Rules
HIPAA compliant dental marketing: core rules
hipaa compliant dental marketing depends on authorization, vendor agreements, risk analysis, six-year documentation, breach response, and state-law checks.
What to take away
- HIPAA sets a federal floor for using patient information in advertising, enforced by the HHS Office for Civil Rights.
- Promotional content that names a patient usually needs written authorization, apart from the treatment consent form.
- Website tracking, ad pixels and email platforms each handle patient data and need a policy and a business associate agreement.
- State law can add duties, and state attorneys general can bring privacy cases.
- Keep authorizations and marketing files for six years, the federal retention standard.
HIPAA compliant dental marketing depends on routine controls for patient photos, tracking pixels, and staff replies to reviews. Few practices set out to break privacy law. They break it by posting a patient photo, adding a tracking pixel to a booking page, or letting a hygienist answer a review.
Who has jurisdiction over dental marketing
The HHS Office for Civil Rights enforces the HIPAA Privacy Rule against covered entities and their business associates. A dental practice is a covered entity. So is the billing service, the answering service and the marketing vendor that touches a patient list.
The Federal Trade Commission polices advertising claims under the FTC Act. Its guidance on health product claims covers testimonial ads, directory listings and promises about outcomes.
State attorneys general can bring HIPAA actions under the HITECH Act. State dental boards add advertising rules of their own, often covering specialty and sedation claims.
What a compliant marketing authorization contains
An authorization is the document that lets a practice use patient information for marketing. HIPAA defines marketing at 45 CFR 164.501 as a communication about a product or service that encourages recipients to purchase or use it; 45 CFR 164.508(a)(3) requires written authorization before any such use or disclosure of protected health information. Under 45 CFR 164.508(c), the form must include the elements listed below. A dental website marketing plan should also list which pages collect data and where that data goes.
- Describe the protected health information to be used or disclosed, identify who may use or disclose it, and identify who may receive it.
- State the purpose of the use or disclosure and an expiration date or event.
- Include the patient's signature and date. If a personal representative signs, describe that person's authority to act for the patient.
- State the individual's right to revoke in writing and either explain applicable exceptions and how to revoke, or refer to the relevant sections of the Notice of Privacy Practices. Also address possible redisclosure and whether treatment, payment, enrollment, or eligibility is conditioned on signing.
- For a marketing authorization, state whether the practice receives remuneration from a third party for the marketing communication.
| Element | What it must contain |
|---|
Authorization Form Required Elements
- Descriptionphotos, first name, city
- Who may disclose and receive
- PurposeInstagram post, testimonial
- Expirationtwelve months from signature
- Revocationhow to withdraw in writing
- Treatment not conditioned on signing
- Signature and date, copy returned
A Notice of Privacy Practices does not replace the form. It must state that marketing uses need authorization and that patient information will not be sold without one.
A staff member who texts a before-and-after photo to an agency without a signed form has made a disclosure HIPAA does not allow.
Tracking carries the same duty. A remarketing tag on a page about implants builds an audience from people seeking care. HHS safeguards for electronic protected health information call for an assessment of the vendor before any tag goes live. Under the Security Rule (45 CFR 164.308(a)(1)(ii)(A)), a practice must conduct an accurate and thorough risk analysis of ePHI before deploying any new tool.
A business associate agreement is not a formality. Under 45 CFR 164.504(e), a BAA must specify: permitted and required uses and disclosures of PHI by the vendor; the safeguards the vendor will implement; the vendor's obligation to report security incidents and breaches; return or destruction of PHI at contract termination; and pass-through terms binding any subcontractor the vendor engages. Without these clauses in writing, the practice has no enforceable privacy boundary with the vendor.
Records a dental practice should keep
HIPAA requires documentation be kept six years from creation or the date last in effect under 45 CFR 164.530(j). For lists, a practice running dental email marketing should show where each address came from. Core federal records include signed marketing authorizations and revocations, applicable HIPAA policies and procedures, risk-analysis documentation, business associate agreements, and records of required compliance actions.
| Record | Retention | Reason it matters |
|---|
Six-Year HIPAA Retention Schedule
Record
- Authorizations and revocations
- 6 years
- Business associate agreements
- 6 years after contract ends
- Breach risk assessments
- 6 years
- Marketing copy and approvals
- 6 years
- Training logs and sanctions
- 6 years
Retention
- Authorizations and revocations
- proves consent existed
- Business associate agreements
- proves vendor oversight
- Breach risk assessments
- shows how a call was made
- Marketing copy and approvals
- defends the claim that ran
- Training logs and sanctions
- first request from OCR
Why it matters
- Authorizations and revocations
- Business associate agreements
- Breach risk assessments
- Marketing copy and approvals
- Training logs and sanctions
- Signed authorizations and revocationssix years from creation or the date last in effect; they show whether marketing use was authorized and whether permission changed.
- HIPAA policies and procedures, risk analyses, business associate agreements, and records of required actions — six years from creation or the date last in effect; they document safeguards, vendor oversight, and the practice's response.
- State treatment recordsfollow the applicable state retention schedule and keep the longer period when schedules differ; this helps meet state requirements and avoid premature destruction.
State rules can run longer. Many states require adult treatment records be held five to ten years, and longer for minors. Where the periods differ, keep the longer one.
What happens after a breach or complaint
A complaint or a self-reported breach starts a review. Under 45 CFR 164.404, a covered entity must notify affected individuals within 60 calendar days of discovering a breach. The risk-assessment factors in 45 CFR 164.402 guide whether notification is required: the nature and extent of the PHI involved, the unauthorized person who received it, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. OCR asks for the authorization, the policies, the risk analysis and the vendor agreement. Missing documents usually mean a finding of failure to safeguard.
From Complaint to Resolution
- Complaint or self-reported breach starts review
- OCR requests authorization, policies, risk analysis, vendor agreement
- Missing documents mean failure to safeguard
- Resolution agreement with corrective action plan
- Annual reporting and tiered civil money penalties
The result can be a resolution agreement with a corrective action plan and annual reporting. Civil money penalties are tiered by culpability, from lack of awareness to willful neglect. State attorneys general can file separately.
Some damage never appears in a settlement. A breach listing stays on the OCR portal, referral sources notice, and dental reputation management turns into damage control.
Where state law adds to HIPAA
California's CCPA and CPRA exempt protected health information that HIPAA already governs, but not everything else. Website visitors who never became patients, newsletter lists and ad audiences can fall inside those statutes, with notice and deletion rights.
Washington's My Health My Data Act reaches health-related businesses beyond covered entities, including some marketing vendors. Texas, Nevada and Connecticut have similar consumer health data laws.
Advertising to minors and to people seeking reproductive care draws added scrutiny in some states. Dental board rules and retention periods differ too, so a campaign built for one state does not travel.
Common questions
Do we need patient authorization to reply to a public review?
Yes, if the reply confirms the person is a patient or describes treatment. A reply that avoids confirming any relationship is safer.
Is a marketing platform compliant on its own?
No. Compliance sits with the practice, not the tool. The vendor signs a business associate agreement and the practice controls the list.
Can we run Google Analytics or a Meta pixel on our site?
Only after a vendor assessment and a decision about which pages carry the tag.
Who owns the data when we change agencies?
The practice does. Before signing, work through dental marketing strategy questions on data return, deletion and tag removal, and put the answer in the contract.
