Whether HIPAA applies depends on whether your agency is a covered entity, for example if it bills Medicaid or other health plans electronically, or is a business associate of one. Even when it does not apply, families expect their information to be handled carefully, and state privacy laws may apply.
Our approach: inquiry forms ask only for contact details and general service needs, never diagnoses or medical history. We do not send health information to Google, Meta or analytics tools, we avoid remarketing based on health conditions, and we use vendors willing to sign a Business Associate Agreement (BAA) wherever protected health information is involved. In 2022 the US Department of Health and Human Services issued guidance on online tracking technologies; a federal court vacated part of it in 2024, but tracking on authenticated pages and appointment flows remains high-risk. We are a marketing agency, not a law firm, so please confirm your obligations with your compliance advisor.