On this page
The HIPAA marketing rule says marketing means “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service,” and a covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing” unless an exception applies (45 CFR 164.501; 164.508(a)(3)). The rule carves out refill reminders about a drug the patient is already prescribed, treatment and care coordination, and a provider's own health-related services, subject to limits on third-party payment, and it lets face-to-face communications and promotional gifts of nominal value go ahead without an authorization. Curve Compliance, which helps health brands measure ads without sending health data to ad platforms, checked every source below on November 9, 2026.
Book a call. Marketing to patients with paid ads or email? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side with neutral event names and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.
The definition, in the rule's words
The marketing rule sits in the HIPAA Privacy Rule. The definition is in 45 CFR 164.501, and the authorization requirement is in 164.508(a)(3). HHS sums it up this way: “With limited exceptions, the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing” (HHS).
Two points matter most for marketers. First, the definition turns on what a communication does, encouraging someone to buy or use a product or service, not on the channel it uses. Second, the authorization requirement attaches to the use or disclosure of PHI for that communication, which is why patient lists, booking data and ad tracking all come into it. HHS's guidance page is dated December 3, 2002 and was revised April 3, 2003, so where it differs from the current rule text on eCFR, follow eCFR. For the history, see the Omnibus Rule for marketers.
Communications that are not marketing
The definition itself lists communications that are not marketing (45 CFR 164.501):
| Exception | The rule's words | The condition |
|---|---|---|
| Refill reminders | “To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual” | Any financial remuneration the covered entity receives must be “reasonably related to the covered entity's cost of making the communication” |
| Treatment | “For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual” | No financial remuneration for making the communication |
| Your own health-related products and services | “To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication” | No financial remuneration for making the communication |
| Case management and care coordination | “For case management or care coordination, contacting of individuals with information about treatment alternatives, and related functions to the extent these activities do not fall within the definition of treatment” | No financial remuneration for making the communication |
The last three apply “except where the covered entity receives financial remuneration in exchange for making the communication” (45 CFR 164.501). HHS's examples of communications that are not marketing include: “A pharmacy or other health care provider mails prescription refill reminders to patients, or contracts with a mail house to do so,” and “A hospital uses its patient list to announce the arrival of a new specialty group (e.g., orthopedic) or the acquisition of new equipment” (HHS).
Two forms that need no authorization
Even when a communication is marketing, 164.508(a)(3) lets it go ahead without an authorization if it is in the form of “(A) A face-to-face communication made by a covered entity to an individual; or (B) A promotional gift of nominal value provided by the covered entity” (45 CFR 164.508). HHS's examples: “A hospital provides a free package of formula and other baby products to new mothers as they leave the maternity ward,” and “An insurance agent sells a health insurance policy in person to a customer and proceeds to also market a casualty and life insurance policy as well” (HHS).
Both exceptions are narrow. Face-to-face means in person, so an email, a text or a retargeting ad does not qualify. The rule text sets no amount for nominal value, so keep promotional items small, such as a branded pen.
Paid communications and financial remuneration
Financial remuneration means “direct or indirect payment from or on behalf of a third party whose product or service is being described,” and it “does not include any payment for treatment of an individual” (45 CFR 164.501). When the covered entity receives such a payment in exchange for making the communication, the treatment, own-services and care coordination exceptions fall away. And under 164.508(a)(3)(ii), “If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved” (45 CFR 164.508).
So if a manufacturer pays a clinic to email its patients about a new product the manufacturer makes, the email is marketing, it needs each patient's authorization, and that authorization has to say a payment is involved. How these rules apply to a specific campaign or sponsorship is a question to talk to your counsel about.
Where ad tracking fits
HHS's bulletin on tracking technologies ties the marketing rule to pixels directly: “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). On June 20, 2024, a federal court vacated part of that bulletin. The notice at the top of the bulletin limits the vacated part to “circumstances where an online technology connects (1) an individual's IP address with (2) a visit to a[n] [unauthenticated public webpage] addressing specific health conditions or healthcare providers,” and says “HHS is evaluating its next steps in light of that order.”
In practice, check any setup that sends booking, intake or patient portal activity to an ad platform for retargeting or ad optimization against that line. A cookie banner is not a HIPAA authorization. For the authorization itself, see HIPAA marketing authorization and ad tracking; for consent tools, see cookie banners vs HIPAA authorization; for the wider rule, see the Privacy Rule and marketing; and for enforcement, see HIPAA marketing penalties.
How Curve Compliance helps
Curve Compliance helps keep health details out of ad measurement. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names so conditions stay out of what platforms see, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent and what each platform accepted.
When a platform flags something, Curve's team reviews what your site sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve is SOC 2 Type II, signs a BAA on every plan, and its team does the setup, typically live in about a week. For what counts as personal data in the first place, see what is PII. For email lists, see Klaviyo vs Mailchimp for healthcare.
Sources, checked November 9, 2026: 45 CFR 164.501 and 45 CFR 164.508 (eCFR, current as of November 5, 2026); HHS, Marketing (Privacy Rule guidance); HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is the HIPAA marketing rule?
It is the Privacy Rule requirement that a covered entity get a patient's written authorization before using or disclosing PHI for marketing, which the rule defines as a communication that encourages someone to buy or use a product or service (164.508; 164.501). Refill reminders, treatment, care coordination and a provider's own health-related services fall outside that definition, subject to limits on third-party payment.
Are refill reminders marketing under HIPAA?
No, when the reminder is about a drug or biologic currently prescribed for the patient and any payment the covered entity receives for sending it is “reasonably related to the covered entity's cost of making the communication” (45 CFR 164.501).
Is a face-to-face recommendation marketing?
It can be, but it needs no authorization: 164.508(a)(3) exempts “A face-to-face communication made by a covered entity to an individual” (45 CFR 164.508). A recommendation made for the patient's own treatment is not marketing at all, unless a third party pays the provider for making it.
Can a clinic give out branded pens?
Yes. A small branded item fits the exception for “A promotional gift of nominal value provided by the covered entity,” which needs no authorization (45 CFR 164.508).
Does sending website visitor data to Meta count as marketing?
HHS says disclosing PHI to tracking technology vendors “for marketing purposes, without individuals' HIPAA-compliant authorizations,” is an impermissible disclosure (HHS). Whether your site data is PHI depends on what it reveals and who you are, so keep identifiers and health details out of what Meta receives.
Do I need an authorization for email newsletters?
Not when the newsletter only describes your own health-related products or services and no third party pays you to send it, because that falls under the own-services exception (45 CFR 164.501). A newsletter that promotes another company's product, or that a third party pays for, is marketing and needs an authorization.
What must a marketing authorization say when a third party pays?
It must state that the remuneration is involved, under 164.508(a)(3)(ii) (45 CFR 164.508). The authorization also needs the core elements listed in 164.508(c).
Talk to Curve Compliance
Book a call. Checking your paid ads and tracking against the HIPAA marketing rule? Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions that strip PHI before data reaches an ad platform, under a BAA on every plan. Book a call with Curve.