Most ABA practices believe their marketing is HIPAA-compliant. Most of them are wrong.
This isn’t a criticism. HIPAA compliance in digital marketing is genuinely complex, and the practices that get it wrong are usually not cutting corners deliberately. They’re using standard marketing tools built for general businesses, deployed by agencies that haven’t built ABA-specific or healthcare-specific expertise.
The consequences of getting it wrong range from internal exposure (the violation exists but hasn’t been identified) to external enforcement. OCR (the Office for Civil Rights at HHS) has been increasingly active in healthcare marketing enforcement, with specific attention to digital advertising practices since 2022. Penalties for violations range from $100 per incident for unknowing violations to $50,000 per incident for wilful neglect.
Here are the five violations we see most consistently when we conduct ABA marketing compliance reviews.
Violation 1: Standard Facebook Pixel Installation on Health-Condition Pages
This is the most common and the most serious.
When the Facebook Pixel fires on a page visit, it transmits data to Meta that includes the URL of the page visited. If the page is /aba-therapy-for-autism-in-boston/ or /does-insurance-cover-autism-therapy/, the URL itself discloses a health condition. When that URL is transmitted to Meta alongside the user’s cookie identity (which Meta connects to their Facebook account), it may constitute the transmission of PHI without authorisation.
OCR’s December 2022 guidance on tracking technology specifically addressed this issue. The guidance wasn’t a new rule. It was an interpretation of existing HIPAA requirements. But it made explicit what many practices hadn’t considered.
The fix requires server-side tagging configurations that prevent health-condition URL data from flowing to Meta’s systems, combined with specific Pixel event configurations that exclude health-related parameters. This is a technical fix, not a conceptual one, but it requires someone who knows ABA and HIPAA to implement it correctly.
Violation 2: Using a Non-BAA’d CRM for Intake Data
When a parent submits an ABA intake form (providing their child’s name, diagnosis, insurance information, and contact details) that data is PHI. It identifies an individual in connection with their health condition.
If that data flows into a CRM that hasn’t signed a Business Associate Agreement with the practice, the practice is transmitting PHI to a third-party HIPAA Business Associate without the required contractual protections.
HubSpot, Salesforce, Zoho, Pipedrive, and most standard CRM tools aren’t HIPAA Business Associates by default. Some offer BAA provisions at higher pricing tiers. Most standard plans don’t. If a practice is using any of these tools at the standard tier to store ABA intake data, it’s likely in violation.
Our Lead Center includes a signed BAA as a standard component of every client engagement. We don’t store or process client intake data without this protection in place.
Violation 3: Standard Google Ads Conversion Tracking on Intake Forms
When a prospective client submits an intake form and Google’s standard conversion tracking fires, the conversion event data transmitted to Google can include form field contents and the URL of the page where the conversion occurred.
Form fields in ABA intake forms typically include: parent name, child name, date of birth, diagnosis, insurance carrier, insurance ID number, and presenting concerns. All of this is PHI. Google’s standard conversion tracking tag transmits it to Google’s advertising systems without any healthcare-specific safeguarding.
The fix is a server-side tagging setup that captures conversion events without transmitting form field data, or a minimised client-side configuration that excludes health-related parameters. Most Google Ads agencies don’t implement this because most of their clients aren’t healthcare providers.
Violation 4: Healthcare Email Follow-Up Through Standard Email Platforms
Following up with ABA enquiries through standard email platforms (Gmail, Mailchimp without a BAA, Constant Contact without a BAA) while referencing health information in the email content creates exposure.
The email doesn’t need to include a diagnosis to be problematic. An email that references “your child’s ABA therapy enquiry” or “the assessment you scheduled for your son” contains information that connects a named individual to a health service. Transmitted through a non-BAA’d platform, this is PHI in an unsecured environment.
The fix: use email marketing and follow-up platforms that offer a BAA, or ensure email content is sufficiently generic that it doesn’t create a health information connection.
Violation 5: Call Recording Without Proper Safeguards
Many ABA practices record intake calls for quality assurance. Intake call recordings contain substantial PHI: the child’s diagnosis, insurance information, treatment history, and personal information.
Recording software that stores these recordings in a non-HIPAA environment (basic call recording through a standard phone system, recordings stored in Dropbox or Google Drive without HIPAA configurations) creates PHI in an unsecured location.
The fix: use phone systems and recording platforms with HIPAA-compliant storage and BAA provisions, and implement access controls so recordings are available only to appropriate staff.
What to Do If You Suspect Non-Compliance
The first step is an honest audit of every platform in your marketing stack that handles patient or prospective patient data. For each platform, two questions:
- Does this platform handle data that could constitute PHI (names, health conditions, insurance, diagnoses)?
- Has this platform signed a Business Associate Agreement with our practice?
If the answer to question 1 is yes and question 2 is no, that’s a potential violation that needs to be remediated.
We offer compliance reviews as part of every client onboarding. For practices that aren’t yet clients, a compliance conversation is available as part of the initial strategy call.
The goal isn’t to scare ABA practices away from digital marketing. Digital marketing done compliantly is highly effective and a core component of growing a practice. The goal is to make sure the marketing that’s working doesn’t also create legal exposure.
Reputation Elevation builds HIPAA-compliant marketing systems for ABA practices. Every client programme includes HIPAA-reviewed ad tracking, Lead Center under BAA, and compliant data handling throughout. Schedule a strategy call.