BAAs & vendors
Identify each party handling protected health information and confirm the applicable business associate agreements and required account settings before patient workflows go live.
Healthcare marketing & HIPAA
Patient privacy belongs in the plan.
The questions to resolve about patient information, BAAs, forms, AI, communications and tracking before a healthcare marketing workflow goes live.
Review every handoffPrivacy by design
Plan the safeguards around each specific workflow.
Start with the workflow
A vendor label is not the whole plan.
Healthcare marketing can touch sensitive information at several points. The right setup depends on the practice, the information involved and the services in scope.
Review before patient workflows go live.
Required agreements, vendor coverage, account configuration and practice approvals must be confirmed before a workflow handles patient information. This page explains our review approach; it is not a certification or a statement that every proposed integration is already configured.
Forms & patient information
Separate public marketing from approved patient intake. Collect only what the workflow needs and document where each field is sent and retained.
SMS & email
Review permissions, message content, opt-outs and channel suitability. A delivery channel or consent checkbox alone does not establish HIPAA compliance.
AI & staff escalation
Define approved administrative use, vendor coverage, access and retention. Clinical questions need an appropriate practice-team handoff.
Calls & recordings
Decide whether recording is needed, review applicable notice and consent requirements, and define access, retention and deletion before enabling it.
Analytics & ad tracking
Review Google, Meta and other tags by page and event. Keep patient details, form answers and sensitive URLs out of advertising events; review patient-facing flows before tracking is enabled.
CRM permissions
Limit access to the people and tasks that need it. Review authentication, offboarding, audit capability and who can export information.
Incident & exit planning
Document who investigates suspected exposure, how vendors and the practice coordinate, and how information is retained, returned or removed at the end of service.
This website
For practice business inquiries.
The Practice Catalyst contact form and scorecard are for practice owners and teams evaluating marketing services. Please do not submit patient names, records or health information through them. Patient intake for a client practice requires its own reviewed workflow.
Read our website privacy policyFurther reading
Review the underlying requirements.
Your privacy officer or legal adviser should review the specific arrangement. Useful starting points include HHS guidance on business associate contracts and HighLevel’s HIPAA setup guidance.
Find out where your practice is losing patients.
Free, about three minutes, and you'll see your results right away.
Get my free scorecard