You need a signed HIPAA authorization before you use or disclose a patient's PHI for a communication that counts as marketing. Two exceptions are face-to-face conversations and promotional gifts of nominal value. Treatment messages, care coordination and refill reminders are generally not marketing at all. The hard part is knowing which side of that line a given email, text or mailer falls on.
If you run an independent pharmacy or a practice, that line decides whether your next campaign is routine or an OCR problem. Here's how it works, in plain terms.
TL;DR
- Marketing under HIPAA is a communication about a product or service that encourages the recipient to buy or use it. If it uses PHI and fits that definition, you need written authorization first.
- Treatment, case management, care coordination and prescription refill reminders are not marketing, so no marketing authorization applies.
- Authorization is also required when a third party pays you to disclose PHI so it can promote its own products.
- A valid form has specific required elements, including an expiration, a signature and date, and a clear statement of the right to revoke.
- A general consent or an email opt-in is not a HIPAA marketing authorization. Treat them as separate things.
Table of Contents
- What HIPAA counts as marketing
- When you need a written authorization
- What a valid authorization must contain
- Authorization is not the same as consent
- Common marketing activities, one by one
- Training the people who collect authorizations
- Revocation: patients can change their minds
- What happens if you skip it
- Putting it into practice
- Need marketing that's built around these rules?
- FAQ
- Sources
What HIPAA counts as marketing
HHS defines marketing as a communication about a product or service that encourages the recipient to purchase or use it. Simple definition. The edges are where people trip.
A communication is not marketing under that definition when it is made:
- for the treatment of the individual,
- for case management or care coordination, or
- to describe health-related products or services provided by, or included in a plan of benefits of, the entity making the communication.
So a pharmacy telling a patient that a new compounding service is available from that pharmacy sits differently than a pharmacy sending a patient list to a supplement company. Same patient data, very different rules.
One more point from HHS: if a health care operations communication falls within the marketing definition but not an exception, authorization is required before PHI is used or disclosed. "We called it operations" doesn't get you out of it.
When you need a written authorization
HHS guidance says a covered entity must get written authorization to use or disclose PHI for a communication that meets the marketing definition, with these carve-outs:
- The communication is face-to-face.
- It is a promotional gift of nominal value.
- It falls under the treatment, care-coordination or plan-benefit exceptions above.
The second trigger catches more people. Marketing also includes an arrangement where you disclose PHI to another entity, for direct or indirect payment, so that entity can promote its own product or service. Selling a patient list falls here. If you get paid by a third party to send their message to your patients, the authorization has to say so.
A quick sorting table
| Activity | Marketing authorization needed? |
|---|---|
| Refill reminder from your pharmacy | No, this is treatment-related |
| Care-coordination call after a discharge | No |
| Newsletter promoting a service you provide, sent using PHI | Depends on whether it fits an exception; check before sending |
| Handing a patient a branded pen at the counter | No, nominal-value gift |
| Talking to a patient about a product in person | No, face-to-face |
| Selling or sharing your patient list with a vendor for payment | Yes |
| Third party pays you to send their product message to your patients | Yes, and the form must disclose the payment |
When a row says "depends," slow down. That is the row where practices get in trouble.
What a valid authorization must contain
A form that is missing elements is not a valid authorization, no matter how many patients sign it. Under 45 CFR 164.508, a valid authorization must identify:
- The PHI to be used or disclosed, described specifically.
- Who is authorized to make the use or disclosure.
- Who will receive the information.
- Each purpose of the use or disclosure.
- An expiration date or event.
- The individual's signature and the date.
It also has to address revocation, redisclosure, and whether treatment or benefits can be conditioned on signing. And if remuneration is involved, the form must say so.
A few practical notes:
- Write the purpose in plain words. "Marketing" alone is thin. Say what you'll send and why.
- Don't bury the remuneration statement. If a third party pays, say it where the patient will see it.
- Give the patient a copy. It's a simple habit that prevents arguments later.
- Keep signed forms where your team can find them. A form nobody can locate on audit day is the same as no form.
Authorization is not the same as consent
This one confuses a lot of owners. The Privacy Rule permits, but does not require, voluntary consent for treatment, payment and health care operations. That kind of consent is a different animal from an authorization.
An authorization is a specific, detailed document tied to a specific use of PHI. A checkbox that says "yes, send me offers" on your web form is not a stand-in for it. And a signed consent form doesn't turn every marketing tool into a safe one. Tracking pixels, third-party platforms and texting vendors each bring their own HIPAA and other legal questions. If you want the consent side of the picture, our guide on enforcing patient consent in healthcare covers it. Texting adds federal telecom rules on top, which we walk through in our HIPAA SMS marketing plan.
Common marketing activities, one by one
Patient lists and mailing lists. Selling patient lists to third parties requires authorization. So does using PHI for marketing that isn't covered by an exception. Using a list for your own treatment-related outreach is a different story.
Refill reminders. Communications for treatment and care coordination, including prescription refill reminders, are not marketing. That's good news for pharmacies. Keep the content on the refill. The moment a reminder turns into a pitch for something unrelated, you've left the exception.
Testimonials and patient stories. Using a patient's story, name or photo identifies them. Get a specific written authorization that covers that use. Don't rely on a general consent form.
Email and SMS campaigns. Ask two questions. Is the message about treatment or care coordination? Is it a product or service pitch built on PHI? Your answer sets the path. If you use automation tools, they need to be set up with these categories in mind. We've written about HIPAA-compliant automation features to look for.
Vendors. An agency or platform that touches PHI on your behalf is a business associate. That calls for a business associate agreement. See our piece on BAAs for marketing vendors.
Training the people who collect authorizations
Most invalid forms are not a legal-theory problem. They're a front-desk problem. Staff handed a stack of forms, with no explanation, will skip the expiration date or forget the signature line.
HIPAA Journal notes that staff who obtain authorizations need training on the Privacy Rule's implementation specifications to avoid invalid forms and noncompliant disclosures. A short checklist taped at the desk helps. So does a regular refresher, and resources on HIPAA compliance and authorization checks can help you build that process.
A simple internal checklist:
- Is every required element filled in?
- Is the purpose specific?
- Is the expiration date or event stated?
- Did the patient sign and date it?
- Does the form disclose any payment from a third party?
- Did the patient get a copy?
Revocation: patients can change their minds
Patients can take it back. HHS says the Privacy Rule gives individuals the right to revoke an authorization at any time. Three details matter:
- The revocation must be in writing.
- It isn't effective until your practice receives it.
- It doesn't undo actions you took in reliance on the valid authorization before then.
The form must state the right to revoke. The process for revoking must either appear on the form or be described in your Notice of Privacy Practices, which the form can reference.
Operationally: build a way to flag revoked patients so they drop off every list. If your texting platform, email tool and mailing vendor each keep their own list, one revocation needs to reach all three. This is where manual processes leak.
What happens if you skip it
HHS enforces the Privacy Rule through a tiered civil penalty structure. According to the AMA, the penalty depends on the level of culpability, from unknowing violations up to uncorrected willful neglect. The same source says violations corrected within 30 days generally avoid civil penalties unless willful neglect is involved. Criminal penalties apply to knowing misuse, and the AMA notes they rise when the intent is commercial advantage. Dollar figures are adjusted over time, so check the current HHS penalty notice before quoting numbers to anyone.
The cheaper path is obvious. A clean form costs you a few minutes per patient.
Our perspective
We work only with healthcare providers, mostly independent pharmacies and clinics, and we see the same pattern. Owners aren't careless. They're busy. Someone adds a new email tool or a texting vendor, and nobody asks whether the campaign touches PHI or whether it counts as marketing.
Our view is that compliance belongs at the start of the project, not at the end. When we design a site, a campaign or an automation workflow, we map each message to a category first: treatment, operations, or marketing. Then the system is built to match. Our approach is designed so that the authorization question is answered before a single message goes out.
That's also why we believe a healthcare-specific partner beats a generic agency here. A generic shop knows funnels. It may not know why a refill reminder and a product promotion are treated differently. You shouldn't have to teach your marketing vendor HIPAA.
Opinly
Putting it into practice
Here's a workable sequence for any new campaign:
- Define the message. What are you sending, and what do you want the patient to do?
- Check the category. Treatment or care coordination? Your own plan or services? Or a product or service pitch?
- Check the data. Does it use PHI, such as a patient list, prescription history or condition?
- Check the money. Is any third party paying you or giving you something of value?
- Decide on authorization. If it's marketing and no exception applies, collect valid forms first.
- Document it. Keep the forms and your reasoning.
- Track revocations. Make sure every platform honors them.
If you're deciding where marketing dollars go this year, our overview of healthcare marketing types helps you see which channels lean on PHI and which don't. Local search and a solid website, for example, usually don't. For more on the day-to-day balance, see our compliance marketing best practices.
Need marketing that's built around these rules?
We build HIPAA-compliant websites, run local SEO and PPC, and set up patient follow-up automation for independent pharmacies, clinics and practices. Our retention automation service is designed to keep patients coming back, with message categories mapped before launch. Pricing isn't published, so reach out through our site to talk through your setup.
If you'd rather attract new patients without leaning on PHI at all, our healthcare SEO service is built for that.
FAQ
Do I need authorization to send prescription refill reminders?
No. HHS treats communications for treatment and care coordination, including prescription refill reminders, as not marketing. Keep the message focused on the refill. Adding unrelated promotions can change how it's classified.
Is a patient's email opt-in the same as a HIPAA marketing authorization?
No. An opt-in is a preference. An authorization is a specific document with required elements, such as the purpose, expiration and signature, set out in 45 CFR 164.508. If your message is marketing built on PHI, the opt-in alone doesn't cover it.
Can I talk to a patient about a product in person without a form?
Yes. Face-to-face communications are an exception to the marketing authorization requirement, as is a promotional gift of nominal value. Both come from HHS marketing guidance. The exceptions cover the in-person conversation itself, not a follow-up mailing built from the same PHI.
Can a patient cancel their authorization?
Yes, at any time, but in writing. It takes effect when you receive it, and it doesn't reverse actions you already took in reliance on the authorization.
Sources
- Marketing | HHS.gov
- How can I distinguish between health care and marketing activities? | HHS.gov
- 45 CFR 164.508 | eCFR
- Authorizations | HHS.gov
- Can an individual revoke his or her authorization? | HHS.gov
- What are the HIPAA Marketing Rules? | HIPAA Journal
- HIPAA violations & enforcement | AMA