Healthcare marketing and privacy, answered.
Straight answers to the questions practice owners ask most, backed by enforcement records and patient research.
Is the Meta Pixel HIPAA compliant on a medical practice website?
It depends on where the pixel fires and what it sends. A pixel on a general page is a different risk than one on an appointment, intake or patient portal page, and hospitals have paid eight-figure settlements over the second kind.
Read the answer →What does the BetterHelp FTC case mean for healthcare marketing?
It means marketing decisions create legal exposure, even when nobody intends harm. The FTC fined BetterHelp $7.8 million for sharing health information with advertising platforms, and named a junior marketing role as the decision-maker.
Read the answer →Can you respond to patient reviews without violating HIPAA?
Yes. HIPAA doesn't stop a practice from replying to reviews. It stops a practice from confirming someone is a patient or sharing anything about their care in the reply, and HHS has fined practices that did.
Read the answer →Do appointment reminder texts need different consent than marketing texts?
Yes. The rules turn on what a message is for. A reminder about care a patient already scheduled is treated differently than a promotion, and getting the line wrong is expensive because patients can sue for each message.
Read the answer →Do HIPAA and FERPA both apply to therapists who serve students?
Often, yes. Which law governs a given record depends on who keeps it and under what arrangement, so a practice that works with students and schools can deal with both at once.
Read the answer →How much does privacy affect patient trust in a practice?
A lot. Surveys consistently find that most patients would leave a provider whose security failed them, and a majority of private-practice patients already doubt their provider protects their information.
Read the answer →Does a healthcare marketing agency need to sign a Business Associate Agreement?
If the agency creates, receives, maintains or transmits patient information on your behalf, generally yes. Many agencies touch more patient data than either side realizes, through forms, call tracking, CRMs and ad platforms.
Read the answer →Working with Rook
Is this legal advice?
No. We review marketing practices and flag risks based on published regulations and guidance. When something needs a legal opinion, we'll refer you to a healthcare attorney.
Do you need access to patient information?
Not for the Marketing Risk Report or audit. If a fix requires access to systems that hold patient data, we sign a Business Associate Agreement with you first, the same kind of agreement you signed with your records system.
We already have a marketing agency.
Good. The audit gives them a specific checklist, and we can work alongside them.
We already have a compliance officer or HIPAA training.
Most compliance programs focus on clinical and operational privacy. Marketing tools, ads and reviews usually fall between the cracks. That's where we work.
Do you do our marketing for us?
No. We install the safeguards and systems and train your team to run them. If you need full-service marketing, we'll refer you to a vetted partner.
Who pays for software?
You do, directly. Every account is in your practice's name, so you own your tools and data after handoff.
Do you work with therapists who serve students?
Yes. That's a specialty. Therapists who serve students work under both HIPAA and FERPA, and we build marketing and outreach that respects both.
Find out where your practice stands.
Our free Marketing Risk Report reviews your public website, listings and reviews and shows you the top risks in about a minute.