HIPAA compliant marketing for therapists and teletherapy practices
Updated October 6, 2026
Mental health marketing carries the highest stakes in healthcare. Federal regulators have fined teletherapy companies millions for sharing client information with advertising platforms, often through ordinary marketing tools.
Where the risk shows up
- Advertising pixels and tracking on intake, assessment and booking pages
- Client email lists uploaded to ad platforms, even in hashed form
- Privacy promises on the website that marketing tools don't actually keep
- Outreach and testimonials involving students, which can bring in FERPA as well as HIPAA
- Review replies that confirm someone is a client
What the record shows
The FTC ordered BetterHelp to pay $7.8 million for sharing health questionnaire information and other data with Facebook, Snapchat, Criteo and Pinterest for advertising (FTC).
In 2024 the FTC ordered Cerebral to pay $7 million after alleging it shared the data of nearly 3.2 million consumers with platforms including Snapchat, TikTok and LinkedIn (Paubox).
Also in 2024, the FTC alleged alcohol addiction treatment service Monument shared email addresses with Meta in hashed form, knowing Meta could undo the hashing and identify members in treatment (Arnold & Porter).
Monument's site had told users their information was "100% confidential, secure, and HIPAA compliant." The FTC and HHS had already sent joint warning letters about tracking technologies to about 130 telehealth companies and hospitals (The Markup).
How Rook helps
Rook reviews your practice's marketing from the outside, then installs the safeguards and systems your team runs. Start with a free Marketing Risk Report, or see programs and pricing.
This page is general information about published regulations, enforcement actions and studies. It is not legal advice.