HIPAA-Safe Marketing for Chiropractic Practices: Where Tracking, Forms and Testimonials Go Wrong

Marketing and privacy law rarely meet in the same meeting. In a chiropractic practice they should. The tools that make marketing measurable, such as tracking pixels, forms, text messaging and call recordings, can quietly collect or transmit health information. When that information goes to an advertising platform that has not agreed to protect it, a practice can end up with a compliance problem it never noticed.

This article is general information, not legal advice. Rules depend on your state, your business structure and your tools. Use it to know what to ask, and then ask your attorney or compliance officer.

Why marketing data can count as protected health information

Under HIPAA, protected health information (PHI) generally means individually identifiable health information held by a covered entity or its business associates. Identifiers include names, email addresses, phone numbers and IP addresses, and the health connection can be as simple as the fact that someone is a patient or requested an appointment for a particular problem.

Federal regulators have said that tracking technologies on certain pages can disclose PHI to third parties. Guidance in this area has been revised and contested in court, so the details have shifted. The safe position is to assume that anything linking an identifiable person to a health condition or to a care relationship needs careful handling.

Trap 1: Tracking pixels on the wrong pages

Ad and analytics pixels record visits, button clicks and form submissions. On a general information page, such as your homepage, the risk is lower. On pages where a person has logged in, is booking an appointment for a specific condition or is filling out intake information, the same pixel could send identifiable health details to an advertising company.

What to do:

• List every tracking tag on your site, including those added by plugins or past vendors.
• Keep advertising pixels off patient portals, intake forms and appointment pages that capture health information.
• Use tools that offer a signed business associate agreement when the tool handles PHI. Many major ad platforms do not sign them, which means they should not receive PHI at all.
• Prefer conversion tracking that records an event, such as "booking completed," without sending names, conditions or other identifiers.
• Review tracking again after every website change.

Trap 2: Web forms and intake

A contact form that asks "describe your symptoms" collects health information. Where does the message go? Many website form tools send submissions by plain email, which is not a secure channel.

Safer habits:

• Keep contact forms to scheduling basics: name, phone, preferred time.
• Move clinical intake behind a secure patient portal supplied by your practice management vendor.
• Add a short notice telling visitors not to include health details in general forms.
• Confirm that your form vendor stores submissions securely and will sign a business associate agreement if it handles PHI.

Trap 3: Text, email and chat

Standard text messaging and unencrypted email are not secure. A reminder that says "Your appointment is Tuesday at 3" is usually considered low risk, but a message that mentions a condition or treatment is not.

• Keep marketing and scheduling messages generic.
• Get documented consent for text and email communication, and honor opt-outs.
• Train staff not to discuss clinical details in text threads or in web chat widgets.
• If you use an AI chat or answering tool, confirm how it stores conversations and whether the vendor will sign an agreement.

Trap 4: Testimonials and patient stories

A patient's review is theirs to write. Your use of it in advertising is a different matter.

• Get a written authorization before featuring a patient's name, photo, video or story in marketing, and keep it on file.
• Never reply to online reviews in a way that confirms someone is a patient.
• Do not post before-and-after content or case stories without authorization and a check against your state board's advertising rules.
• Avoid using testimonials that imply promised outcomes.

Trap 5: Using patient lists for outreach

Sending marketing to your patient list can be permissible, but it depends on the content and on whether you are receiving payment from a third party to send it. Uploading patient lists to advertising platforms for "lookalike" audiences is a risky practice because it hands identifiable patient data to a vendor. Do not do it without legal review.

Build a simple marketing privacy routine

You do not need a large program, just a repeatable one.

1. Inventory: Keep a list of every marketing tool, what data it collects and where it sends it.
2. Agreements: Record which vendors have signed business associate agreements and which handle no PHI at all.
3. Training: Include marketing scenarios in annual staff training, such as what to say in a review reply.
4. Review: Have someone check tags, forms and messaging templates quarterly.
5. Incident plan: Know who to call and what to do if something goes wrong.

Questions to ask any marketing vendor

• What data do you collect from our website and where is it stored?
• Do you place tracking pixels on our patient-facing pages?
• Will you sign a business associate agreement if any of your work touches PHI?
• How do you handle our patient lists, and do you upload them anywhere?
• Who at your company has access to our accounts?

A vendor that cannot answer these clearly is a risk. For a view of how privacy fits with the rest of your marketing system, see our overview of why chiropractic marketing fails.

Checklist

• Tracking tags inventoried and removed from sensitive pages.
• Forms limited to scheduling basics.
• Texting consent and opt-out process in place.
• Written authorization on file for any patient content.
• Review replies never confirm patient status.
• Vendors asked about business associate agreements.
• Quarterly privacy check on the calendar.

Talk with us

Good marketing and good privacy habits can coexist. If you want a second set of eyes on your website tags, forms and messaging workflow, book a strategy call and bring your compliance contact if you have one.