Rule explainer Not legal advice

When HIPAA calls your content marketing

Read this to find out whether the thing you are about to publish needs a patient's signature on a form first. That is the only question HIPAA asks about marketing, and it turns on two: whether you are a covered entity, and whether the piece uses information about a real patient. Most practice content fails the second and is free.

The ruleTwo paragraphs do all the work. 45 CFR §164.501 says what marketing means. 45 CFR §164.508(a)(3) requires a written authorization before using protected health information for it. Enforced by the HHS Office for Civil Rights, not a licensing board. Sources 1 and 2, numbered at the foot of this page.

How the rulebook changed

April 14, 2003The Privacy Rule bitesMarketing needed an authorization from that day, with a shorter list of exceptions than the one you read now.
2009Congress narrows the exceptionsSection 13406 of the HITECH Act takes aim at communications that look like care and are paid for by somebody selling something.
September 23, 2013The text you are held toCompliance date of the rule that rewrote the definition. Money from a third party decides which exceptions you keep.

Scope

Does it reach you?

Two questions, in order. The first is about your practice, and almost every practice answers it yes. The second is about the thing you are publishing, and it is the one that decides. Most people never reach it, which is why so much practice content never gets written.

ApplicabilityA health care provider is a covered entity only if it is one “who transmits any health information in electronic form in connection with a transaction covered by this subchapter”. Source 3.

You bill insurance or check eligibility electronically

The Privacy Rule reaches you

One electronic claim is enough, and the software most offices bought years ago does it by default. Assume this is you.

Cash only, and nothing goes out electronically in a standard transaction

Not a covered entity

Some cash-pay therapy and cosmetic practices sit outside the federal test, which is mechanical rather than moral. It is fragile: the day a new billing tool runs one eligibility check, you are in. Your state privacy statute and your board never left.

An article about a procedure, naming nobody, on your own site

The rule never engages

The answer almost nobody states plainly. An authorization is required before a use of protected health information for marketing. An article about root canals, sleep apnoea or cognitive behavioural therapy uses none, so there is nothing for it to attach to. Write it.

A patient's story, a photograph, a review, a before and after

This is where it actually lives

Every hard HIPAA question in practice marketing is a version of this one, and the argument is never about the word “marketing”. It is about whether a reader could work out who that is, and that test is stricter than changing a name.

Keep reading →

The definition

What HIPAA means by marketing

It is a term of art, and much narrower than advertising. Marketing means a communication about a product or service that encourages the people receiving it to buy or use it. Notice what it never mentions: a website, a blog, a social account, a budget. The test is what a communication does, not where it appears.

Then come the exceptions, which are what lets you talk to your patients about their care without asking permission. Treatment communications sit outside the definition, as do ones describing a service you yourself provide, as do refill reminders. Each has the same trapdoor underneath, and it is money from a third party.

All of which settles one thing: whether the communication is marketing. Whether you need a signature is a second question, answered by whether it uses anything about an identifiable patient.

Definition§164.501, under Marketing. Paragraph (1) is the general rule, (2) holds the exceptions, (3) defines the payment that takes them away. Source 1.

Does this need an authorization?

Worked examples

Worked from the two definitions' own words. Where a real communication lands is a judgement about your facts.

The core of it

The two paragraphs, in their own words

Shorter than their reputation. One sentence defines marketing, four passages take things back out of it, one defines the money that puts them back in, and two say when a signature is required. Left, the text as written. Right, what it means for something you are about to publish.

Reading noteThe middle column is verbatim, with one long passage shortened where the omitted words are about health plans rather than practices. Paragraph numbers sit in the left margin. Sources 1 and 2.

45 CFR §164.501 and §164.508(a)(3), as written

Point at either side to link them

Verbatim

In plain English

501Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

501(2)(i)

To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication

In plain EnglishTelling a patient about a medicine they are already on is not marketing. If a manufacturer chips in, the amount has to be about what the mailing cost. Profit on it turns it into marketing.

501(2)(ii)

For the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication

In plain EnglishThe hinge the section turns on. What follows is outside the definition right up until somebody pays you to send it, at which point it all stops applying at once.

501(2)(ii)(A)

For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual

In plain EnglishWider than it looks. Recommending a different therapy, or another clinician, to a particular patient is treatment, even though it plainly encourages them to use a service.

501(2)(ii)(B)

To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication …

In plain EnglishYou may describe what you offer. The words carrying the weight are “provided by … the covered entity”: your own implant service is inside, a device somebody else sells is not.

501(3)

Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect payment does not include any payment for treatment of an individual.

In plain EnglishTwo limits worth reading slowly. It has to be money, so a free lunch is not it. And a patient paying for their own care never counts, which is why being paid for dentistry does not make it marketing.

508(a)(3)(i)

… a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of: (A) A face-to-face communication made by a covered entity to an individual; or (B) A promotional gift of nominal value provided by the covered entity.

In plain EnglishThe requirement, and the two things it lets through. Read the object of the sentence: an authorization is needed for a use of protected health information, not for marketing as such. The two exceptions are a conversation and a toothbrush, so neither describes anything you could put on a website.

508(a)(3)(ii)

If the marketing involves financial remuneration … to the covered entity from a third party, the authorization must state that such remuneration is involved.

In plain EnglishBeing paid does not only cost you an exception, it changes the form. The patient has to be told, on the page they sign, that somebody paid you to send this.

Quoted text is the regulation's own. The right-hand column is our rendering, not part of the rule. Sources 1 and 2.

Vocabulary

Four words that carry the weight

The two paragraphs reuse the same handful of terms, and most disagreements about a draft turn out to be about one of them.

Covered entity

A mechanical test, not a judgement about how medical you are. A provider becomes one by transmitting health information electronically in a covered transaction. A billing decision, made years ago, by somebody who has left.

Protected health information

Information that relates to a person's care and identifies them, or could reasonably be used to. The second half is the live one: identifying is something a reader does, not a name field.

Marketing

Encouraging someone to buy or use a product or service. Narrower than advertising and wider than a campaign, which is why a friendly reminder email can be inside it and a brochure about your own services outside.

Authorization

A signed document with named contents and an expiry, revocable in writing. Not consent to treat, not the privacy notice, not a media release an agency drafted.

The part almost nobody explains

The form at the front desk is not an authorization

One sentence causes more trouble here than the rest of this page combined, and it is usually said in a staff room rather than written anywhere.

The documentWhat a valid authorization must contain is listed at §164.508(c)(1) and (c)(2). It must be in plain language, and the patient must be given a copy of what they signed. Source 2.

What people think it says

They signed our privacy paperwork at intake, so we are covered.

Intake paperwork is consent to treat and an acknowledgement of your notice of privacy practices. The notice's job is to tell patients you will come back and ask for an authorization. Telling someone you will ask is not asking.

What it actually says

A separate signed document, naming this information, this audience, this purpose, with a date it runs out.

Six things have to be in it and two more statements on it. Which makes this a filing job rather than a legal one, and the reason it goes wrong is that nobody owns it.

What has to be on the page a patient signs before their story can run: six elements and two statements

What information“Your photographs and your treatment history”, not “your records”

Who may use itYour practice by name. An agency you have not named is not covered

Who may receive itThe audience. For anything you publish, that is the public, in those words

WhyEach purpose. When the patient asked you to run it, “at the request of the individual” is enough

When it expiresA date, or an event tied to them or the purpose. A form with no end is not valid

Signature and dateTheirs, or a representative's with that authority described on the form

The right to revokeIn writing, with how to do it and what it cannot undo

Whether care depends on itIt does not, and the form has to say so

And it can be taken back, in writing, at any time. A story still running has an owner who can ask you to take it down, and a practice with no record of which page rests on which signature cannot answer.

What changes it

Who is paying you to send it

Payment is not what makes a communication marketing. It takes an exception away, then changes what the signed form has to say. There is no dollar line anywhere in this rule, which is the main way it differs from every other advertising regime. Move the selector and watch which lines engage.

ConditionsThe exceptions at §164.501(2)(ii) hold “except where the covered entity receives financial remuneration in exchange for making the communication”. That term is defined at §164.501(3). The statement requirement is §164.508(a)(3)(ii). Sources 1 and 2.

An email to your own patient list, about a health-related product

Move the selector

What the email is, and who paid for it Care you provide, nobody paid

Not marketing

Inside the marketing definition §164.501 Outside
A signed authorization before it goes out §164.508(a)(3)(i) Not needed
The form has to say you were paid §164.508(a)(3)(ii) Not needed

Read off the definitions' own words. Which stop a real email sits at is a judgement about your facts. Sources 1 and 2.

None of these four stops reaches an article that names nobody. The requirement is a rule about using protected health information, so a page carrying none never arrives at this device. What the selector decides is the other case: the email or portal message that goes to particular people because of what you know about them.

Records

Six years, from the later of two dates

A signed authorization is a record you keep, and the clock does not start when the patient signs it. It starts at the later of the day it was created and the last day it was in effect, so a form with no expiry behind a page you never took down has a clock that has not begun.

Retention§164.508(b)(6) sends a signed authorization to §164.530(j), which requires documentation to be retained “for six years from the date of its creation or the date when it last was in effect, whichever is later”. Source 4.

The retention clock on one signed form

45 CFR §164.530(j)(2)

Still in effect Expired or revoked. The six years are running. Still in effect, so the later of the two dates keeps moving.

Start: the later of the day it was created and the last day it was in effect +6 years

Six years, in writing or electronically, and producible. Not six years in the patient's chart alone, because the question you will be asked is about a campaign rather than a person.

A form with no expiry, behind a page still up, has a last day in effect that is in the future, so the six years have not started. The authorization signed years ago for a story you never took down is not an old problem, it is a live one.

The consequence practices trip over: an authorization filed only in a chart can be produced one at a time and cannot answer a question about a campaign. Source 4.

One section about our software, then back to the rule

What Verand checks of this rule, and what it does not

Everything above stands whether or not you buy anything. This is how much of it software can see in a draft. The right-hand column is the longer one, and we would rather print that than let you assume otherwise.

What it checks

Reads every draft for two structured patterns that should never reach published copy: a Social Security number, and a date of birth written as one. Either fails the draft and shows as a compliance failure on the report your reviewer opens.
Blocks a guaranteed or permanent cure claim. A draft promising a cure or a guaranteed outcome cannot publish. That rule is the FTC's rather than HIPAA's, and it stops more medical drafts than anything here. What you have to be able to prove →
Flags “best dentist”, “#1 clinic” and an unqualified “painless” for a person to look at. Flagged, not blocked: several state boards restrict these and the acceptable wording is local.
Blocks six more claim types from the baseline underneath: guaranteed results, guaranteed returns, cannot-lose, get-rich-quick, risk-free, zero-risk. The last two release only on a written, logged reason.
Requires the medical disclaimer block, and four cited sources, two from a government health agency, peer-reviewed literature, or a major medical or dental association.

What it does not

It does not decide whether you are a covered entity. That turns on how you bill, which appears nowhere in an article. Every draft is checked as though you are one.
It does not read a draft for a patient's name, condition, photograph or story. The honest limit, and the important one, because identifiability is exactly what the requirement turns on. Judging whether a described person can be worked out is a reading task rather than a pattern match, and we have not built it. The two patterns above are the whole of what it sees.
It does not hold your authorizations, check one exists, or keep your six years of records.
It does not look at your reviews widget, photo gallery or social accounts. It checks the article, and these questions usually go wrong somewhere else.
It does not publish. Nothing reaches your site without a person at your practice approving it, and no setting changes that.

Validated against the HHS Office for Civil Rights' rules. AI-researched and operator-reviewed. Your counsel confirms applicability. Not legal advice. How we label review →

Verand for medical practices Can a practice use AI to write posts? →

Questions

The ones that come up

About the rule, not about our software. Each points at the paragraph it comes from.

Can I write about a procedure we offer at all?

Yes, and nothing on this page would stop you. The requirement attaches to protected health information, and an article explaining what a procedure involves uses none. What can stop you is a different regime: whether you could substantiate what you claim it achieves, which is the FTC's question, not this one.

Can I use a before-and-after photograph?

With a signed authorization, yes. Without one the rule is unusually concrete: full face photographic images and any comparable images are on the list of things that must come off before information counts as de-identified. Cropping to the mouth is not automatically enough, because the test is whether the person can reasonably be identified.

A patient left us a five-star review. Can we repost it?

Read the definition of protected health information and the answer arrives on its own. The patient may say whatever they like, because the rule does not bind them. It binds you. A named review you republish identifies a person and relates to their care, so republishing it is you disclosing it. The same goes for the reply underneath.

Can I write up a case if I change the name and drop the date?

Changing the name is not the test, which is where most attempts go wrong. Information stops being identifiable when there is no reasonable basis to believe it can be used to identify the person. If you are the only practice in the county doing that procedure, the procedure is the identifier.

Does it matter that a draft was written with AI?

Not to this rule, which asks what the communication is and whose information it uses, never what typed it. The practical change is that there is more to review, and the thing needing a human eye is the paragraph where a real patient wandered in. The longer answer.

Sources

Where every line came from

Primary sources only. Quoted phrases on this page are the regulation's own words. Everything else is our rendering, worth checking against the text rather than taking our word for it.

145 CFR §164.501, definitions, at Marketing. Cornell Legal Information Institute 245 CFR §164.508, uses and disclosures for which an authorization is required, at (a)(3), (b)(6) and (c). Cornell Legal Information Institute 345 CFR §160.103, definitions of covered entity, health care provider and protected health information. Cornell Legal Information Institute 445 CFR §164.530, administrative requirements, at (j)(1) and (j)(2). Cornell Legal Information Institute 545 CFR §164.514, de-identification, at (a) to (c). Cornell Legal Information Institute 6Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, 78 FR 5566, January 25, 2013. Compliance required from September 23, 2013. Federal Register

Paragraph references are to 45 CFR. Last checked against these sources on September 17, 2026. Not legal advice.

Elsewhere in this section

The next questions this one raises

Hub

Verand for medical practices

What the software does, and refuses to do.

/medical-practices Explainer

What you have to be able to prove about a health claim

The other regulator. Substantiation, and the rule behind the cure gate.

/ftc-health-claims Explainer

Is a medical blog “marketing” under HIPAA?

The scope test, run over what a practice actually publishes.

/what-counts-as-advertising Question

Can doctors, dentists and therapists use AI to write blog posts?

Permission, responsibility, and what a person does first.

/using-ai-to-write-content Guide

Local SEO for medical and dental practices

Being found nearby, within the rules above.

/local-seo Trust

How we label compliance review

Operator-reviewed, not attorney-verified, and why we print it.

/compliance-standards

The rule is two paragraphs long. Your publishing calendar is not.

Verand drafts in your practice's voice, runs the checks above before anything reaches a reviewer, and says plainly which ones it cannot run. Someone at your practice still presses publish.

Start for Free Verand for practices →

Packs are AI-researched and operator-reviewed against the governing body's published rules. Not attorney-verified. Not legal advice.