HIPAA
HIPAA and patient privacy
Treatment centers are covered by HIPAA, so their marketing has to be built with patient privacy in mind. Here’s how we handle patient information, and how to get a business associate agreement from us.
Our HIPAA statement
How we treat patient information
Spravato Marketing Services is a marketing agency, not a healthcare provider. When a clinic hires us and our work involves protected health information (PHI), such as call recordings or form submissions from patients, we act as that clinic’s business associate under HIPAA.
That means we use PHI only to do the work the clinic has hired us to do, we limit it to the people who need it, and we follow the terms of our business associate agreement.
Most marketing doesn’t need PHI at all, so we build it that way from the start. Information that never enters a marketing system can’t leak from one.
Business associate agreements
We sign BAAs
We offer a business associate agreement (BAA) to every clinic we work with, and we sign it before any work that could involve PHI begins. If your organization has its own form, send it over and we’ll review it. If you don’t, we’ll send you ours.
To ask for one, contact us and mention it in your message.
In practice
Keeping patient information out of marketing
- Ad platform pixels stay off pages and forms where people share health details.
- Call tracking and forms are set up so patient information doesn’t flow to ad platforms.
- Reports show totals, such as calls, consults and starts. They don’t need patient names.
- Review replies stay general and never confirm that someone is a patient.
- We don’t use patient stories or photos without the patient’s written authorization.
One request: please don’t send us PHI through this website’s forms or by regular email. They aren’t set up for it, and we’ll arrange a safer way if it’s ever needed.
You can read more in our guide to website tracking and HIPAA. This page describes how we work. It isn’t legal advice, and your own compliance counsel has the final word.
Questions
About HIPAA and BAAs
Will you sign a business associate agreement?
Yes. We offer a BAA to every clinic we work with, and we sign it before any work that could involve patient information begins. If you have your own form, send it over and we’ll review it.
Is a marketing agency a business associate?
It can be. If an agency creates, receives, keeps or sends protected health information on behalf of a clinic, it’s a business associate under HIPAA and needs a BAA. Call recordings and form submissions are common examples.
Do you need access to patient records?
No. We don’t need your medical records, your EHR or anything from the REMS portal to run your marketing. We measure results with counts, such as calls, consults and starts.
Are you HIPAA certified?
There’s no official HIPAA certification, so we don’t claim one. What we can do is sign a BAA, follow it and show you how your marketing is set up.
Free audit
Get a free Spravato marketing audit
Tell us about your program. We’ll look at how patients find you, what your site tells them, and where calls are likely slipping away, then send a plain list of what we’d fix first.
- Where you show up for “spravato treatment near me” in your market
- What your site says about cost, coverage, the two-hour visit and the ride home
- How leads are tracked after the click, and what a caller hears next
118 Broadway St, Ste 625
San Antonio, TX 78205