Addiction Treatment Marketing Compliance: HIPAA, LegitScript & Google Ads Rules Explained

The complete guide for treatment center operators and marketing teams navigating the most regulated advertising environment in healthcare.

---

---

The Regulatory Stack: What Governs Addiction Treatment Marketing

Before going deep on each layer, it helps to see them together. A single piece of advertising — a Google search ad, a Facebook retargeting campaign, a landing page with a call tracking number — can simultaneously implicate:

Each framework has different enforcement mechanisms, different penalties, and different compliance requirements. A marketing program that satisfies one layer can still violate another. Understanding how they interact is the actual work of compliance-first addiction treatment marketing.

---

HIPAA in the Addiction Treatment Marketing Context

What HIPAA Actually Covers

HIPAA applies to “covered entities” — healthcare providers, health plans, and healthcare clearinghouses — and their “business associates.” If your treatment facility is a covered entity (which it is if it provides healthcare services), HIPAA governs how you handle Protected Health Information (PHI).

PHI is any individually identifiable health information held or transmitted by a covered entity.

In marketing, this becomes complicated because several common digital marketing tools — analytics platforms, advertising pixels, CRM systems, call tracking software — collect and transmit data that can constitute PHI when it’s in the hands of a healthcare provider.

The marketing-specific HIPAA rules are found primarily in the Privacy Rule (45 CFR Part 164) and center on a single core principle: you cannot use or disclose PHI for marketing purposes without written authorization from the individual, with limited exceptions.

The Pixel Problem: Why Standard Analytics and Advertising Tracking Violates HIPAA

This is the most common and consequential HIPAA compliance failure in addiction treatment marketing, and it affects the majority of treatment centers that haven’t specifically audited their tracking infrastructure.

When a person visits your website, fills out an inquiry form, calls your phone number via a call tracking link, or initiates a chat, they are a potential patient.

Standard Google Analytics, the Meta Pixel, Google Ads conversion tracking, and most call tracking platforms were not built for HIPAA compliance.

They transmit user-level data to third-party servers (Google, Meta, etc.) without a Business Associate Agreement (BAA) in place. Google explicitly states in their google analytics and google ads terms of service that they are not a HIPAA business associate. Meta says the same.

What this means practically:

• A Google Analytics account tracking your website visitors is, by default, sending identifiable behavioral data about potential patients to Google without a BAA — a potential HIPAA violation.
• A Meta Pixel firing on a contact form confirmation page is sending data about someone who just requested information about addiction treatment to Meta — a potential HIPAA violation.
• A standard call tracking platform that records calls and stores data in its own system without a BAA is a potential HIPAA violation.
• Retargeting campaigns that use pixel-collected audiences consisting of people who visited your treatment inquiry pages are built on PHI — and targeting them with ads may constitute an unauthorized use of that PHI.

The OCR (Office for Civil Rights at HHS) has made clear through enforcement actions and guidance that this is not a theoretical concern. In December 2022, HHS issued a bulletin specifically addressing the use of tracking technologies by HIPAA-covered entities, stating that when a covered entity uses tracking code that transmits to a vendor without a BAA, it violates HIPAA’s Privacy and Security Rules.

Penalties range from $100 to $50,000 per violation per category, with annual maximums up to $1.9 million per violation category. A single un-remediated pixel that’s been running for two years represents thousands of individual incidents.

What HIPAA-Compliant Tracking Looks Like

There are several approaches to building compliant tracking infrastructure. None of them are plug-and-play defaults — they require intentional implementation:

Business Associate Agreements (BAAs). For any vendor that will touch PHI, a BAA must be in place before data flows to them. Some vendors (certain CRM platforms, some analytics tools built specifically for healthcare) will sign BAAs. Google and Meta will not. This means for those platforms, you either need a technical solution that prevents PHI from reaching them, or you don’t use them on PHI-triggering pages.

Server-side tagging and conversion APIs. Rather than using client-side pixels that transmit data directly from the user’s browser to advertising platforms, server-side tagging routes data through your own server first, where it can be filtered, stripped of PHI, and hashed before transmission.

Google’s Consent Mode and Meta’s Conversions API (CAPI) can be implemented with server-side filtering that removes PHI from the data stream. This allows for some level of conversion tracking and optimization without transmitting raw PHI.

Some ‘Hipaa compliant analytics / google ads / meta pixel ads setups we have seen actually do transmit PHI, and some we have seen strip so much data that sending to google ads / tag manager / meta pixel with all data stripped makes it worthless and simply a tax on your server resources with no benefits.

More on this in our blog posts and webinars.

Consent management platforms. A properly implemented consent management platform (CMP) can gate tracking behind explicit user consent. Under this approach, analytics and advertising pixels only fire for users who have explicitly consented to tracking. The limitation is that this significantly reduces data volume — most users in crisis don’t engage with cookie banners deliberately — and this cmp doesn’t fully resolve the PHI issue on the healthcare provider side.

HIPAA-compliant analytics alternatives. Platforms like Matomo (self-hosted), or analytics tools built specifically for healthcare with BAAs available, can replace standard analytics on sensitive pages without creating HIPAA exposure.

(as mentioned above, some ‘lessened hipaa exposure services’ we have reviewed either remove only a portion of PHI or remove so much, that sending the data to ad pixels becomes worthless)

HIPAA and Call Tracking

Call tracking — routing calls through trackable phone numbers to attribute marketing spend to phone inquiries — is standard practice in addiction treatment marketing because phone calls are how most admissions happen. The HIPAA implications are significant.

A call tracking platform typically records the call, stores the recording, logs caller phone numbers, and integrates with CRM systems. All of this involves PHI (a phone call about seeking addiction treatment from an identified phone number is PHI).

Compliant call tracking requires:

• A signed BAA with the call tracking vendor
• Call recording notices that meet applicable state wiretapping disclosure requirements
• Secure storage and access controls for recordings
• Data retention policies and procedures
• Integration with your overall Security Rule compliance program

Several call tracking platforms serve healthcare and will sign BAAs, including some built specifically for the treatment center market. Generic business call tracking tools (most of them) will not, and using them to track patient inquiries is a compliance exposure.

Email Marketing and HIPAA

If you’re sending marketing emails to individuals who are or have been patients of your facility, those communications are subject to HIPAA’s marketing rules.

Sending promotional communications about your services to a current patient list typically requires individual written authorization unless the communication falls within a limited exception (such as treatment communications or communications about treatment alternatives when there’s no financial relationship with the alternative provider).

Email to prospective patients who found you through non-PHI channels (opted into a general mailing list, for instance) and haven’t established a patient relationship is governed more by CAN-SPAM act, and your consent practices, more than HIPAA.

Can-Spam act is serious and some state laws take it further. Omitting rule 4 (Your message must include your valid physical postal address.) can cost you a lot of money with one email blast.

The line between “prospective patient” and “patient” for HIPAA purposes can be blurry and depends on the nature of the contact.

---

42 CFR Part 2: The Substance Use Disorder Privacy Overlay

42 CFR Part 2 is a federal regulation that predates HIPAA and is, in several important ways, stricter than HIPAA. It specifically governs the confidentiality of substance use disorder (SUD) patient records held by federally assisted programs.

“Federally assisted” is broadly defined and includes programs that receive any federal funds (including Medicare and Medicaid reimbursement), are conducted by a federal agency, or are authorized or licensed under federal law.

Most addiction treatment centers qualify as federally assisted programs. For those facilities, 42 CFR Part 2 applies to all SUD patient records, and its requirements are more restrictive than HIPAA’s in several key ways:

Stricter disclosure rules. Under HIPAA, covered entities can share PHI for treatment, payment, and healthcare operations without patient authorization in many circumstances. Under 42 CFR Part 2, SUD records generally cannot be disclosed without written patient consent even for treatment coordination with other providers, with limited exceptions.

More specific consent requirements. The 42 CFR Part 2 consent form has specific required elements that go beyond HIPAA authorization requirements, including a list of permitted disclosures, expiration provisions, and anti-redisclosure language.

Marketing implications. Any use of patient records or patient-derived information for marketing purposes by a facility subject to 42 CFR Part 2 is subject to its consent requirements. This includes testimonials — using a patient’s experience for marketing purposes without a 42 CFR Part 2-compliant consent is a federal violation, not just an ethical issue.

What changed in 2020. HHS updated 42 CFR Part 2 in 2020 (effective March 2021) to better align with HIPAA in some areas, making it somewhat easier to share records for treatment coordination with patient consent. However, the core prohibition on disclosure without consent remains, and the marketing implications are unchanged.

The practical marketing implications of 42 CFR Part 2 are primarily around patient testimonials, case studies, alumni marketing programs, and any data use that involves records from your SUD treatment program. If you’re running an alumni engagement program, retargeting past patients, or using patient outcomes in your marketing, 42 CFR Part 2 compliance must be specifically addressed.

---

LegitScript Certification: The Gate to Paid Search Engine Marketing / Facebook / Instagram sponsored ads

Who Needs LegitScript Certification

You need LegitScript certification to run paid ads for addiction treatment services on any platform that requires it, including:

• Google Ads (Search, Display, YouTube)
• Microsoft Advertising (Bing)
• Facebook and Instagram (Meta has separate but related policies)
• Pinterest (certain healthcare categories)
• Various other ad networks have also adopted LegitScript standards

If your treatment center provides any of the following services and wants to advertise them via paid search or paid social, certification is required:

• Drug and alcohol detox
• Residential treatment
• Partial hospitalization (PHP)
• Intensive outpatient (IOP)
• Outpatient treatment
• Medication-assisted treatment (MAT)
• Sober living/recovery housing (some contexts)
• Dual diagnosis treatment

What LegitScript Certification Allows You to Do

Certified status does not mean unrestricted advertising. It means you’re eligible to advertise, subject to platform-specific policies that still apply.

Your ads still must:

• Accurately represent your facility and services
• Not contain prohibited claims
• Direct users to pages that match the ad content
• Comply with Google’s broader healthcare and medicines advertising policies and Facebook’s (Meta) policies

Certification is the key that unlocks the door. What you do once you’re through the door still matters.

LegitScript Certification and Your Marketing Agency

Here’s where treatment centers often get burned: LegitScript certifies facilities, not agencies. Your marketing agency cannot be LegitScript certified on your behalf. What this means operationally is:

• Your facility must hold its own LegitScript certification
• Your certification is tied to your Google Ads account(s)
• If your agency manages a Google Ads account under their MCC (manager account) and runs addiction treatment ads in it without your facility’s LegitScript certification properly linked, that account is at risk
• When you change agencies, the certification status and account history stay with the account, not the agency

Agencies with deep experience in addiction treatment marketing know how to properly link facility certifications to Google Ads accounts and how to structure account access to protect your certification standing during agency transitions.

---

Keyword and targeting restrictions. Google has at various points restricted certain targeting methods for sensitive healthcare categories, particularly limiting the use of audience targeting based on health conditions. Policies in this area have evolved and continue to evolve — what’s permitted in a given campaign structure should be verified against current policy at the time of campaign build.

The Practical Impact of Google’s Policy Enforcement

Google’s automated systems and human review processes flag and suspend addiction treatment advertising accounts regularly. Common enforcement actions include:

Ad disapprovals for policy violations in specific ads, which don’t necessarily affect other ads in the account but create gaps in coverage and require remediation.

Account suspensions for serious violations or patterns of violation. A suspended account cannot run any ads until the suspension is resolved, which can take days to weeks and requires submitting an appeal with documentation of remediation.

Policy change-driven disruptions when Google updates its healthcare policies. These changes happen without advance notice to advertisers and can cause compliant campaigns to suddenly become non-compliant.

For treatment centers that depend heavily on paid search for admissions, an account suspension is an immediate crisis. Building compliance into the account from the start — and maintaining a relationship with someone who monitors Google policy changes — is not optional for programs that treat paid search as a significant admission source.

Microsoft Advertising (Bing)

Microsoft Advertising has adopted policies similar to Google’s, including a LegitScript certification requirement for addiction treatment advertising. If you’re running Bing ads for addiction treatment, the same certification and policy considerations apply.

---

Some treatment centers using Meta advertising choose to use Meta’s Conversions API (CAPI) with server-side filtering that prevents (some? all?) PHI from being transmitted, combined with consent infrastructure. This is a technical implementation task that requires specific expertise — it is not the default setup for a Meta Pixel installation.

We consider it wasteful in most cases to send stripped patient or client data back to meta, google, or any other place. In an effort to try to get some bonus from sending stripped conversion data and stay Hipaa compliant, we find that it either violates or Hipaa or sending data back with no info gives you no ads benefit so it is twice as wasteful.

We are always looking for ways to do things in a Hipaa compliant way that has benefits for marketing spend. As of May 2026 we still have not found a way to do this data sharing of conversion data in compliance with Hipaa.

---

Success Rate and Outcome Claims

This is the area where treatment centers most frequently create legal exposure without realizing it.

The FTC requires that any objective claim made in advertising be substantiated — meaning you must have competent and reliable evidence to support the claim before you make it, not after someone challenges it.

Claims that commonly appear in addiction treatment marketing and require substantiation:

Recovery rate claims. “Our clients achieve lasting sobriety” or “90% of our graduates are still sober at one year” are objective claims. If you don’t have rigorous, methodologically sound data to support them — tracked outcomes, defined measurement criteria, a representative sample — making them is deceptive advertising under the FTC Act. The challenge is that outcome tracking in addiction treatment is genuinely difficult, and most facilities do not have data that would meet the FTC’s substantiation standard for strong outcome claims.

Comparison claims. “Higher success rates than traditional 12-step programs” or “More effective than other treatment approaches” require comparative data. Vague superiority claims without data are deceptive.

“Best” claims. “#1 addiction treatment center in [state/region]” requires a defined, verifiable methodology for that ranking. If it’s self-assigned without substantiation, it’s deceptive.

The safest approach is to focus marketing claims on your program’s attributes — your staff credentials, your clinical approach, your accreditations, your evidence-based modalities — rather than outcome percentages. What you do is more verifiable than what percentage of patients succeed by some measure, given how difficult addiction treatment outcomes are to track and define.

Testimonials and Endorsements

The FTC’s Endorsement Guides (16 CFR Part 255, significantly updated in 2023) govern how testimonials and endorsements can be used in advertising. The rules that most directly affect addiction treatment marketing:

Testimonials must reflect typical results. If you feature a patient testimonial describing their successful recovery, and that experience is not typical of your patient population, you must clearly disclose that. Phrases like “results not typical” were historically used for this purpose, but the 2023 FTC Guides made clear that such disclaimers are insufficient if they’re buried or easy to ignore — the non-typicality must be clearly communicated.

You cannot cherry-pick outlier results. Featuring only your best outcomes while presenting them as representative of typical patient experience is deceptive regardless of whether each individual testimonial is accurate.

Paid or incentivized endorsements must be disclosed. If you pay patients, provide free services, or offer any consideration in exchange for testimonials, that relationship must be clearly disclosed.

Social media endorsements. If alumni or advocates post positive content about your facility on social media and you have any kind of relationship with them (paid, discount, affiliate, or formal ambassador program), those posts require disclosure under the Endorsement Guides.

The 42 CFR Part 2 Intersection with Testimonials

Testimonials from former patients at an SUD treatment program subject to 42 CFR Part 2 require more than FTC compliance — they require a 42 CFR Part 2 compliant written consent that specifically authorizes the use of the patient’s information for marketing purposes.

This means your testimonial collection process needs both a 42 CFR Part 2 compliant consent form AND compliance with FTC testimonial requirements.

Many treatment centers have testimonials on their websites collected under generic photo/media releases that don’t meet either standard.

Insurance and Cost Claims

Making claims about insurance coverage (“we accept most major insurance” or “your insurance may cover 100% of treatment”) without verification creates FTC exposure. These statements can create false impressions about affordability and influence decisions to seek care based on financial expectations that turn out to be inaccurate.

More specific: any representation about what insurance will cover for a specific patient before verification has actually been completed is a potential problem. Marketing can accurately describe which insurance plans you’re in-network with. It cannot promise coverage outcomes before those outcomes are verified for the individual.

The No Surprises Act (effective 2022) adds a separate layer here — patients have specific rights to cost estimates, and marketing that creates inaccurate cost impressions intersects with those rights.

---

State Law Considerations

Why Federal Compliance Isn’t Enough

Federal law establishes minimum standards. States can and do enact stricter requirements, and addiction treatment marketing is an area where many states have moved aggressively. Operating in multiple states — or marketing nationally to patients who may be in any state — requires understanding the patchwork of state requirements.

State Substance Use Confidentiality Laws

Many states have enacted their own substance use disorder confidentiality laws that are stricter than 42 CFR Part 2 in specific ways. California, New York, Illinois, and Texas, among others, have state-level SUD privacy protections that treatment centers must comply with when treating residents of those states.

A multi-state facility, or a facility that markets nationally and admits patients from multiple states, cannot assume that federal 42 CFR Part 2 compliance is sufficient for all patients. State law analysis is required.

State Advertising and Licensing Rules

Many states regulate healthcare advertising directly, including:

Licensure advertising requirements. Some states require that advertising by licensed healthcare facilities include specific disclosures about licensure status or licensure numbers.

False advertising prohibitions. State consumer protection laws parallel the FTC Act but sometimes have different standards, different enforcement priorities, and different private right of action provisions (meaning patients or competitors can sue you, not just regulators).

Patient brokering laws. Most states now have specific prohibitions on patient brokering in the addiction treatment context, including restrictions on referral fee arrangements and lead generation practices. These laws vary significantly in scope, definitions, and enforcement from state to state.

State certification and accreditation requirements. Some states have their own certification requirements for marketing specific treatment modalities or claiming certain types of specialization.

Florida, California, and Texas: Higher Stakes States

These three states represent significant concentrations of addiction treatment facilities and have been the most active in enforcement:

Florida passed the Patient Brokering Act and related legislation after the “Florida shuffle” scandals of the mid-2010s. Florida law on patient brokering, kickbacks, and referral arrangements is detailed, actively enforced, and has resulted in criminal prosecutions. Treatment centers marketing to Florida patients or operating in Florida need specific Florida law analysis.

California has detailed SUD confidentiality law (Welfare and Institutions Code sections on drug and alcohol treatment confidentiality), strict consumer protection enforcement via the CCPA’s health data provisions, and a private right of action for many advertising violations.

Texas has aggressive enforcement by the Health and Human Services Commission on licensing and advertising claims.

---

---

Step 2: Remediation by Priority

Not everything can be fixed at once, and some fixes are more urgent than others. Prioritization should be based on:

• OCR enforcement risk: Active HIPAA violations — particularly non-compliant pixels on inquiry pages — represent the highest acute risk and should be remediated first.
• Platform suspension risk: LegitScript gaps and non-compliant ad copy create business continuity risk (admissions going to zero) and should be addressed immediately.
• FTC and state law risk: Unsubstantiated claims and non-compliant testimonials create long-term legal exposure but typically don’t generate immediate operational disruption.

Step 3: Compliant Infrastructure Build

Once remediation is complete, build compliant infrastructure going forward:

Tracking: Implement server-side tagging with PHI filtering, consent management for user-controlled tracking, and restrict tracking on sensitive pages. Secure BAAs with vendors who will sign them. Use HIPAA-compliant analytics alternatives where necessary.

LegitScript: Obtain and maintain certification. Understand the renewal requirements and build them into your compliance calendar.

BAAs: Establish a vendor review process that requires BAA evaluation before any vendor integration that touches PHI goes live.

Ad accounts: Structure Google Ads accounts to properly link LegitScript certification. Establish ad copy review processes that check for prohibited claims before ads go live.

Content and testimonials: Build a compliant testimonial collection process that meets both 42 CFR Part 2 consent requirements and FTC Endorsement Guide requirements. Review existing testimonials against these standards.

Step 4: Ongoing Monitoring and Maintenance

Platform policy monitoring: Google, Meta, and other platforms update their healthcare advertising policies without advance notice to advertisers. Someone needs to be tracking these changes and responding to them. Policy changes that affect running campaigns can happen at any time.

Account health monitoring: Regular review of Google Ads account status, disapprovals, and policy warnings. Early detection of issues prevents small problems from becoming account suspensions.

Regulatory monitoring: OCR enforcement guidance, FTC updates to the Endorsement Guides, and state law changes all affect compliance requirements. Healthcare marketing compliance is not a static target.

Annual compliance review: At minimum annually — and more frequently as your program scales — a comprehensive review of your marketing compliance posture against current requirements.

Step 5: Staff Training and Vendor Alignment

Compliance failures often happen not because nobody knows the rules, but because the people executing marketing tasks — writing ad copy, collecting testimonials, adding website integrations — haven’t been trained on the specific rules that apply to what they’re doing.

Internal marketing staff, external agencies, and freelancers who contribute to your marketing program should all understand the basic compliance requirements relevant to their work. An agency that adds a pixel to your website without checking your BAA status and HIPAA implications is a compliance liability, not just a service provider.

---

---

The Agency Side: What to Demand From Your Marketing Partner

If you’re working with a marketing agency on your addiction treatment advertising — or evaluating agencies — compliance competence is not a differentiator, it’s a prerequisite. Here’s what a genuinely compliant agency should be able to demonstrate:

LegitScript knowledge: Can they walk you through the certification process, the timeline, the ongoing requirements, and how certification is linked to your Google Ads account? If they’re vague or say they’ll “handle it,” that’s a problem.

HIPAA tracking competence: Can they conduct or facilitate a tracking audit of your website? Do they understand the difference between client-side pixels and server-side tagging? Can they name which of your current vendors have signed BAAs and which haven’t?

42 CFR Part 2 awareness: Do they know what this regulation is and how it affects patient testimonials and data use in your marketing program? Many healthcare marketing agencies are not aware of 42 CFR Part 2 at all.

Google Ads policy history in addiction treatment: Have they had accounts suspended? What happened? How did they remediate? An agency that has operated in this space long enough will have encountered enforcement situations — what matters is how they handled them.

FTC claim review process: What is their process for reviewing ad copy and content claims before publication? Do they flag unsubstantiated outcome claims, or do they write whatever they think will perform?

Compliance documentation: Can they show you BAAs they’ve executed with vendors on your behalf, their ad copy review checklist, their LegitScript compliance procedures?

The right answer to each of these questions is a substantive, specific answer from someone who clearly knows the territory. Vague reassurances that “we handle all of that” are a flag, not a comfort.

---

TCA’s Compliance Approach

Treatment Center Agency was built around this environment. We work exclusively in addiction treatment and behavioral health — no other verticals, no clients who have never encountered a Google Ads policy suspension or a LegitScript renewal issue.

Our approach to compliance isn’t a department we added when compliance became a hot topic. It’s the foundation the agency was built on, because we’ve seen what happens to treatment centers whose marketing programs aren’t built this way:

Programs go dark when Google suspends an account. Facilities get OCR letters triggered by pixel complaints. Testimonial pages get cited in FTC investigations. Treatment centers lose years of ad account history and optimization data when a non-specialist agency mismanages their LegitScript standing during a transition.

Our standard for new clients begins with a compliance audit before strategy or campaigns. We won’t run advertising in an account that isn’t compliant, and we won’t build tracking infrastructure that creates liability for our clients. That’s not a constraint on our ability to drive results — it’s the operating discipline that makes durable results possible.

Every client owns their assets. Your LegitScript certification stays with you. Your Google Ads account is yours. Your website, your content, your tracking infrastructure — all of it is built to be yours, regardless of what the agency relationship looks like in the future.

No long-term contracts. Compliance-based confidence doesn’t need to be locked in. If we’re doing the job, you stay. If we’re not, you shouldn’t be locked into a contract that keeps money flowing to an agency that isn’t performing.

If you’d like a compliance assessment of your current marketing program — tracking infrastructure, ad accounts, content claims, vendor BAA status — we offer a structured audit that gives you a clear picture of your current risk profile and what it would take to remediate it.

---

Frequently Asked Questions

Do I need LegitScript certification to run Facebook ads for my treatment center? Meta has its own healthcare advertising policies that are related to but separate from LegitScript. Google explicitly requires LegitScript certification for addiction treatment ads. Meta’s enforcement has been less consistent, but its policies for health-related advertising and special ad categories apply to addiction treatment advertising. Consulting a specialist on current Meta policy for your specific situation is advisable.

We’ve been running Google Ads for years without LegitScript certification. How is that possible? Google’s enforcement is not instantaneous or uniform. Some accounts have operated in non-compliant states for extended periods before enforcement caught up. When it does catch up, account suspension is retroactive — the history of running without certification doesn’t protect you from future enforcement.

Can our marketing agency handle the LegitScript certification application? An agency can assist with the application process and ensure the account is properly configured once certification is obtained. However, the certification is issued to the facility, not the agency. Ownership of the certification and the associated Google Ads account must be structured to remain with the facility.

What’s the difference between a HIPAA authorization and a consent for marketing under 42 CFR Part 2? A HIPAA authorization allows a covered entity to use or disclose PHI for purposes not otherwise permitted by the Privacy Rule, including marketing. A 42 CFR Part 2 consent has specific additional required elements and applies to SUD records at federally assisted programs. For treatment centers subject to both, testimonials and patient-facing marketing require forms that meet both standards — a single general media release almost certainly doesn’t.

Is website chat HIPAA compliant? Standard website chat platforms (Intercom, Drift, Zendesk, etc.) are not built for HIPAA compliance and most will not sign BAAs. If your chat platform captures conversations with individuals seeking addiction treatment, those conversations can constitute PHI. Using a non-HIPAA-compliant chat platform for patient inquiries is a potential HIPAA violation. HIPAA-compliant chat solutions exist — the requirement is selecting one, not avoiding chat.

We want to share patient success stories. What do we need? At minimum: a written consent that meets 42 CFR Part 2 requirements (if your program is subject to it, which it likely is), compliance with FTC Endorsement Guide requirements including disclosure of whether the result is typical, and care in how the testimonial is presented so it doesn’t create a false impression about typical outcomes. Have legal counsel review your consent forms and testimonial program before going live.

---

Ready to assess where your current marketing program stands?

---

---