HIPAA marketing rule: what counts as marketing, the exceptions, and what an authorization must contain

The law has three layers. Each comes from the regulation text; where HHS explained it, the explanation follows in the next sections.

1. The general rule. "A covered entity must obtain an authorization for any use or disclosure of protected health information for marketing", except for the two exempt forms (164.508(a)(3)(i)).
2. The payment disclosure. If the marketing involves financial remuneration from a third party, "the authorization must state that such remuneration is involved" (164.508(a)(3)(ii)).
3. The definition of payment. Financial remuneration means "direct or indirect payment from or on behalf of a third party whose product or service is being described". It excludes payment for treatment of the individual (164.501, paragraph (3) of the definition of marketing).

The rule applies to protected health information held by covered entities and their business associates. A business associate may send a communication for a covered entity only as its contract allows. The contract cannot permit what the covered entity itself could not do (78 FR 5595 to 5596; 45 CFR 164.504(e)).

Paragraph (2) of the definition lists what is not marketing (45 CFR 164.501):

1. Refill reminders and current prescriptions. Messages about "a drug or biologic that is currently being prescribed for the individual", if any payment is "reasonably related to the covered entity's cost of making the communication".
2. Treatment by a provider. Including case management, care coordination, and recommending "alternative treatments, therapies, health care providers, or settings of care".
3. The entity's own health-related products or services. Including provider and plan networks, plan replacements or enhancements, and value-added items available only to plan enrollees.
4. Case management and care coordination that fall outside treatment, including information about treatment alternatives.

Items 2 to 4 carry one condition. They stop being exceptions "where the covered entity receives financial remuneration in exchange for making the communication" (164.501). This is the HITECH change. Before 2013, a third party could pay a covered entity to send a health-related message that still sat outside marketing, which HHS described as a continuing concern (78 FR 5592; 42 U.S.C. 17936(a), LII).

What HHS said. In the 2013 preamble, HHS chose to require authorization for all subsidized treatment and operations communications, rather than an opt-out for treatment messages (78 FR 5595). It also said two kinds of message fall outside the definition altogether. General health promotion, such as encouraging annual mammograms, is not marketing. Neither are communications about government programs such as Medicare, Medicaid or CHIP (78 FR 5597).

Some communications are marketing but still need no authorization. The rule names two forms: "a face-to-face communication made by a covered entity to an individual" and "a promotional gift of nominal value provided by the covered entity" (164.508(a)(3)(i)).

What HHS said about face-to-face. The exemption holds even when a third party pays. A provider may recommend an alternative drug in person, verbally or by handing over a pamphlet. Phone calls, mail and email "do not constitute face to face communications", so a paid message sent that way needs an authorization (78 FR 5596). A targeted digital ad is not face-to-face on that reading.

What HHS said about gifts. Its guidance gives the example of a free package of formula and baby products for new mothers leaving the maternity ward (HHS marketing guidance). The regulation does not set a dollar figure for "nominal value", and we found no HHS figure for it.

The refill exception is the only one that survives payment, and only within a limit. HITECH allowed payment that is "reasonable in amount" and left the meaning to the Secretary (42 U.S.C. 17936(a)(2)-(3), LII). The regulation turned that into payment "reasonably related to the covered entity's cost of making the communication" (164.501).

What HHS said. Permissible costs cover "only the costs of labor, supplies, and postage". Payment that generates a profit or covers other costs falls outside the exception (78 FR 5597). HHS also placed three message types inside the exception. They are the generic equivalent of a prescribed drug, adherence messages and, for self-administered drugs, "all aspects of a drug delivery system", such as an insulin pump (78 FR 5596).

Two more clarifications shape the payment test. In-kind benefits are not financial remuneration, and the payment must be in exchange for making the communication (78 FR 5596). A third-party donation for a new hospital wing does not turn the hospital's flyers about that wing into marketing (78 FR 5593).

A worked example shows the line. A manufacturer pays a pharmacy to send refill reminders for its drug. If the payment covers only drafting, printing and mailing, no authorization is needed. If the manufacturer adds an incentive to keep the pharmacy sending them, the reminders are marketing and need an authorization with the remuneration statement (78 FR 5597).

The sale rule is separate from the marketing rule, and an advertising arrangement can trigger both. A covered entity or business associate "may not sell protected health information" except under an authorization, and that authorization "must state that the disclosure will result in remuneration to the covered entity" (164.502(a)(5)(ii)(A); 164.508(a)(4)).

A sale is a disclosure where the entity "directly or indirectly receives remuneration from or on behalf of the recipient" in exchange for the PHI. The regulation lists eight exclusions, including public health, research for a cost-based fee, treatment and payment, a merger, business associate services paid by the covered entity, and other permitted disclosures for a cost-based fee (164.502(a)(5)(ii)(B)(2)).

Before 2013, the marketing definition itself covered selling patient data so that the buyer could market its own products. HHS removed that clause because the activity became a prohibited sale under HITECH section 13405(d) (78 FR 5594). The HHS marketing guidance page still describes the older clause. It is dated 3 December 2002, revised 3 April 2003, and was last reviewed on 26 July 2013 (HHS marketing guidance).

Read each row with its facts. A change in who pays, which channel carries the message or whose product it promotes changes the answer. The last column links the rule or the HHS statement behind each answer.

The glossary entry for PHI explains when an identifier becomes health information. One case the table leaves open is ad tech itself, covered in the next section.

Digital advertising adds a second question. The ad may promote the entity's own service, which fits an exception. Building the audience may still disclose PHI to a platform. That disclosure needs its own permission, whatever the ad says.

What OCR said. In its tracking-technology bulletin, OCR wrote that disclosing PHI to tracking technology vendors for marketing purposes without individuals' HIPAA authorizations "would constitute impermissible disclosures" (HHS OCR bulletin). On 20 June 2024 the Northern District of Texas vacated the bulletin only where it treated an IP address plus a visit to an unauthenticated public page as PHI. HHS notes that order at the top of the page, last reviewed on 26 June 2024.

What changes the answer. Four facts decide most ad tech cases. Is the data PHI at all? Does the recipient act for the covered entity under a business associate agreement? Does anyone pay the entity for the message? Is the data sold? Our guide to programmatic advertising under HIPAA works through the architectures. The pixel problem in healthcare marketing covers tags and the litigation. For vendors that will sign a business associate agreement, see our review of HIPAA marketing platforms and BAA availability.

HIPAA does not prescribe a form. It lists what a valid authorization must contain, and an authorization missing a required element is defective (164.508(b)(1)-(2)). The list below follows the regulation's order.

Core elements, 164.508(c)(1) (eCFR):

1. A description of the information to be used or disclosed, "in a specific and meaningful fashion" ((c)(1)(i)).
2. The name or specific identification of the person or class of persons authorized to make the use or disclosure (c)(1)(ii).
3. The name or specific identification of the recipients (c)(1)(iii).
4. A description of each purpose of the use or disclosure (c)(1)(iv).
5. An expiration date or an expiration event that relates to the individual or the purpose (c)(1)(v).
6. The individual's signature and date, plus a description of a personal representative's authority where one signs (c)(1)(vi).

Required statements, 164.508(c)(2) (eCFR):

7. The right to revoke in writing, with the exceptions and how to revoke, or a reference to the notice of privacy practices ((c)(2)(i)).
8. Whether treatment, payment, enrollment or eligibility may be conditioned on signing, and the consequences of refusal where the rule permits conditioning (c)(2)(ii).
9. That information disclosed may be redisclosed by the recipient and no longer protected by the rule (c)(2)(iii).

Statements specific to marketing and sale (eCFR):

10. For marketing with third-party financial remuneration: a statement that remuneration is involved ((a)(3)(ii)).
11. For a sale of PHI: a statement that the disclosure will result in remuneration to the covered entity (a)(4)(ii).

Form and handling rules (eCFR):

12. Plain language ((c)(3)), and a copy of the signed form to the individual when the entity asked for it (c)(4).
13. No compound authorization, except as (b)(3) allows; no conditioning of treatment, payment, enrollment or eligibility, except as (b)(4) allows.
14. Revocation in writing at any time, except to the extent of reliance (b)(5); documentation kept under 164.530(j) (b)(6).

HIPAA uses two different words, and only one works for marketing. A covered entity "may obtain consent" for treatment, payment and health care operations, but that consent "shall not be effective" where an authorization is required (45 CFR 164.506(b), eCFR). A checkbox in intake paperwork or a cookie banner is not a 164.508 authorization unless it meets every element above.

The notice of privacy practices points the same way. It must describe the uses that require an authorization under 164.508(a)(2) to (a)(4), which include marketing and sale (164.520(b)(1)(ii)(E), eCFR).

The HIPAA marketing rule binds only covered entities and business associates. A pharmaceutical manufacturer or a telehealth app outside HIPAA answers to the FTC Act and to state law instead. Washington's My Health My Data Act, for example, requires separate consent to collect and to share consumer health data (RCW 19.373.030). The state health privacy law tracker lists those rules. Our ad tech compliance hub collects the related frameworks, and the planned guides to pharma programmatic advertising and telehealth advertising rules cover the non-HIPAA cases.

1. 45 CFR 164.501, Definitions (marketing; financial remuneration). eCFR, current text, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.501
2. 45 CFR 164.508, Uses and disclosures for which an authorization is required. eCFR, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.508
3. 45 CFR 164.502, Uses and disclosures of protected health information: general rules (sale of PHI at (a)(5)(ii)). eCFR, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.502
4. 45 CFR 164.506, Uses and disclosures to carry out treatment, payment, or health care operations. eCFR, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.506
5. 45 CFR 164.514, Other requirements (fundraising at (f)). eCFR, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.514
6. 45 CFR 164.520, Notice of privacy practices. eCFR, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.520
7. 45 CFR 164.504, Uses and disclosures: organizational requirements (business associate contracts at (e)). eCFR, checked 9 November 2026. https://www.ecfr.gov/current/title-45/section-164.504
8. HHS, "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the HITECH Act and the GINA; Other Modifications to the HIPAA Rules", final rule, 78 FR 5566 (25 January 2013); marketing discussion at 5592 to 5598. Federal Register. https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the
9. 42 U.S.C. 17936, Restrictions on certain communications for marketing (HITECH Act section 13406). Legal Information Institute. https://www.law.cornell.edu/uscode/text/42/17936
10. HHS Office for Civil Rights, "Marketing" guidance (3 December 2002, revised 3 April 2003; content last reviewed 26 July 2013). https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html