HIPAA and Healthcare Marketing | What is HIPAA Compliant Marketing

When navigating restrictions in healthcare marketing, it can be difficult to find the answers to what you’re looking for. This is because marketing can be HIPAA compliant, but it can also not be. It all comes down to how you are using marketing, what tools you use, and if you have consent from the patient. In an effort to clear up the confusion surrounding HIPAA compliant marketing, HIPAA marketing guidelines and HIPAA marketing FAQs are provided below. 

HIPAA Marketing Guidelines

HIPAA marketing rules differ based on what type of marketing you are doing. If you are targeting your audience based on basic demographics such as age, gender, or location, this type of marketing does not fall under HIPAA’s jurisdiction.

HIPAA Marketing Policy

Developing a HIPAA marketing policy is an important part of ensuring that your communications are HIPAA compliant. Your HIPAA marketing policy should include procedures for receiving patient authorization for marketing communications, what to do if you’d like to use patient testimonials or reviews for marketing, and opt out procedures.

HIPAA Marketing Opt Out

Part of HIPAA compliant marketing is giving patients the ability to easily opt out of marketing communications. All of your marketing communications should include a way to easily unsubscribe from them. This may include an unsubscribe link in marketing emails, or the option to text STOP to opt out of text message marketing.

HIPAA Marketing Restrictions

The Privacy Rule defines “marketing” as making “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” Generally, if the communication is “marketing,” then the communication can occur only if the covered entity first obtains an individual’s “authorization.”

The HIPAA Privacy Rule dictates certain HIPAA marketing restrictions, “The HIPAA Privacy Rule gives individuals important controls over whether and how their protected health information is used and disclosed for marketing purposes. With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing. So as not to interfere with core health care functions, the Rule distinguishes marketing communications from those communications about goods and services that are essential for quality healthcare.”

Using PHI for Marketing

So how can you market to existing patients, and how can you use patient information for your marketing efforts? Well, there are a couple of ways to do this.

HIPAA Marketing Authorization Form

HIPAA requires healthcare organizations to have signed authorization forms from patients when their protected health information (PHI) will be used for marketing purposes. If the marketing communication involves direct or indirect remuneration to the covered entity from a third party, the authorization must state that such remuneration is involved.

There are certain instances in which a HIPAA marketing authorization form is not required. This includes when communication occurs face to face between the covered entity and the individual; or when the communication involves a promotional gift of nominal value.

Using Look-a-Like Audiences 

Another way that you can market to patients is by using a look-a-like audience. However, this requires you to use a HIPAA compliant marketing tool to do so. Many popular tools such as Facebook Ads and Hubspot are not HIPAA compliant, so patient data cannot be input into these platforms. This can be a huge obstacle to your marketing efforts. But there may be a work around to this, although it requires a little extra work on your part. 

Instead of setting a look-a-like audience for digital marketing, you could analyze your patient data on your own by using a spreadsheet, and input ONLY the demographics that you identified as your target audience into your marketing tools. For instance, if you find that most of your patients are males between the ages of 45 – 60, you can set this demographic as your target audience without having to filter any PHI through the software. 

*When using a spreadsheet for PHI, you must ensure the spreadsheet software is HIPAA compliant, and you have a signed business associate agreement (BAA) with the software provider. Some HIPAA compliant spreadsheet providers include Microsoft Excel and Google Sheets, but they are ONLY considered HIPAA compliant if you have a BAA signed with Microsoft or Google before their use.

HIPAA Compliant Marketing Tools

There are certain things to look for when determining whether or not a marketing tool is HIPAA compliant.

HIPAA Compliant Security Features 

When a healthcare organization uses a marketing tool to input patient information, that tool is considered a business associate. Business associates are required to have certain safeguards in place to ensure the confidentiality, integrity, and availability of PHI shared with them.

These include, at minimum:

• User Authentication. HIPAA compliant marketing tools allow each employee to have unique login credentials to access the platform. For increased security, the platform should enable two-factor authentication (2FA). 2FA requires users to input their username and password, in combination with another unique identifier (i.e. security questions or one-time PIN) to access sensitive data.
• Access Controls. With the use of unique login credentials, access controls can be set. Access controls limit access to sensitive data, and should be set based on an employee’s job function. Not all employees should have full access to the platform, they should only be granted access to the data that they need to perform their job. 
• Audit Logs. An important part of HIPAA is ensuring that data is only accessed when it should be. Audit logs can be used to determine access patterns for each employee, enabling administrators to identify when an employee is accessing data excessively. This allows both insider and outsider breaches (i.e. when an unauthorized party uses stolen login credentials to access PHI) to be detected quickly. Audit logs should list who accesses what data and how long they access it for.
• End-to-end Encryption. When electronic PHI is created, stored, transmitted, or received using a software platform, that platform should enable end-to-end encryption (E2EE). E2EE prevents unauthorized access to data at rest and in motion by converting it to a format that can only be read with a decryption key.

HIPAA Business Associate Agreements

Even the most secure platform cannot be considered HIPAA compliant if they are unwilling or unable to sign a business associate agreement (BAA). A BAA is a legal contract that requires each signing party to be HIPAA compliant, and to be responsible for maintaining their compliance. A BAA limits the liability of both signing parties in the event of a breach or HIPAA audit as only the negligent party will be held responsible.

HIPAA Compliant Marketing Agency

Marketing agencies are also considered business associates when doing targeted marketing for healthcare clients. As a business associate, you yourself will need to be HIPAA compliant. 

To be HIPAA compliant, you must:

• Conduct annual self-audits
• Implement remediation plans to address risks and vulnerabilities to PHI
• Conduct annual HIPAA training for employees with the potential to access PHI
• Implement HIPAA policies and procedures
• Be willing to sign a business associate agreement, and have signed BAAs with your business associates
• Have a process for responding to and tracking incidents affecting PHI

Additionally, when healthcare businesses use a marketing agency for their marketing efforts, they expect their marketing agencies to be aware of how patient information can and cannot be used. As their trusted marketing advisor, you will be responsible for ensuring that your communications with their patients are HIPAA compliant. For instance, if you’d like to use patient testimonials or reviews on your healthcare clients website, in direct mail, or in email campaigns, you must have written consent from the patients before doing so. 

HIPAA Marketing FAQ: Questions Answered