HIPAA Training for Hospital Marketing and Communications Staff

Hospital marketing and communications staff may handle protected health information (PHI) when they create patient stories, photograph events, respond to social media, or coordinate publicity. Training helps you recognize when information is protected, obtain the right permissions, and follow your hospital’s policies before sharing anything publicly.

What HIPAA rules apply to hospital marketing and communications staff?

A hospital that meets HIPAA’s definition of a covered entity must follow the HIPAA Privacy Rule when using or disclosing PHI. PHI generally includes individually identifiable information related to a person’s health, health care, or payment for health care that the hospital holds or transmits. It can appear in photographs, video, audio, written stories, social media content, and other formats—not just medical records. Learn more in HHS guidance on PHI and de-identification.

Marketing staff are part of the hospital workforce when they handle PHI as part of their work. They must follow the hospital’s privacy policies and procedures, including rules for accessing, using, disclosing, and safeguarding patient information. A communication’s purpose and content matter: calling a post “public relations” or “patient education” does not by itself make a use of PHI permissible.

HIPAA’s definition of marketing focuses on communications that encourage recipients to purchase or use a product or service, along with certain paid communications made on behalf of another entity. Some communications about the hospital’s own health-related services are excluded from that definition, but staff must still comply with other Privacy Rule requirements. See HHS guidance on HIPAA marketing and the regulatory definition of marketing.

Follow the hospital’s social media privacy policy and escalation process. If you are unsure whether a proposed story, image, or reply contains PHI or has the necessary permission, pause publication and ask the privacy officer or another designated reviewer.

When is written patient authorization required for marketing?

As a general rule, a covered entity must obtain a valid written HIPAA marketing authorization before using or disclosing PHI for a communication that meets HIPAA’s definition of marketing. The rule provides exceptions, including certain face-to-face communications and promotional gifts of nominal value. The federal requirements are set out in 45 CFR § 164.508.

The Privacy Rule excludes certain communications about the covered entity’s own health-related products or services from the definition of marketing. It also excludes certain treatment-related communications, such as recommendations that further a patient’s care. That classification does not automatically allow staff to disclose a patient’s PHI for publicity; the hospital must still have a permitted basis for the specific use or disclosure.

A valid authorization must describe the information to be used or disclosed, identify who may use or disclose it and who may receive it, state the purpose, and include an expiration date or event, among other requirements. If the marketing involves financial remuneration from a third party to the covered entity, the authorization must say so. Except as allowed by law, a hospital generally cannot condition treatment on a patient signing an authorization for a separate use or disclosure of PHI.

Use the hospital’s approved HIPAA marketing authorization and confirm that it covers the actual content, channels, audience, and intended use. A general photo release or a patient’s informal agreement may not satisfy HIPAA’s authorization requirements. HHS explains the authorization rule and marketing exceptions.

How should staff handle patient stories, photos, and videos?

Treat a patient story, image, or video as potentially containing PHI if it identifies someone and relates to their health, care, or payment for care. A name, diagnosis, treatment detail, hospital location, distinctive circumstances, voice, or recognizable image may identify a patient directly or in combination with other details. Full-face photographs and comparable images are identifiers under HIPAA’s Safe Harbor method for de-identification; removing a name alone does not establish that information is de-identified. See HHS de-identification guidance.

Before collecting or publishing a patient testimonial, photo, or video, check with the hospital’s privacy office and obtain the required HIPAA authorization when PHI will be used or disclosed in a way that is not otherwise permitted. The authorization should cover the specific material and intended use. Do not assume that a patient’s willingness to be interviewed, a signed general media release, or the absence of clinical details is enough.

Plan photography and filming to prevent unauthorized exposure of other patients’ PHI. That can include securing the necessary authorizations in advance, keeping recording crews away from treatment areas where unauthorized PHI may be visible or audible, and checking the final materials for names, screens, wristbands, voices, room details, or other identifying information. HHS states that blurring a patient’s identity after filming does not replace authorization when media has already had access to PHI. See HHS guidance on film crews and patient privacy.

Consent to participate should be voluntary and handled in accordance with hospital policy. Staff should not promise that a public story can be removed from every channel after publication, and should route questions about scope, expiration, or withdrawal of authorization to the appropriate privacy contact.

What HIPAA rules apply to hospital social media posts?

HIPAA’s privacy protections apply to PHI shared on social media just as they apply to PHI shared through other channels. Do not post or confirm a patient’s identity, care, diagnosis, appointment, location, or experience without an appropriate legal basis and any required authorization. A seemingly anonymous post can still identify someone through its details, timing, image, or surrounding context.

Do not respond to a comment or review in a way that confirms the commenter is a patient or reveals information about their care. Even a well-intentioned reply—such as thanking someone for being a patient or discussing a specific visit—could disclose PHI. Direct the interaction to an approved private contact method without confirming the person’s relationship with the hospital.

Before posting event photos, videos, or patient stories, verify that permissions cover the content and intended online use, and check for other patients or PHI in the background or audio. Do not rely on tags, account settings, or a patient’s own public post as permission for the hospital to disclose information from its records.

A hospital social media privacy policy can set practical review steps, account-access controls, moderation rules, and escalation procedures. These are organizational safeguards and training practices; the policy should not be presented as a separate HIPAA rule. If a post may have disclosed PHI improperly, report it promptly through the hospital’s established process.

Which hospital communications are excluded from HIPAA’s definition of marketing?

HIPAA excludes certain communications from its definition of marketing. For example, a covered entity may describe its own health-related products or services, such as a new specialty service or equipment, without that communication being classified as marketing under the Privacy Rule. Some communications about treatment, care management, or alternative treatments are also not marketing. HHS summarizes these distinctions in its marketing guidance.

Some marketing communications also fall within specific authorization exceptions, such as a face-to-face communication made by the covered entity to an individual or a promotional gift of nominal value. Those exceptions are limited; they do not create blanket permission to use patient stories, images, or other PHI in public campaigns.

For each communication, distinguish two questions: whether it meets HIPAA’s definition of marketing and whether the hospital may use or disclose the PHI involved. A communication that is not “marketing” may still require an authorization or another permitted basis before identifiable patient information can be shared. When the answer is unclear, consult the hospital’s privacy officer before proceeding.

What should HIPAA training cover for marketing and communications staff?

Training should explain how to recognize PHI in text, images, audio, video, and online interactions; how to apply the hospital’s privacy policies; and when to obtain review or authorization before using patient information. It should use realistic examples, such as a patient testimonial, a photo with a visible wristband, a filming request in a treatment area, or a reply to a social media comment.

Include the hospital’s procedures for patient image authorization, reviewing stories and promotional materials, protecting information during interviews and filming, managing social media accounts, and reporting a suspected privacy incident. Staff should know whom to contact when authorization is missing, unclear, or outside the proposed use.

HIPAA requires covered entities to train workforce members on relevant privacy policies and procedures as appropriate to their roles, provide training to new workforce members within a reasonable period, train affected staff after material policy changes, and document that training was provided. The regulation does not establish a universal annual training schedule. Hospitals may set their own recurring training requirements under employer-specific policy. See 45 CFR § 164.530.

Training completion records show that training was provided; they do not, by themselves, certify that an individual or hospital is HIPAA compliant. Staff must also follow employer-specific policies and ask for guidance when a proposed use of PHI is uncertain.

In practice, safe hospital communications depend on recognizing PHI, distinguishing marketing classification from permission to disclose, obtaining appropriate authorization, and following the hospital’s review and social media procedures.

FAQs

Can a hospital use a patient photo in promotional materials without written authorization?

Often, the hospital should obtain a valid HIPAA authorization before using an identifiable patient photo in promotional materials if the image relates to the patient’s care or otherwise contains PHI and no other permission applies. A photo’s lack of clinical details does not automatically resolve the issue. Ask the privacy office to assess the image, context, and proposed use. HHS lists full-face photographs and comparable images among identifiers under the Safe Harbor de-identification method.

Can staff share patient stories on hospital social media?

Staff should share an identifiable patient story only when the hospital has an appropriate legal basis and any required HIPAA authorization covering the story and its social media use. Follow the hospital’s review process and avoid confirming a person’s patient status in comments or replies.

Does HIPAA apply to photos that do not include clinical details?

It can. A photo may still identify someone and, in context, relate to their health or the fact that they received care. Conversely, an image that is not individually identifiable health information may fall outside HIPAA’s PHI protections. Consider the image together with captions, location, background details, and other information that could identify the person.

Are all communications about a hospital’s services considered marketing?

No. HIPAA excludes certain communications about a covered entity’s own health-related products and services, as well as some treatment-related communications, from its definition of marketing. However, that classification does not by itself authorize the hospital to disclose identifiable patient information. Review both the communication’s purpose and the PHI involved.