HIPAA-Safe Marketing for Mental Health Practices: Where Tracking, Forms and Testimonials Go Wrong

Marketing and privacy law rarely meet in the same meeting. In a therapy or psychiatry practice they should. The tools that make marketing measurable, such as tracking pixels, forms, text messaging and call recordings, can quietly collect or transmit health information. When that information goes to an advertising platform that has not agreed to protect it, a practice can end up with a compliance problem it never noticed.

The stakes are higher in mental health than in most specialties. Simply being a client of a therapist or a psychiatrist is private information, and a leaked appointment request can do real harm to the person involved.

This article is general information, not legal advice. Rules depend on your state, your business structure and your tools. Use it to know what to ask, and then ask your attorney or compliance officer.

Why marketing data can count as protected health information

Under HIPAA, protected health information (PHI) generally means individually identifiable health information held by a covered entity or its business associates. Identifiers include names, email addresses, phone numbers and IP addresses, and the health connection can be as simple as the fact that someone is a client or requested an appointment for a particular concern.

Federal regulators have said that tracking technologies on certain pages can disclose PHI to third parties. Guidance in this area has been revised and contested in court, so the details have shifted. Separately, the FTC has taken enforcement action against some online mental health and telehealth companies over sharing sensitive user data with advertising platforms. The safe position is to assume that anything linking an identifiable person to a mental health concern or to a care relationship needs careful handling.

If your practice treats substance use disorders, additional federal rules (42 CFR Part 2) may apply, and they are stricter than HIPAA in some respects. Ask your attorney whether they cover you.

Trap 1: Tracking pixels on the wrong pages

Ad and analytics pixels record visits, button clicks and form submissions. On a general information page, such as your homepage, the risk is lower. On pages where a person has logged in, is booking an appointment for a specific concern such as anxiety, depression or trauma, or is filling out intake information, the same pixel could send identifiable health details to an advertising company. Even a page URL like "/anxiety-therapy-booking" paired with an identifier can say a lot.

What to do:

• List every tracking tag on your site, including those added by plugins or past vendors.
• Keep advertising pixels off client portals, intake forms and appointment pages that capture health information.
• Use tools that offer a signed business associate agreement when the tool handles PHI. Many major ad platforms do not sign them, which means they should not receive PHI at all.
• Prefer conversion tracking that records an event, such as "booking completed," without sending names, conditions or other identifiers.
• Review tracking again after every website change.

Trap 2: Web forms and intake

A contact form that asks "what brings you in?" collects health information. Where does the message go? Many website form tools send submissions by plain email, which is not a secure channel.

Safer habits:

• Keep contact forms to scheduling basics: name, phone, preferred time.
• Move clinical intake behind a secure client portal supplied by your practice management or EHR vendor.
• Add a short notice telling visitors not to include health details in general forms.
• Confirm that your form vendor stores submissions securely and will sign a business associate agreement if it handles PHI.

Trap 3: Text, email, chat and voicemail

Standard text messaging and unencrypted email are not secure. A reminder that says "Your appointment is Tuesday at 3" is usually considered low risk, but a message that mentions a condition, a medication or a therapist's specialty line is not. A voicemail or text that identifies your practice as a counseling center can reveal care to a family member who sees the phone.

• Keep marketing and scheduling messages generic, and ask each client how they want to be contacted and whether voicemail or text is safe.
• Get documented consent for text and email communication, and honor opt-outs.
• Train staff not to discuss clinical details in text threads or in web chat widgets.
• If you use an AI chat or answering tool, confirm how it stores conversations and whether the vendor will sign an agreement.
• Have a clear response for messages that suggest a crisis, and make sure your automated tools never present themselves as crisis support. Point people to 988 or local emergency services.

Trap 4: Testimonials and client stories

A client's review is theirs to write. Your use of it in advertising is a different matter, and in mental health many practices simply choose not to feature client testimonials at all, because the relationship is sensitive and licensing boards often restrict them.

• Check your licensing board and professional association rules (for example, those for counselors, social workers, psychologists and psychiatrists) before using any client quote. Some prohibit solicited testimonials.
• Get a written authorization before featuring a client's name, photo, video or story in marketing, and keep it on file.
• Never reply to online reviews in a way that confirms someone is a client. A response such as "Thanks for your feedback. We cannot discuss anyone's care publicly" is safer than any detail.
• Avoid testimonials that imply guaranteed outcomes.

Trap 5: Using client lists for outreach

Sending marketing to your client list can be permissible, but it depends on the content and on whether you are receiving payment from a third party to send it. Uploading client lists to advertising platforms for "lookalike" audiences is a risky practice because it hands identifiable client data to a vendor. Do not do it without legal review.

Build a simple marketing privacy routine

You do not need a large program, just a repeatable one.

1. Inventory: Keep a list of every marketing tool, what data it collects and where it sends it.
2. Agreements: Record which vendors have signed business associate agreements and which handle no PHI at all.
3. Training: Include marketing scenarios in annual staff training, such as what to say in a review reply.
4. Review: Have someone check tags, forms and messaging templates quarterly.
5. Incident plan: Know who to call and what to do if something goes wrong.

Questions to ask any marketing vendor

• What data do you collect from our website and where is it stored?
• Do you place tracking pixels on our client-facing pages?
• Will you sign a business associate agreement if any of your work touches PHI?
• How do you handle our client lists, and do you upload them anywhere?
• Who at your company has access to our accounts?

A vendor that cannot answer these clearly is a risk. For a view of how privacy fits with the rest of your marketing system, see our mental health marketing overview.

Checklist

• Tracking tags inventoried and removed from sensitive pages.
• Forms limited to scheduling basics.
• Texting consent and opt-out process in place, with each client's contact preferences recorded.
• Written authorization on file for any client content, and licensing board rules checked.
• Review replies never confirm client status.
• Vendors asked about business associate agreements.
• Quarterly privacy check on the calendar.

Talk with us

Good marketing and good privacy habits can coexist. If you want a second set of eyes on your website tags, forms and messaging workflow, book a strategy call and bring your compliance contact if you have one.