HIPAA Marketing Rules for Orthodontic Practices: The Basics

HIPAA does not ban orthodontic marketing. It controls how you use patient information in it. Ads to the public that use no patient data are outside HIPAA’s marketing rules. Using a patient’s name, photo, story or contact details for marketing generally needs written authorization. Vendors that handle patient data need a business associate agreement.

This guide explains the rules that matter most for orthodontic practices. It covers what HIPAA calls marketing, testimonials, photos, vendors and website tracking. It is general information, not legal advice. State laws can add stricter rules, so confirm details with a healthcare attorney and your state dental board.

In this article

• Does HIPAA apply to your orthodontic practice?
• What HIPAA counts as marketing
• Testimonials, reviews and patient stories
• Social media and everyday team habits
• Patient photos and videos
• Vendors and business associate agreements
• Website tracking: what changed in 2024
• A practical HIPAA marketing checklist
• Frequently asked questions

Does HIPAA apply to your orthodontic practice?

HHS’s Privacy Rule summary covers “every health care provider, regardless of size,” that sends health information electronically in certain transactions. Electronic insurance claims are a typical example.

Most orthodontic practices that bill dental insurance meet that test. If you are unsure, ask your attorney. Treat this guide as applying to you until you know otherwise.

HIPAA protects “protected health information,” or PHI. In marketing, PHI shows up in places teams overlook:

• Patient and parent names, emails and phone numbers in your practice software or CRM
• Before-and-after photos, smile videos and case galleries
• Form submissions and call recordings that mention treatment
• Review replies that confirm someone is a patient
• Data sent from logged-in patient portal pages to analytics or ad tools

What HIPAA counts as marketing

HHS defines marketing as a communication that “encourages recipients of the communication to purchase or use the product or service.” The key question is whether you use PHI to make that communication.

HHS’s FAQ says the rule requires an authorization to use or disclose PHI “for ALL marketing communications.” There are two exceptions.

• The communication happens face to face between the practice and the patient.
• The communication involves a promotional gift of nominal value.

If a third party pays you to make the communication, the authorization must say so.

HHS guidance also lists communications that are not marketing at all. These include communications for the patient’s treatment, for care coordination, and to describe a health-related product or service the practice itself provides.

Common orthodontic examples

Communication	Uses PHI?	Authorization needed?
Google ad for clear aligners shown to the public	No	Not under HIPAA marketing rules
Retainer check or adjustment reminder	Yes	Generally no: it is for treatment
Email to patients about a new service your practice offers	Yes	Generally no, if no third party pays you to send it
Email promoting another company’s product, paid by that company	Yes	Yes, and it must disclose the payment
Discussing an upgrade option during a consult	Yes	No: face-to-face exception
Branded toothbrush or water bottle given at a visit	Yes	No: promotional gift of nominal value
Patient testimonial on your website or social media	Yes	Yes, signed authorization before posting

Texting and email also involve other rules, such as consent under telecom law. See our guide to orthodontic text message consent.

Testimonials, reviews and patient stories

A happy patient’s story is persuasive marketing. It is also PHI when it identifies the person and their care. HHS says a covered entity “must obtain the individual’s written authorization” for many uses of PHI. That applies to uses outside treatment, payment or health care operations, unless otherwise permitted.

Featuring a patient in marketing is not treatment, payment or operations. Get a signed authorization first. HHS’s summary says an authorization must be in plain language and include:

• A specific description of the information to be used or disclosed
• Who will disclose it and who will receive it
• An expiration date or event
• The patient’s right to revoke the authorization in writing

Verbal permission at the chair is not enough. A social media post is not a signed authorization.

Review replies are a disclosure risk

Replying to an online review can disclose PHI, even when the patient posted first. In 2023, HHS settled with a New Jersey provider over “impermissible disclosures of patient protected health information in response to negative online reviews.” The provider paid $30,000.

Our guide on handling negative reviews as an orthodontist includes safe reply templates.

Social media and everyday team habits

Many HIPAA problems in marketing come from small, friendly posts rather than big campaigns. Staff mean well. They simply do not see a post as a disclosure.

• Debond day shout-outs. “Congrats to Emma on getting her braces off!” with a photo identifies a patient and their treatment. Get a signed authorization first.
• Office photos and videos. Check backgrounds for patients in chairs, schedules on screens and charts on counters.
• Tagging and comments. Do not tag patients or reply to comments in ways that confirm someone is a patient.
• Direct messages. Move treatment questions from social media to a private, approved channel.
• Personal accounts. Team members should not post patient content from their own profiles.

Put these rules in a one-page social media policy. Train new hires on it in their first week, and review it with the whole team each year.

Patient photos and videos

Photos are the core of orthodontic marketing. HHS’s list of identifiers for de-identification includes “full face photographic images and any comparable images.” A smiling full-face photo of a patient is identifiable.

Treat every patient image used in marketing as needing a signed authorization. That includes intraoral images posted next to a name or story.

Most orthodontic patients are minors. HHS says that “in most cases, parents are the personal representatives for their minor children.” A parent or guardian usually signs. State law can change that in some situations.

Our guide to before-and-after photos on orthodontic websites covers authorization forms, minors and accuracy rules in detail.

Vendors and business associate agreements

Many marketing tools touch PHI. HHS defines a business associate as an outside person or entity that performs services for you involving access to PHI.

HHS’s summary lists examples such as claims processing, data analysis, billing, consulting, management and administrative services. For orthodontic marketing, ask whether each vendor handles patient data.

Vendor type	Typical PHI exposure	Ask for a BAA?
Patient communication or reminder platform	Names, phone numbers, appointments	Yes
Call tracking with call recording	Recorded calls about treatment	Yes, if it records or stores PHI
Website form or chat tool	Names and treatment questions	Yes, if it stores submissions
Review request software	Patient names and contact details	Yes
Agency running public search ads only	None, if it never receives patient data	Usually not needed; confirm in writing

Keep a simple vendor inventory. List each tool, the patient data it touches, whether a BAA is signed and who owns the login. Review it when you add a tool or change agencies.

HHS says a business associate contract must limit how the vendor uses PHI, require safeguards and require reporting of breaches. It must also require subcontractors to agree to the same restrictions.

The simplest rule is to keep PHI out of tools that will not sign a BAA. Under our published terms, the practice owns every account, and we design campaigns so patient data stays where it belongs.

Website tracking: what changed in 2024

HHS issued guidance on online tracking technologies such as pixels and analytics tags. In June 2024, a federal court in American Hospital Association v. Becerra vacated part of it.

HHS’s page now carries a note about the ruling. The vacated part covered tools that connect an IP address with a visit to a public, unauthenticated page. Those pages address specific health conditions or healthcare providers.

Other parts of the page remain. HHS says tracking on “user-authenticated webpages generally have access to PHI.” It says regulated entities must ensure tracking vendors with PHI have signed a BAA. It also says cookie banners “do not constitute a valid HIPAA authorization.”

• Keep ad pixels off patient portals, payment pages and logged-in areas.
• Do not send form contents, such as treatment interest plus name, to ad platforms.
• Review what your analytics tags collect at least once a year.

Our guide on tracking pixels and patient privacy walks through a safer setup.

A practical HIPAA marketing checklist

Run every campaign idea through these questions before launch. They will not replace legal advice, but they catch most common mistakes.

1. Does this campaign use any patient information, including names, photos, contact lists or stories?
2. If yes, is it a treatment communication or about your own services, with no third-party payment?
3. If it is marketing, do you have a signed authorization from the patient or parent?
4. Does every vendor that touches the data have a signed BAA?
5. Are ad and analytics tags kept off logged-in pages and form data?
6. Does your team have a written policy for social media and review replies?
7. Have you checked state privacy law and your dental board’s advertising rules?

Advertising rules are a separate layer. Our guide to orthodontic specialty advertising rules covers board and ADA requirements. Our orthodontic reputation management service follows these privacy rules for review requests and replies.

Every campaign we run follows these rules by default. See how our orthodontic marketing agency keeps tracking, reviews and ads privacy-safe.

Frequently asked questions

Is it a HIPAA violation to post a patient’s smile photo on Instagram?

Without a signed authorization, it likely is. A full-face photo is an identifier under HHS’s de-identification standard, and marketing is not treatment, payment or operations. Get a written authorization from the patient, or usually a parent for minors, before posting. Check your state’s privacy and dental board rules too, since they can add requirements.

Do we need authorization to email patients about a new treatment we offer?

Generally no. HHS guidance says communications describing a health-related product or service the practice itself provides are not marketing. That changes if a third party pays you to send the message. Email and text programs also involve other laws, such as anti-spam and telecom consent rules, so check those separately.

Does our marketing agency need to sign a BAA?

Only if it creates, receives, keeps or transmits patient information for you. An agency that runs public search ads and never sees patient data may not need one. An agency that manages your CRM, call recordings, review requests or patient lists does. Put the answer in writing either way.

Is a cookie consent banner enough for HIPAA?

No. HHS’s tracking guidance says website banners asking users to accept or reject tracking do not constitute a valid HIPAA authorization. A 2024 court ruling vacated part of that guidance for public pages. Tracking on logged-in pages that can access patient information still needs careful setup and vendor agreements.

Who signs the authorization for a teenage patient?

HHS says parents are usually the personal representatives for their minor children, so a parent or guardian typically signs. State law can change this in specific situations, such as care a minor can legally consent to alone. Asking the teen to agree too is a respectful extra step. It does not replace the parent’s signature.