HIPAA does not ban paid advertising for healthcare. It restricts how patient information reaches ad platforms, and most violations come from tracking, not creative. A compliant paid advertising HIPAA compliance program starts with the data your website and campaigns send out, then moves to targeting, and only last to the wording of the ad. This article covers where the line sits, how pixels and retargeting create exposure, how platform rules differ from federal law, and what a defensible setup looks like on Google, Meta, and Microsoft. It is operational guidance, not legal advice, and the rules below reflect what we understand as of 2026.
HIPAA governs covered entities (health care providers who transmit certain transactions electronically, health plans, and clearinghouses) and their business associates, meaning vendors that handle protected health information on their behalf. It regulates how protected health information (PHI) is used and disclosed. It does not regulate advertising as a channel, and nothing in it prevents a dental group or medical practice from buying search ads.
The definition of PHI is broader than most marketers assume. It is individually identifiable health information, and identifiers include names, email addresses, phone numbers, device IDs, and IP addresses. In an ad context, an IP address or device ID paired with the fact that someone viewed a page about a specific condition, or booked an appointment, can qualify. The data does not need to contain a diagnosis to become sensitive. The combination of who and what is enough.
The Privacy Rule also defines marketing. Using or disclosing PHI for marketing generally requires the patient's written authorization. The exceptions are narrow: a face-to-face communication from the provider to the patient, and a promotional gift of nominal value. Telling your existing patients about your own treatments in some contexts falls under separate treatment and health care operations provisions, but sending their data to an ad platform to find or target them is a disclosure that needs its own justification.
That leads to the most common misconception: that only patient lists are risky. Uploading a CRM export to Meta as a Custom Audience is risky, and you should not do it without authorization. But the larger exposure for most practices is passive. Every page load on your website can send data to third parties through scripts you installed years ago and forgot about. Nobody has to upload anything for a disclosure to occur.
A second misconception is that hashing or anonymizing identifiers makes data safe. Platforms match hashed emails and phone numbers back to user accounts. That is the whole point of the feature. Hashing protects data in transit; it does not change the fact that you have told the platform this specific person is connected to your practice.
The mechanism is simple. The Meta Pixel, the Google Ads tag, or the Microsoft UET tag loads in a visitor's browser. When the visitor loads a page or takes an action, the tag sends the page URL, the visitor's IP address, cookie or device identifiers, and event data to the platform. If the URL reads something like /patients/book/oncology-consult, the platform receives a record of a specific browser visiting that page, tied to whatever account the person is logged into.
The HHS Office for Civil Rights issued a bulletin on online tracking technologies in December 2022 and revised it in March 2024. It took the position that regulated entities disclose PHI to tracking vendors in many scenarios, including some on public pages, and that doing so without a permitted basis or a business associate agreement is a violation. In June 2024, in American Hospital Association v. Becerra, a federal court in the Northern District of Texas vacated part of that guidance, specifically the portion treating IP address plus a visit to an unauthenticated public page as PHI. The authenticated-page portions of the guidance were not the target of that ruling. Appeal and enforcement positions can shift, so confirm the current status with counsel before you rely on either side of this.
The FTC has been active on a separate track. In 2023, the FTC and HHS sent a joint letter to roughly 130 hospital systems and telehealth providers warning about tracking technologies. The FTC also brought enforcement actions against GoodRx and BetterHelp that year, alleging the companies shared health-related information with advertising platforms, including for ad targeting, contrary to their privacy promises. Both resulted in settlements, and the BetterHelp matter included a consumer refund component. Those cases rest on the FTC Act and the Health Breach Notification Rule rather than HIPAA, which matters: even if HIPAA does not reach a given business, other law can.
Retargeting built on a visit to a condition-specific page is the highest-risk tactic. It converts a browsing event into a health-related audience list held by an ad platform, and then shows ads that may reveal the person's interest to anyone using the same device. Authenticated pages, such as patient portals and booking confirmations, carry more risk than public service pages because the visitor is already identified as a patient. A tag firing there is much harder to defend than one on a general "Our Services" page.
Platform policy is a separate constraint from HIPAA. Google restricts personalized advertising and remarketing based on sensitive health conditions, and Meta restricts targeting and data use tied to sensitive health attributes. Both also prohibit advertisers from sending sensitive health information through their tools. Violating these rules can get ads disapproved or accounts restricted, which is a business problem, but it is not the same as a HIPAA problem.
The more consequential point is that, as of 2026, the major platforms do not sign business associate agreements for their standard advertising products. Google has offered a BAA for certain Google Cloud and Workspace services, but that does not extend to Google Ads or standard Google Analytics. Meta and Microsoft do not offer one for their ad products either. Confirm each platform's current terms yourself, since offerings change. The practical consequence is that you cannot make PHI sharing compliant by relying on platform terms. If PHI flows into an ad product, there is no contract that fixes it.
Targeting options have also narrowed. In 2022 Meta removed many detailed targeting options tied to sensitive topics, including health-related interest categories. As of 2026, you should assume that condition-based interest targeting on Meta is limited or unavailable and check Ads Manager rather than a stale guide. Google similarly limits remarketing and customer-list targeting for health-related categories, and the exact restrictions are in its published personalized advertising policy.
Two situations follow from keeping the regimes separate:
Approval is not a compliance opinion. Treat the two reviews as independent checks, and pass both.
Favor contextual placement, search intent, and geographic targeting. A person searching "dental implants near me" has told Google what they want in that moment, and you are responding to that query, not building a list of people who visited your site. Avoid remarketing lists built from site visitors on condition-specific pages, and do not upload patient lists to Google Customer Match or Meta Custom Audiences without written authorization.
Do not write copy that implies you know the viewer's condition. "Struggling with your diabetes?" asserts something about the person seeing it, and platforms reject it as well. "Diabetes care in Tulsa" describes your service. Avoid testimonials that disclose PHI unless you hold written authorization from the patient, and keep in mind that a first name plus a described treatment can be enough.
Suppose a dental group runs Google Search and Local Service Ads for implants. Ads send traffic to a public landing page with a call-tracking number and a short contact form. Conversions are call starts and form submissions on that page. The patient scheduling system sits on a separate domain with no ad tags, and no remarketing list is built. The group still gets measurable lead data, and the ad platforms never see anything from inside the clinical workflow.
Start with one question: will the agency ever access PHI? The best structure is that it never does. Ad account management, creative, bidding, and reporting on aggregated lead counts do not require patient records. If the agency has no PHI access, you avoid the need for a BAA. If access is possible, for example through call recordings, CRM exports, or form submission contents, a signed BAA is required before work begins.
Then ask operational questions and listen for specifics:
Vague answers or a reliance on "the platform approved it" are warning signs.
Be clear about responsibility. The covered entity remains accountable for its website and its vendor choices. An agency's job is to design campaigns that minimize risk and to flag problems it sees. It is not to provide legal sign-off, and any agency that offers one is overstepping.
Triad Media Lab works as a senior-led extension of your team, with transparent reporting and no long-term lock-ins, so you can see exactly what is tracked and why. Compliance determinations belong with your privacy officer or healthcare counsel. Agencies serving healthcare clients can also work with us through our white-label Agency Partner Program.
HIPAA risk in paid media lives in data flows, not in ad copy. A carefully worded ad on top of a portal page firing a Meta Pixel is a worse position than a plain ad on a clean public landing page. Before your next campaign goes live, work with counsel to audit every tag on your site and every remarketing audience in your ad accounts, and remove anything you cannot justify. If you want a team that builds campaigns around that discipline, Learn more about our services.
