
opt_out_timestamp: null

This structure answers the only question that matters in an audit: for this exact message, to this exact person, did we hold the required consent, and can we prove it?

Building the campaign: the mechanics that decide it

The sign-off sequence belongs to the pre-launch review lesson. What follows are the four mechanical choices that determine whether there is anything worth signing off.

Page and URL design. Keep condition names out of paths, query strings and page titles on any page that carries advertising tags. A campaign landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition → at /screening-event leaks nothing; /screening-event?condition=chf leaks everything, and referrer headers carry it onward to every script on the page.

Tag inventory, and the server-side trap. Inventory every script on patient-facing pages, including tag manager containers nobody has opened in two years. Moving to a server-side setup is often sold as the fix. It is not, by itself: routing the same IP address and page data to Meta's Conversions APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → is the same disclosure with a different transport. Server-side only helps if you strip identifiers before transmission, which is the work most teams skip.

Lists. Hashing an email address before uploading it to an ad platform is not de-identification. The hash is a stable identifier that matches to a person, which is the whole point of uploading it. Under HIPAA, data is de-identified only through Safe Harbor (all 18 identifiers removed) or a documented expert determination.

Phones. Call tracking and dynamic number insertion put a marketing vendor inside a conversation where a caller describes symptoms. Recordings then create a second problem in two-party consent states. Either put the vendor under a BAA or keep it off the lines that reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → clinical staff.

A quick contrast

Non-compliant: retarget heart failure page visitors with cardiology ads via an ad pixel and no BAA.

Compliant: run a geo-targeted awareness campaign for a heart health screening event to a general audience, drive traffic to a clean landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition → with no health-condition URL, and capture separate marketing consent from anyone who registers.

Same goal. One is a breach. One is a program you can scale.

The cost of getting it wrong

A breach affecting 500 or more people triggers notification to those individuals and to HHS within 60 days, plus prominent media notice in the affected region. The entry then stays on OCR's public breach portal, which is the first place a reporter looks. Novant's 1.36 million notices, one per household, arrived with the health system's name on the envelope.

TCPA suits run on a separate track, priced per message, and plaintiff firms find non-consented blasts quickly because recipients forward them.

This is why the mechanics sit with marketing rather than only with legal. The people choosing the pixel, the list and the send are the people creating the exposure.

Key Takeaways

• Identity plus health context equals PHI. A page URL, an IP address or a hashed email tied to a condition brings HIPAA into play and makes standard ad tooling a liability.
• Tracking tags are the top failure point, and server-side is not the cure. Strip identifiers before data leaves your control, and never rely on a platform's own sensitive-data filter as your safeguard.
• No BAA does not mean no rule. GoodRx and BetterHelp were penalised by the FTC without HIPAA applying at all.
• Separate care consent from marketing consent, and price the mistake. At $500 per message, a mid-sized non-consented text blast is an eight-figure claim.
• Market to audiences, not to identified patients. Geo and general-interest targeting stays open; retargetingretargetingShowing ads to users who have previously visited your site or interacted with your brand, to bring them back and drive conversion.View full definition → off health-page visits does not.

*This lesson is educational and not legal advice. Consult your compliance and legal teams before launching patient-facing campaigns.*