PracticeCare HIPAA marketing assessment vFF

Is Your Marketing HIPAA Compliant?

This assessment is designed to give you an idea if you have issues with HIPAA compliance in your digital marketing. It focuses on the areas of digital marketing where HIPAA and marketing may overlap. It's based on our experience achieving and maintaining HIPAA compliance according to current standards, and in setting up HIPAA compliant relationships with our clients and subcontractors. We are not lawyers. This is not legal advice nor is it comprehensive.

PracticeCare® HIPAA Digital Marketing Assessment

Name(Required)

First Last

Email(Required)

Company Name(Required)

Services You May Use In Your Marketing

For each service, check the answer that best describes your practice.

PHI = Protected Health Information. PHI can be as small as a patient's name plus either an email address or a cell phone number.

BAA = Business Associate Agreement.

Website Maintenance

Who maintains your website?(Required)

Maintenance means making minor updates, fixing errors, etc.

Do you have a signed BAA with your website maintenance company?(Required)

Yes

I don't know

Website Forms

For this question, please include any form that is directly on your website, for example, a "contact" form on your contact page.

Do you have any forms on your website, for example, a contact form?(Required)

Yes

Do you have a signed BAA with the service you're using to create the form(s)?(Required)

Yes

I don't know

Email Marketing

Email marketing most often refers to emails you send out, in bulk, to your patients. Some examples are a monthly newsletter, announcements of new products or services you offer, special events you host, and wishing patients happy birthday.

Do you do email marketing, for example, send out a newsletter or wish patients happy birthday?(Required)

Yes, we subscribe to a third party service (ex: Constant Contact) and outsource managing the service to another agency or service

Yes, we subscribe to a third party service but manage the service ourselves in-house

No, we don't do this at all

Do you have a signed BAA with your email marketing third party service?(Required)

Yes

I don't know

Are your in-house staff trained on HIPAA compliance requirements for email marketing?(Required)

Yes

I don't know

Do you have a signed BAA with the outsourced agency or service for email marketing?(Required)

Yes

I don't know

Getting Reviews from Patients Online

Do you ask your patients to give you a review?(Required)

Yes, we subscribe to a third party service and outsource managing the service to another agency or service

Yes, we subscribe to a third party service but manage the service ourselves in house

Yes, we do everything in house, without any third party service

No, we don't ask patients to give us a review

Do you have a signed BAA with the third party service you use for patient reviews?(Required)

Yes

I don't know

Are your in-house staff trained on HIPAA compliance requirements for patient reviews?(Required)

Yes

I don't know

Do you have a signed BAA with the outsourced agency or service you use for patient reviews?(Required)

Yes

I don't know

Do you respond to reviews online?(Required)

Yes, even if sometimes

Social Media

For these questions please include social media accounts like Facebook, Instagram, X, TikTok, and any other social media platform.

For these questions, include your organic activity only - words, pictures, videos, replies to any posts, if you share posts, like posts, or repost posts. Exclude any advertising you may do on social media.

Do you post on social media?(Required)

Yes, and we outsource it to another agency or service

Yes, we subscribe to a third party service but do all of the posting ourselves in house

Yes, we do it all ourselves in house, without any third party service

No, we never post on social media at all

When posting, replying to posts, sharing, or engaging with a social media post in any way, do you ever share PHI?(Required)

Yes

I don't know

Are your in-house staff trained on HIPAA compliance requirements for social media?(Required)

Yes

I don't know

Do you have a signed BAA with the social media platform(s) you post on?(Required)

Yes

I don't know

Do you have a signed BAA with the third party service you use for social media?(Required)

Yes

I don't know

Do you have a signed BAA with the outsourced agency or service for social media?(Required)

Yes

I don't know

Paid Ads Online

For these questions please include social media accounts like Google, Facebook, Instagram, X, TikTok, and any other social media platform.

Do you run paid ads online?(Required)

Yes, and we outsource it to another agency or service

Yes, but we do all of it ourselves in house

No, we do not run paid ads online

Do you retarget your paid ads online?(Required)

Yes

I don't know

For your retargeting ads, do you make sure your ads are too broad to disclose any PHI?(Required)

Yes

I don't know

Are your in-house staff trained on HIPAA compliance requirements for paid ads online?(Required)

Yes

I don't know

Do you have a signed BAA with each ads platform (ex: Google, Facebook, etc)?(Required)

Yes

I don't know

Do you have a signed BAA with your outsourced agency or service you use for paid ads online?(Required)

Yes

I don't know

________________________________________________________________________________________

Would you like to talk with MarketVisory Group about your practice's marketing?(Required)

Yes

Not now, but please contact me in a few months

About MarketVisory Group

MarketVisory Group is a healthcare marketing agency. We’re devoted to helping private practice owners stay private. That’s what you want, and we firmly believe that care is better when it’s just you and your patient in the relationship – no hospital, health system, or far away owners whispering in your ear what their needs are.

We are fully compliant with the HIPAA Standards for Privacy, Electronic Transactions and Security (including the HITECH Act and the Omnibus Rule of 2013). We have implemented policies, processes, and procedures designed to ensure compliance with Federal security laws, regulations, and rules, and we monitor ongoing compliance efforts and maintain various reporting mechanisms that are required by law or requested by our customers. We recognize that it is a key responsibility for our business and will continue to provide all of our various programs and services in accordance with the relevant requirements of all federal laws and regulations, including, as applicable, HIPAA.

________________________________________________________________________________________

About Your Answers

Sharing PHI with third parties in marketing is more common than you might think. Even a name combined with an email address or a cell phone number counts as PHI. Please be careful!

To be HIPAA compliant you need a BAA in place with each service provider (ie: agency, software tool, service, etc) with whom you will share PHI.

We hope this survey helped you!

CAPTCHA