AI adds new data flows to healthcare marketing. A single campaign may move information through tracking tools, a CRM, an email platform, and an AI service. Organizations need to understand what each tool receives, how it uses that information, and whether those uses and disclosures are permitted.
Why AI Raises the Stakes for HIPAA-Compliant Marketing
AI does not remove HIPAA’s requirements for permitted uses, disclosures, and safeguards. It can increase the amount of health information a marketing tool handles and introduce new uses that teams need to review. Below, we explain the marketing rules and how to evaluate AI vendors before sharing PHI.
The Marketing Rule Still Sets the Bar
Under HIPAA, marketing is a message that encourages someone to buy or use a product or service. Using protected health information (PHI) for that purpose usually requires written authorization. The HIPAA marketing rule excludes certain communications about treatment, care coordination, and a covered entity’s own health-related products or services from its definition of marketing, subject to specific conditions. Payment from a third party whose product or service is being promoted can trigger the marketing authorization requirement. An ordinary email opt-in does not, by itself, satisfy the requirements for a HIPAA authorization.
Evaluate AI Vendors Before Sharing PHI
A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate generally qualifies as a business associate. This can apply even when the vendor stores only encrypted PHI and cannot view it. HHS states this plainly in its cloud computing guidance, and the same logic applies to AI platforms. A common misstep is pasting intake notes into a chatbot to draft a follow-up email. That step can be an impermissible disclosure if the tool and intended use have not been approved. Before sharing PHI, confirm that the use and disclosure are permitted, execute a business associate agreement (BAA) where required, and assess appropriate safeguards. Check that the agreement covers the specific AI feature, and review data retention, model-training uses, and downstream providers.
What Regulators and Courts Changed Since 2022
The past few years brought real movement, though not always in the direction headlines suggested. Federal tracking guidance got narrower, while other regulators stepped in to cover data HIPAA does not reach. The sections below explain both shifts.
Tracking Guidance Narrowed but Still Applies
OCR’s 2022 bulletin on online tracking technologies warned that pixels could send PHI to ad platforms. In June 2024, a federal court vacated the portion of OCR’s guidance that treated connecting an IP address with a visit to an unauthenticated page about a health condition or provider as sufficient, by itself, to trigger HIPAA obligations. Tracking can still disclose PHI, including through patient portals, login forms, scheduling forms, and symptom checkers. The analysis depends on the information collected and shared. We cover the details in our website tracking guide.
The FTC and the States Filled the Gaps
Many health apps, wellness brands, and digital health companies fall outside HIPAA, but they are far from unregulated. In September 2026, the FTC withdrew its 2021 policy statement on health apps and connected devices, saying the 2024 amendments to the Health Breach Notification Rule made it unnecessary. In a separate FTC Act case, the agency ordered BetterHelp to pay $7.8 million over health data shared for advertising. Meanwhile, Washington’s My Health My Data Act generally requires consent to collect consumer health data and separate consent to share it, subject to statutory exceptions, including processing necessary to provide a consumer-requested product or service. Sales require a separate valid authorization. The law applies to covered activities and can be enforced through private actions under Washington’s Consumer Protection Act.
Where AI Creates New Risk in Healthcare Marketing
Most AI risk grows out of small, routine choices that nobody flagged as data decisions. Those choices usually sit inside email, automation, and lead management. We look at email first, then at the health data AI can create on its own.
Email and Marketing Automation
When an email or automation platform handles PHI on behalf of a covered entity or business associate, a BAA is only one part of compliance. The organization must also confirm that the campaign’s use and disclosure of PHI are permitted and that appropriate safeguards are in place. AI features can build segments, write subject lines, and time sends based on contact behavior. If a HIPAA-regulated organization holds identifiable appointment history or condition-specific intake data, that data can be PHI, so review these features before enabling them. Subject lines also deserve review, because one that names a condition can reveal health details in a shared inbox.
Inferred Data and AI Chat
AI is very good at guessing. A lead scoring model can infer a condition from page visits, and a chatbot can collect symptoms in plain conversation. Washington’s attorney general says inferences about health status can count as consumer health data, so a guess can carry legal weight. Before you turn on an AI feature, check these common sources of health data:
- Chatbots that ask why a visitor needs care
- Lead scoring models that weigh condition-specific page visits
- AI writing tools where staff paste notes or form data
- Retargeting audiences built from contact or appointment lists
- Call tracking tools that transcribe what callers say
How to Build a Compliant AI Marketing Program
The organizations that handle this well build compliance into campaign design from the first brief. That approach can help teams identify privacy risks earlier and reduce avoidable changes late in review. Below is the process we recommend, plus what to ask of any agency partner.
Map the Data Before You Add the Tool
The proposed Security Rule update, announced in December 2024, would strengthen the rule and make certain requirements more specific. The current rule already requires risk analysis, documented policies and procedures, and periodic evaluation. The proposal is not final, and the current rule remains in effect. Organizations should meet existing obligations while monitoring the proposal. Here is the process we recommend:
- List every tool that touches contact or health data, including AI features in platforms you already own.
- Trace what each tool collects, where it sends that data, and who can see it.
- Confirm that each use and disclosure of PHI is permitted, obtain any required authorization, and execute BAAs with vendors that qualify as business associates before sharing PHI.
- Set clear rules for what staff can put into AI tools.
- Review the map when tools or data practices change. We also recommend a quarterly review to check for new features and data flows.
What to Ask a HIPAA-Compliant Marketing Agency
Your agency sees more of your data flows than most partners, so hold it to the same standard as your software vendors. Ask whether it signs BAAs when its work involves PHI and how it chooses which AI tools its team may use. Levo Health undergoes annual independent SOC 2 audits as part of its information security program, and our technology integration services are built around compliant data flows. Clear answers can help you assess how an agency manages privacy risks and supports your organization’s compliance responsibilities.
Mapping data flows and reviewing tools before launch can help organizations identify privacy risks earlier and make more informed decisions about AI adoption. Combine that work with permitted data uses, appropriate agreements and authorizations, safeguards, and ongoing review.
Rolling out AI tools in your marketing this year? Levo Health can trace how health data moves through your current stack and identify where a BAA, HIPAA authorization, or other consent may be required. Request a data flow review before your next campaign launches.
