Building compliant patient marketing under HIPAA and TCPA constraints

This is not a rare edge case. Between 2022 and 2024, dozens of US health systems disclosed similar pixel-related breaches, some affecting millions of patients. The lesson: in healthcare, the marketing tools that work everywhere else can quietly turn routine campaigns into reportable breaches.

The two rules that reshape everything

Two federal laws govern how you reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → patients. Learn them before you touch a campaign.

HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. (the Health Insurance Portability and Accountability Act) protects PHI, or Protected Health Information. PHI is any health information tied to an identifiable person: name, email, IP address, appointment type, condition, or even the fact that someone is a patient of your oncology clinic.

The trap: identity plus health context equals PHI. "John Smith" is not PHI. "John Smith viewed our diabetes page" is.

TCPA (the Telephone Consumer Protection Act) governs how you contact people by phone, text, and automated calls. It requires specific consent before you send marketing texts or place automated calls, and it is enforced through lawsuits with steep per-message penalties.

HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. controls what data you can use. TCPA controls how you can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → out. A compliant campaign satisfies both.

Why the pixel broke the law

Back to our cardiology campaign. Here is the mechanical failure.

A standard tracking pixel captures the visitor's IP address, the page URL, and often a device identifier, then sends it to the ad platform. On a retail site, that is fine. On a hospital site, the page URL ("/cardiology/heart-failure") plus the IP address becomes PHI, because it reveals a specific person's health interest to a company that is not authorized to receive it.

Under HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation., sharing PHI with a vendor requires a Business Associate Agreement (a BAA, a contract making the vendor legally responsible for protecting the data). Major ad platforms generally will not sign BAAs for their advertising pixels. So the moment the pixel fired on a health page, the hospital disclosed PHI to a party with no BAA and no patient authorization.

The US Department of Health and Human Services issued guidance on tracking technologies that spells this out. Worth reading in full before your next digital campaign.

What you can still do

Compliance does not kill marketing. It changes your inputs. Here is what stays open.

Market to audiences, not identified patients

You can advertise service lines to broad, non-patient audiences: people in your region interested in general health topics. What you cannot do is retarget based on which condition page someone visited on your authenticated or health-specific pages.

Concrete line: promoting a "Free Heart Health Screening" to a geographic audience is fine. Building a custom audience of "people who viewed our heart failure page" and uploading it to an ad platform is not.

Use PHI only with authorization

HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. lets you use PHI for marketing only with the patient's written authorization, with narrow exceptions. One key exception: you may send treatment and care reminders (appointment reminders, refill reminders, follow-up instructions) without marketing authorization, because those are healthcare operations, not marketing.

So "Your annual mammogram is due, call to schedule" is generally permitted as a care communication. "Our new med spa is offering 20% off Botox" to the same list is marketing and needs authorization.

Keep vendors under BAAs

Any vendor that touches PHI (your CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →, email platform, call center, analytics tool) must sign a BAA. Before adopting a martech tool, ask one question: will you sign a BAA? If the answer is no, that tool cannot touch patient data.

Handling phone and text under TCPA

TCPA layers on top of HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.. Even a HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.-permitted message can violate TCPA if you lack the right consent.

The rule of thumb:

• Appointment and care reminders by text or automated call generally require prior express consent (the patient gave you the number and agreed to be contacted for that purpose). Collecting a phone number at intake with a clear notice usually covers this.
• Marketing messages (promotions, new service announcements) by automated text or call require prior express written consent, a higher bar. The patient must specifically agree, in writing, to receive marketing.

Practical design: separate your consent checkboxes at intake. One for care communications. One for marketing. Never bundle them. Never pre-check the marketing box.

Also honor opt-outs immediately. A "STOP" reply must remove the person from all future texts. Log the timestamp.

A simple consent data model

If you build or buy a patient contact system, your records should distinguish consent types clearly:

This structure lets your team answer the only question that matters in an audit: for this exact message, to this exact person, did we have the required consent, and can we prove it?

Building the compliant campaign, step by step

Here is how a marketing lead should actually plan a patient-facing campaign in 2026.

Step 1: Classify the data. List every data element the campaign touches. Flag anything that combines identity with health context. That is PHI and triggers HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation..

Step 2: Choose the reach method and map the consent. Email, text, mail, and calls each carry different rules. Match each channel to the consent you actually hold. No marketing consent means no marketing text, full stop.

Step 3: Audit your website tags. Before running digital ads, inventory every pixel and script on your patient-facing pages. Remove or restrict tracking on any page that reveals a health condition or an authenticated patient area. Many systems now use a server-side approach or a HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.-compliant analytics vendor under a BAA to strip identifiers before any data leaves their control.

Step 4: Confirm every vendor has a BAA. No BAA, no PHI. Route non-compliant tools away from patient data entirely.

Step 5: Document the decision. Write down why the campaign is compliant: what data, what consent, what vendors. If a regulator asks, this record is your defense.

A quick contrast

Non-compliant: retarget heart failure page visitors with cardiology ads via an ad pixel and no BAA.

Compliant: run a geo-targeted awareness campaign for a heart health screening event to a general audience, drive traffic to a clean landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.Voir la définition complète → with no health-condition URL, and capture separate marketing consent from anyone who registers.

Same goal. One is a breach. One is a program you can scale.

The cost of getting it wrong

HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. violations can trigger penalties and, more damaging, mandatory public breach notification to affected patients. In healthcare, trust is the product. A breach headline erodes the exact reputation your marketing is trying to build.

TCPA suits are a separate financial risk, with penalties assessed per message. A single sloppy text blast to a non-consented list can generate thousands of individual claims.

This is why compliance belongs in the marketing team, not just legal. The people building the campaign are the ones who choose the pixel, the list, and the message.

Key Takeaways

• Identity plus health context equals PHI. The moment a page URL or list reveals someone's condition alongside their identity, HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. applies and standard ad tools become a liability.
• Tracking pixels on health pages are the top failure point. Audit every tag, and never send condition-level data to a vendor without a signed BAA.
• Separate care consent from marketing consent. Appointment and refill reminders are usually permitted; promotional messages need higher, explicit consent under both HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. and TCPA.
• Market to audiences, not to identified patients. Geo and interest targeting to non-patient audiences stays open; retargeting based on health-page visits does not.

*This lesson is educational and not legal advice. Consult your compliance and legal teams before launching patient-facing campaigns.*