Most therapists know HIPAA protects client information in sessions and records. Fewer realize it also affects marketing: your website, contact forms, ads, reviews and emails.
This guide explains, in plain English, what you can and can't do. It isn't legal advice. For your specific situation, talk to a compliance professional or attorney.
Why HIPAA matters in marketing
HIPAA protects health information that can identify a person. In marketing, that information can leak in quiet ways:
- A tracking pixel on an intake page sends details to an ad platform.
- A contact form asks about symptoms and sends them by regular email.
- A reply to a review confirms someone is a client.
None of these feel like a privacy breach, but each can create risk.
What you can do
- Promote your services. Describe what you treat, your approach and who you help.
- Share helpful content. Blog posts, videos and guides on general mental health topics.
- Run ads. Google and Meta ads that promote your practice, within each platform's health policies.
- Collect reviews. Ask satisfied clients for reviews, and respond carefully.
- Use email. Newsletters to people who opted in, without sharing anyone's health details.
- Use analytics. On general pages, as long as no client health information is sent.
What you should avoid
- Ad pixels on sensitive pages. Keep Meta and Google tracking off intake, contact and booking pages.
- Health details in general contact forms. Ask only for what you need to reply.
- Confirming someone is a client. In review replies, social comments or public posts.
- Using client stories without authorization. Even anonymous stories can identify someone.
- Retargeting based on sensitive pages. Showing ads to people because they visited a specific condition page can create risk.
Your website
A HIPAA-aware therapy website includes:
- SSL on every page.
- A simple contact form without health questions.
- A HIPAA-compliant tool for intake, scheduling and client portals, with a signed Business Associate Agreement (BAA).
- No ad tracking on sensitive pages.
- A clear privacy notice.
No website alone can make your practice HIPAA compliant. Compliance depends on your policies, training and signed agreements with every vendor that handles client information.
Business Associate Agreements
A BAA is a contract in which a vendor agrees to protect client health information. You need one with any vendor that handles it, like your EHR, scheduling tool, intake form provider or telehealth platform.
Google and Meta do not sign BAAs for their advertising and standard analytics tools. That's why client health information must never reach them.
Reviews and testimonials
You can ask for online reviews, but be careful how you respond. Thank reviewers in general terms, never mention their treatment and never confirm they're a client.
Note: most professional ethics codes for therapists discourage or prohibit soliciting testimonials from current or former clients, even with written authorization. Check your licensing board's rules first.
Email marketing
Send newsletters only to people who opted in. Keep content general. Don't use your email platform to send anything about a specific client unless it's a HIPAA-compliant service with a signed BAA.
Telehealth
Use a video platform that signs a BAA. Consumer video apps usually aren't designed for clinical sessions.
A quick checklist
- No ad pixels on intake, contact or booking pages
- Contact form doesn't ask for health details
- Intake and scheduling tools have signed BAAs
- Review replies never confirm someone is a client
- Telehealth platform has a signed BAA
- Email list includes only people who opted in
- Privacy notice is on your website
Where Rewokers fits
Rewokers builds HIPAA-aware websites and marketing for therapists and healthcare practices, with a New Jersey office in Brick. We check your website for privacy risks and connect you with HIPAA-compliant tools for anything clinical.
FAQ
Is it a HIPAA violation to use Google Analytics on a therapy website?
It can be if health information is sent to Google. On general pages with careful setup, it's lower risk. Keep analytics off sensitive pages.
Can I reply to a client's Google review?
Yes, but keep it general. Never confirm they're a client or mention their care.
Do I need a BAA for my contact form?
If your form collects health information, the service receiving it may need a BAA. The simpler option is to keep health questions out of your general form.
Can a marketing agency make my practice HIPAA compliant?
No. An agency can make your marketing HIPAA-aware, but full compliance depends on your whole practice and your agreements with vendors.
Want help with this for your practice?
Book a free 30-minute practice audit