Marketing in healthcare is supposed to be different. HIPAA. State medical board rules. Patient privacy. The standard advice: "Be careful, everything is different in healthcare."
Most of this advice is too general to be useful. Some healthcare marketing problems are real regulatory issues. Most aren't. They're cultural issues that get blamed on regulation.
What HIPAA actually restricts
The actual rule is narrower than most teams realize. HIPAA restricts the use of protected health information in marketing without explicit patient authorization. That's mostly about specific patient data — diagnoses, treatments, identifiable health details.
What HIPAA does not restrict:
- General educational content about conditions
- Marketing your services and capabilities
- Posting photos of patients who have signed releases
- Sharing testimonials from patients who have signed releases
- Discussing the kinds of cases you handle in general terms
Most of what healthcare brands won't do isn't legally restricted. It's culturally restricted by an organization that's been told for years to be conservative about anything patient-facing.
The state board layer
State medical, dental, and veterinary boards have their own advertising rules. These vary wildly. Some states prohibit specific phrasing ("best," "guaranteed"). Some require disclaimers on testimonials. Some restrict before-and-after photos in specific ways.
These rules are real and worth following, but they're also more localized than HIPAA. A national brand can run national content within HIPAA bounds and customize state-specific creative for the few states with strict rules. Most teams over-correct and apply the strictest state's rules to all 50.
The cultural restriction
The bigger constraint in healthcare marketing usually isn't regulation. It's the institutional risk aversion of the people who run healthcare organizations.
A typical sequence: marketing proposes a campaign. Legal raises a concern. Compliance escalates the concern. The campaign gets watered down to nothing. Marketing learns to propose smaller things next time. Over years, the marketing team stops proposing anything interesting.
This isn't HIPAA. It's risk-averse culture making decisions that look like HIPAA decisions.
What actually works
Three patterns from running healthcare marketing programs across dental, veterinary, and multi-location practice networks:
Build a "yes" pattern with legal. Don't bring legal one campaign at a time. Bring them a framework once — what kinds of content are okay, what triggers a review, what releases are needed. Then operate inside that framework. The friction drops dramatically.
Get release forms in the patient intake process. Not at the moment you want to use a photo or testimonial. Months earlier, as part of normal onboarding. The opt-in rate is higher and the legal posture is cleaner.
Differentiate by the experience, not the diagnoses. Healthcare marketing fails when it tries to be specific about what conditions you treat. It works when it's specific about how it feels to be a patient there. The first runs into regulation. The second doesn't.
The point
Healthcare marketing isn't more restricted than other regulated industries — it's just more often described as restricted. Most of what looks like a regulatory wall is actually a cultural wall.
Knowing the difference is what separates healthcare marketing teams that do interesting work from teams that don't.