HIPAA and Dental Marketing: The Rules in Plain English

The short answer

What HIPAA calls marketing

In the regulation's words, marketing is a communication about a product or service that "encourages recipients of the communication to purchase or use the product or service" [1]. Put each patient-facing promotion through that test with your counsel before it goes out: a whitening offer emailed to your patient list, a recall message that also promotes a new service, or a social post that features a patient. Read 45 CFR 164.501 in full; this article quotes only its core sentence.

When HIPAA requires a patient's authorization

The exceptions are narrow, and a disclosure can reach well beyond the practice's own channels. In one of four enforcement actions HHS announced on March 28, 2022, Northcutt Dental-Fairhope in Alabama disclosed patient information "to a campaign manager and a third-party marketing company" hired for a state senate election campaign, and agreed to pay $62,500 [3]. Anyone outside the practice who receives patient information for promotion belongs in that conversation with counsel.

Replying to reviews without disclosing anything

OCR's director put it plainly when announcing the New Vision Dental settlement on December 14, 2022: providers cannot disclose patients' protected health information when responding to negative online reviews. "This is a clear NO." [4] It is not only dentists: Manasa Health Center, a New Jersey psychiatric practice, paid $30,000 after posting a response to a patient's negative online review that disclosed the patient's information [5].

The American Dental Association's guidance on negative reviews gives the safe pattern: respond "in very broad 'all patient' terms", invite anyone who wants to discuss their experience to contact the office directly, and "Never reference a specific person or incident." [6] That means no "as your dentist", no treatment details and no dates of visits.

Asking for reviews and using testimonials

The FTC's rule is 16 CFR Part 465, published at 89 FR 68034 on August 22, 2024, and it binds businesses [7][8]. It also bans company-controlled "independent" review sites and "fake indicators of social media influence" [8]. FTC staff say the rule does not ban incentives that carry no sentiment condition, and that asking only happy customers, while not specifically banned by the rule, "could violate the FTC Act" [9]. Google's policy is stricter: merchants may not offer incentives "in exchange for posting any review" or selectively solicit positive reviews [10].

The ADA adds that it is "generally and strongly recommended" that practices not pay for online reviews, and notes that some jurisdictions may prohibit soliciting online reviews by patients [11]. Check your state board's rules before you build a review program; our guides on how to get Google reviews and whether Google reviews help SEO cover the rest.

Testimonials are endorsements. The FTC's Endorsement Guides, updated June 29, 2023, are guidance under the FTC Act rather than a rule. They say a testimonial will likely be read as representing what consumers will generally achieve, and that advertisers "should not take actions that have the effect of distorting" what consumers think [12][13]. The ADA Code, 2025 edition, which binds ADA members, treats statements "likely to create an unjustified expectation about results" as misleading [14].

Photos, social media and case stories

Before-and-after photos also carry an FTC meaning. The Endorsement Guides give the example of an ad that simply features "before" and "after" pictures: it "is likely to convey that the endorser's experience is representative" [13]. Pick results you would call typical.

Social media now has its own line in the ADA Code. Since the 2025 edition, announced February 24, 2025, unsupported claims of safety, efficacy or superiority are misleading whether made "in print or digital via social media or via a dental influencer", and anyone endorsing a product or service "must disclose any paid partnerships with vendors" [14].

Website tracking: what the 2024 ruling changed

The bulletin is "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates", issued by HHS's Office for Civil Rights in December 2022 and revised on March 18, 2024 [15]. The case is American Hospital Association v. Becerra, No. 4:23-cv-1110, in the Northern District of Texas. The court said its vacatur should not be construed as limiting "the legal operability of other guidance" in the HHS document [16], and the AHA reported on August 29, 2024 that HHS would not appeal [17].

What the bulletin still says:

• "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI." [15]
• Pages where people schedule appointments without logging in may have access to PHI in certain circumstances; then the tracking vendor is a business associate and "a BAA is required" [15].
• Cookie banners "do not constitute a valid HIPAA authorization" [15].
• Disclosing PHI to tracking vendors for marketing without HIPAA-compliant authorizations "would constitute impermissible disclosures" [15].

Regulators have warned about this before. On July 20, 2023, the FTC and HHS wrote to about 130 hospital systems and telehealth providers about technologies such as the Meta/Facebook pixel and Google Analytics; dentists were not among the recipients [18]. The FTC has also moved against health data flowing to advertising platforms outside dentistry, with proposed orders against BetterHelp ($7.8 million, March 2, 2023) and Cerebral (April 15, 2024) [19][20]. For the site setup itself, see our list of dental website must-haves.

Market the practice, not the patient

Strong dental marketing needs no patient details: it needs pages that answer questions, a complete Business Profile and genuine reviews collected within the rules. That is the work behind our dental SEO and our first page guarantee, offered after an assessment for a phrase list agreed in writing, with its written terms measuring the share on page one separately in each of the three places: the map results, the organic results and Google's AI answers. More channels are in our dental marketing strategies guide, and a free SEO audit shows where your practice stands.

This is general information, not legal advice.