Is a medical blog “marketing” under HIPAA?
Usually not, and the reason catches people out. HIPAA reads your patient list, not your paragraphs. Answer four questions about the piece in front of you and this page tells you which of the two rulebooks it lands in, and which question decided it.
Dental implants: what recovery actually looks like
Dental implants: what recovery actually looks like
Two rulebooks. Only one of them reads your sentences.
“Marketing” in HIPAA is not the everyday word, and the confusion runs one way: practices hold back clinical writing they were always free to publish, then send it out in a way nobody checked. The rulebook that really does police what a health page says is not HIPAA at all.
Did patient information go into it, or into choosing who receives it?
HIPAA governs one thing: what you may do with protected health information. If none went into the piece and none went into deciding who sees it, the marketing rule has nothing to grip. That is why a post sitting open on your website is normally clear, and why the same post in patients' inboxes is a different question.
It never asks whether the writing is educational. There is no education exemption, in either direction.
45 CFR 164.501 · 164.502(a) · 164.508(a)(3) · notes 1, 3, 5Can you back up every health claim in it?
The FTC does not care who received it or how you built the list. It cares whether the claims are supported before they run. This is the rulebook that reaches the public post HIPAA just let through, and it reaches a cash-pay clinic exactly as it reaches a hospital.
It is the one with teeth on a public page. Endorsements and reviews carry rules of their own, and the reviews one has been in force since October 2024.
FTC Act §5 · 16 CFR 255 · 16 CFR 465 · notes 6, 7, 8Four questions about your piece
Answer for the thing in front of you, or load one of the six items practices publish most. The FTC line under the verdict never moves, which is the point of it.
Where does patient information come into it?
Two doors. Inside the piece: a photo, a name, a story, a date of service. Or in who gets it, because a list of your patients is itself patient information.
Does it encourage the reader to buy or use a product or service?
Broader than an advert. A treatment you offer, described, ending in an invitation to book. A recall notice or a clinic closure is not.
Is it about this person's own care, or a service you yourself provide?
Their treatment, their next step of care, a referral onward, the drug they are on, or a health-related service your practice provides. These sit inside the definition, so a communication within them is not marketing at all.
Did the company whose product you are describing pay you to send it?
Directly or indirectly. Payment from that company cancels the exceptions above. Money from the patient for their own treatment is not this.
Outside HIPAA’s marketing rule
A reading aid, not a ruling. It cannot see your piece or your mailing list, and nothing on this page is legal advice.
Three things the definition takes back out
They sit inside the definition rather than outside it, which matters: a communication within one of them was never marketing, so there is nothing to authorize. Two of the three are cancelled by money.
Refill reminders, and communicating about a drug or biologic currently prescribed for that individual. This one has its own money test, a ceiling rather than a bar: payment is allowed only so far as it is reasonably related to what the communication costs you to make.
164.501, marketing (2)(i)Treatment of that individual, including case management and care coordination for them, and directing or recommending alternative treatments, therapies, providers or settings of care. Care coordination outside treatment is written in separately, so it is covered either way.
164.501, marketing (2)(ii)(A) and (C)Describing a health-related product or service provided by the practice making the communication. Read the qualifier closely: provided by you. A treatment you perform sits inside it. The same words about someone else's device do not.
164.501, marketing (2)(ii)(B)An exception you were paid for is not an exception.
The two care-side exceptions carry a clause that swallows them whole: they hold except where the covered entity receives financial remuneration in exchange for making the communication. A note to your own patients about a device you genuinely use on them, which would plainly have been fine, becomes marketing the moment the manufacturer pays you to send it. The subject matter does not change. The money changes it.
Direct or indirect payment from, or on behalf of, a third party whose product or service is being described. Indirect is doing real work there, and the payment need not be per message.
Payment for treating the individual is written out of it explicitly. Being paid to treat a patient has never been the thing that turns a letter to that patient into marketing.
Three things HIPAA adds, and three the FTC was going to ask for anyway
Landing inside the definition is not a disaster. It is a short list of conditions, and the bottom half applies to the public post that never went near HIPAA at all.
- 01You need a written authorization firstFrom the individual, before it goes out, not a consent buried in the intake pack. The standard sits squarely on the practice: a covered entity must obtain one for any use or disclosure of protected health information for marketing.
- 02Two forms are let through, and they are narrowA face-to-face communication made to the individual, and a promotional gift of nominal value. That is the whole list. An email is not face to face, and neither is a letter.
- 03If somebody is paying you, the authorization has to say soWhere the marketing involves payment to the practice from a third party, the authorization itself must say so. In the document the patient signs.
- 04Every health claim needs its evidence before it runsSubstantiation first, published second. The guidance behind it replaced the 1998 supplements guide. A figure with no study behind it fails this whether the post went to one patient or to nobody in particular.
- 05A review or an endorsement brings a disclosure with itA connection between you and the person praising you that a reader would not expect, and that might matter to them, gets disclosed. A staff review, a discount given for a testimonial, a gifted treatment.
- 06Fake and insider reviews are their own rule nowWriting reviews of your own practice, buying them, or having someone with an undisclosed connection write them is separately prohibited since October 2024, with civil penalties attached. Newer than most practice marketing policies.
Items 1 to 3 are 45 CFR 164.508(a)(3). Items 4 to 6 are the FTC Act and the two rules under it. Sources below.
Settling scope takes a minute. The FTC half has to hold on every post, for years.
You make the HIPAA call once for your website and once for your newsletter, and then it is a habit. Substantiation is a sentence-level obligation on pages nobody rereads, and practices do not fail it on the obvious claim. They fail it in the fourth paragraph of the eleventh post, where a treatment that usually works quietly became one that works.
That is the part Verand is for, which is why it turns up here and not earlier. Name HIPAA and your board during setup and the medical pack loads itself. Every draft is read against it before it can leave, and a person at your practice presses publish. It cannot publish for you.
What it does not do is decide scope. No validator can see your mailing list. What it reads is the draft: the cure claim, the missing disclaimer, the four citations. The HIPAA row is a validator rather than a banned phrase, and it is blunt on purpose in this version, catching the patterns it can be certain about and leaving the judgement about a patient's story with you.
“Our implant protocol delivers a guaranteed outcome in a single visit, with no follow-up needed.”
Validated against HHS and the FTC's published rules. AI-researched and operator-reviewed. Your counsel confirms applicability. Not legal advice.
Protected health information, and nothing else
The definition is broad. The obligation hanging off it is not: it attaches to a use or disclosure of protected health information, which is why most of what a practice publishes never engages it.
- Any use or disclosure of protected health information for marketing
- Practices and their business associates, which is the rule's own pairing
Your agency, your email platform and whoever built your site become business associates the moment they touch that information for you, which is a contract conversation as much as a content one.
- A communication using no patient information at all
- Two named forms even when it is marketing: face to face, and a promotional gift of nominal value
The first of those is a conclusion read off two provisions rather than a sentence you can point at. Note 5 shows the working.
State medical and dental boards run advertising rules on top of both of these, and they are where restrictions on superlatives and before-and-after imagery usually live. They vary by state and this page does not speak to them. Yours is worth reading once, properly, rather than inferring it from a federal rule that says nothing about it.
State board overlays are documented and not yet in the pack, so Verand says so rather than implying coverage it does not have. Anything your board bans that the pack does not, you enter in Brand Hub as your own banned claim and it gates like a pack rule.
Everything above, traced back
Quoted phrases are the regulation's own words, checked against the CFR text rather than a summary of it. The rest is restatement, which is not the same thing as the rule.
Three pages that pick up where this one stops
Two companion pages: the FTC substantiation rule behind the cure gate, and HIPAA’s marketing provisions end to end.
Scope is a call you make once. Every claim is a call on every draft.
Seven days, every feature unlocked, one click to cancel. Name HIPAA and your board during setup and the first article is drafted against that pack.
Validated against HHS and the FTC's published rules. AI-researched and operator-reviewed. A person at your practice still presses publish.