Contact Us Now

Magnet attracting people traffic on wooden background, top view with space for text. Marketing conceptMarketing A Private Medical Practice.

While in school, business and marketing was not a focal point of coursework.  Unfortunately for you, that means you have to learn about business from the school of hard knocks.

Just because you opened your medical practice doesn’t mean your calendar will be overflowing with new patients.  You need a game plan to help you grow regardless of how big or small your practice is.

If you are here you need help.

From our experience from successfully marketing practices,

We compiled our list of the 30 best marketing tactics for private practices to help you build and grow a healthy sustainable practice.

While helping you remain HIPAA Compliant in your marketing efforts.

First you may be asking,

How do I market myself as a doctor?

As a doctor, you need to remember that you are an advocate for your patients and must be sure to make this clear to them from the start. This should be your main message. Making sure your patient base understands who you are and what your values are is an important part of marketing yourself as a doctor they can turn to in times of need. Which can lead to more patient referrals.

30 of the best marketing strategies for medical practices

Build a website

When a patient wants to learn more about you, the first thing they are likely to do is head to good ol’ Google. Give them something meaningful to look at when they find you; invest in a site that is professional, aesthetically pleasing, and easy to navigate.


Gathering testimonials from current or past patients that highlight their positive experiences with your private medical practice is one of the best ways to build a trustworthy reputation. Studies have shown that half of patients think it is important for their doctor to be well liked by others, and 77% ranked trustworthiness as the most important trait their doctor needs to have.

Best of all, collecting testimonials is a relatively straightforward process. Keep up your excellent care and bedside manner. Then ask your patients to review your medical practice and attest to your high level of care.

However, always maintain HIPAA compliance.  Only use testimonials or reviews with the patient’s expressed SIGNED consent.  Don’t assume that if you get a review online you can respond any way you want or post it on another site, never reveal any personal identifiable information.

Social media presence

Social media is the ultimate modern marketing tool. Billions of users flood social media platforms daily for information, entertainment, and so much more. So, how can you take advantage of it? Create social media accounts on major platforms such as Twitter, Facebook, and Instagram, of course.

Before establishing your presence on any of these sites, however, it is important to research what platforms you are most likely to find your patients on. For example, Facebook is the go-to social media platform for many older people. If you see mostly adults who are 60 or older, then, it only makes sense to work hard to establish yourself on Facebook above any other platform.  Here is a helpful breakdown of social platforms by age group as well as income levels.

Give back to the community

As a doctor, you are a valued member of your community. Your private medical practice is also part of that community. Therefore, taking the time to invest in your community shows others that you are not just in it for the money but you genuinely want to help people. Examples of community outreach include attending charity events or volunteering medical supplies or services several times a year.

These are not only excellent ways to show the community that you care but also a great opportunity to make your practice locally known.

Use SEO best practices

SEO stands for search engine optimization. Using SEO best practices ensures that your website ranks high when prospective patients search for you. Good SEO strategy takes into account quality content, word choice, and local listings. You can hire an SEO company to help you with this or read up on these best practices yourself here.

Claim local listings

Local listings display information about your practice like address, website, and contact number. All of this information makes it easier for patients to find you. Make sure to claim and verify these so that search engines can easily pull up your information. Search engines like Google are such an integral part of our everyday life—it would be a detriment not to effectively utilize this form of advertising!


Blogging is a great tool for connecting with your audience and building your reputation. Information shared on your medical practice’s blog not only helps you build credibility as a doctor but also gives your patients insight into your business. Offer health tips, post information on health conditions, or touch on other topics your readers would be interested in.

When used correctly it can support your SEO strategy.

Update regularly

After establishing a website, it can be easy to think that your work has been done. However, it is not quite that simple. Make sure that you are taking the time to update your website on a regular basis.

You do not want patients or potential patients coming across a site with outdated information or old technological functionality. These issues can create distrust or frustration among your patients or leave you open to a hack.

Engage your audience

Show your patients that you care by actively engaging with them. Utilize social media platforms to share information and keep in touch with your patients. Also make sure you are replying to all comments or messages, not just the positive ones. This shows that your practice’s first concern is ensuring patients are taken care of and that their concerns are not being ignored.

Important to note that when replying to comments that are available publicly do not include any personally identifying information.  It is best to direct feedback related comments or questions to a pre approved list of canned HIPAA compliant responses that move those conversations offline or to a more secure environment.

Implement direct marketing techniques

Direct marketing strategies include sending out newsletters, birthday cards, “welcome to the family” greetings for new patients, and even friendly reminders for upcoming appointments. Patients want to feel valued and seen. Direct marketing can be impactful because it creates personalized experiences that make patients feel welcome and more than just another number in your records.

Offer tips

As a doctor, you have knowledge and experience that can benefit your entire community. Use your expertise to educate your community on staying healthy; hold seminars at local events to offer patients tips on a variety of health-related topics. You might even visit schools, nursing homes, and other institutions to educate others. In any case, showing your willingness to help others builds trust.

Ensure top quality care

The best way to win over your patients and ensure that they want to come back? Simply provide them with top-notch care. Maintain quality care, and the good reviews will follow. This method depends upon building a loyal patient base by promoting your practice via word-of-mouth. It may take time to pay off; however, if you are persistent and passionate about everything you do, it will be worth it.

Create a powerful brand

Branding plays a key role in marketing and is a dynamic way for patients to recognize you in the community. Make sure to create a cohesive logo, website, and practice “look” so that your practice is easily identifiable. Focus on creating a memorable experience for your patients. There are great resources on building and defining brands online that can help you with this.

Offer discounts

Make visiting your practice seem more enticing than ever. Discounts may come in the form of free screenings or referral discounts for patients who are introduced to your practice by a current patient. Moreover, discounts can give patients the opportunity to test out your care or explore new services.

Hold webinars

Like blogs, webinars are great for building trust and showing off your expertise. These online speaking events inform your patients on topics they may be interested in while also giving them a chance to engage back. Webinars usually incorporate question and answer sessions or discussions, which can help you connect with the community your medical practice serves.

Advertise openings

Let potential and current patients know that you have time in your schedule by emailing, posting online, or putting up signs that state that you are “Accepting New Patients”. This will signal to people that you want to prioritize them.


Personalize pens, notepads, magnets or other free items with your medical practice’s brand and contact information. Then, pass these out to your patients or at various events throughout the community. These little items keep your patients and strangers alike excited. After all, who doesn’t like receiving free things? Not to mention, even a little pen with your name and practice plastered on it is a great way to advertise yourself.

Build professional relationships

Become familiar with other professionals in the area and in your field. They can become critical supporters of your medical practice, and you can even help them build their client bases. They will do the same by referring patients to you.

Paid search campaigns

Paid search campaigns can easily drive your target audience to your social media and website while also targeting patients interested in your private practice’s specific services. Pay-per-click advertising buys you advertising space on search engine results pages–for example, Google, Bing, or Yahoo. The best part is that you only pay if your paid ad is clicked on and you can get in front of higher competitive searches your SEO and content marketing campaigns may have trouble ranking for in the search results when you are new.

Expand services

As your private medical practice continues to grow, consider adding additional staff and services to your practice. This not only attracts new business but creates more loyalty within your patient base, because they may visit your office for multiple services instead of just one. For example, if you are a pediatric orthodontist, you may team up with a general pediatric dentist to offer more services in one office.

Traditional advertising

While digital marketing has grown significantly in the last decade, you shouldn’t overlook the benefits of traditional marketing to attract new patients. In fact, traditional advertising strategies like TV ads are still the most effective based on indicators such as sales and new accounts. Reach out to local radio, newspapers, and TV stations for some of your practice marketing needs. Just remember to target advertising towards your desired audience.

Partner with journalists

Offer to be a medical reference for news articles relating to medicine. This is a great way to gain exposure while establishing your expertise in the medical world. Being cited in a news article as a medical source or as the health column expert helps you foster trust among your current/prospective patients.  While also improving your local SEO and reach.

Connect with your local chamber of commerce

A chamber of commerce is a business network that works to further the goals and interests of businesses. If you’re not sure where to start when it comes to community outreach, you can get in contact with your local chamber of commerce to get involved. This network can help you identify areas where you are needed and is also a great way to build relationships with other businesses in the area.

Host an open house

Open houses are a great way to welcome the community to your private practice and help you establish important relationships. Show off your facility and your services to the community by inviting the public to an open house. These events give potential patients a chance to meet your staff and see what your office looks like.

Attend health fairs

Health fairs help you build brand awareness and can help you advertise your services to people who may otherwise have been unaware about you or your practice. Use these events to give back to your community while also speaking to them about the services you offer.  They can also be an effective way to build professional relationships with other providers who can become a great source of referrals.

Publish in journals

Contribute to medical journals or publications to show your knowledge on particular topics. You can build your reputation and credibility by referencing studies and research that your doctors have participated in. These can help assure your patients of your expertise.  White papers also can help in a SEO strategy for building up your brand mentions and backlinks.

Mobile optimization

3.5 billion people in the world own smartphones. Tap into this market by making sure your website is mobile friendly. For example, you might make it so that your patients can call your office simply by tapping a button on your website.

Pamphlets and brochures

Create materials for distribution and information to hand out to your patients when they visit your office. Pamphlets and brochures not only teach a patient about your services and the values and mission of your medical practice, but they are also easy to pass along to others. In addition, you can hand these out at any events you attend.

Email marketing

Stay in touch with your patients and keep the lines of communication strong with email. Emails can include appointment reminders, links to your blog or newsletter, and updates on upcoming events or promotions your practice is holding. This strategy allows you to keep in touch with patients outside of regular office visits.

Don’t forget the patient release documentation to allow you to market to them.

Thank your patients

Let your new and long-time patients know that you appreciate them with handwritten letters. Personalized touches like this remind your patients that you care about their business and will help your practice stand out.

Bonus: Affordable ways to market

There are plenty of marketing ideas out there both for new and established medical practices. For those looking to keep costs down, focus on marketing strategies that you can personally carry out. Learn how to build great social media and other marketing courses in Udemy. However, don’t forget about HIPAA when engaging in social media.

Design apps like Canva offer free basic graphic creating tools while a basic internet search can teach you how to put out helpful content. If spending money on advertisements is too costly, focus on word-of-mouth marketing and building a loyal patient list and find some networking groups to gain professional relationships that will help promote your business through referrals.

The world of marketing is expansive. Take time to test different strategies and find what works best for your medical practice.

How To Market a Private Medical Practice.

As a healthcare provider, your mission is to ensure that your patients are receiving high-quality medical care. When it comes to building a patient base, marketing efforts for private medical practices cannot be overlooked. Having multiple marketing strategies in place will put your private medical practice on the map, enticing prospective patients to seek out your care and expertise.

There are many ways to set your private practice up for success. Below, we offer some of the best strategies for ensuring that your private medical practice receives the attention it deserves.

If you’re a practicing physician or have just finished your residency, you may be considering starting your own medical practice. Although it can feel like a daunting task, the truth is, you’ve already completed the hardest part: becoming an MD or DO. Establishing your practice won’t take nearly as long as completing the degree and postgraduate requirements did–nor will it cost as much!

That said, there are some things to consider before you take the steps to starting your own medical practice: time, expenses, and licensing, just to name a few. Establishing your private practice is much like starting any other business: there are many moving parts to consider. But once you have solidified your plan of action and start researching everything you need to know, opening your practice and taking on patients will likely begin to come naturally.

How exactly do you begin? How do you start a medical practice from the ground up?

Here are some things you should keep in mind!

Hire Someone to Help You Get Started

Even doctors need to consult someone else for help every once in a while. With that in mind, you might consider hiring a consultant to help you get organized and explore your options. A consultant can help you identify where you should establish your practice, how you will design the space to meet your needs, how you’ll organize your staff and patient data, and how much this will all cost.

It might also be helpful to hire a personal assistant to help keep you organized throughout the process, especially if you’re already working for another hospital or private practice. Managing your time and energy will keep your mind clear, and keep the task of establishing your own practice from beginning too overwhelming.

When it comes to your medical website design or marketing you should always consider hiring a HIPAA compliant and minded company or consultant.

How Much Does It Cost To Open A Private Medical Practice?

Costs for opening your own practice will depend upon a number of factors. Where you decide to practice will play the biggest role in determining the overall cost, as real estate and property rental fees vary widely from one state to another; even cities within the same state with just a few miles between them can bear different price tags.

How you choose to furnish the practice, the types of benefits you offer your employees, and the number of employees you’ll need to staff your practice are some other major factors that will determine the total cost of starting your practice.

In total, opening a small-sized practice could range anywhere from $70,000 to $100,000 over the course of just a few months. This estimate covers your insurance, start up costs, and your personal expenses for the first quarter that you’re open for business.  However, some costs can be reduced depending on what you decide to do yourself.

Assuming that you will require a small business loan to get started, having good credit will save you some of the expense associated with the high interest rates of credit cards or loans. If you’re beginning the planning process now, be sure to take your credit history into consideration.

If your credit is not great, make it a priority to improve it as quickly as you can. With good credit, you might be able to find a low-interest loan that can be structured to require interest-only payments for the first year. In doing this, you should be able to establish a decent revenue-flow and salary before you’re required to begin repayment.

How Long Will it Take?

Assuming that you are already practicing as a physician, you should give yourself about six to nine months of planning time before you expect to open your practice. This will give you time to find an appropriate and convenient location and to renovate it to suit your needs, if necessary. It will also give you time to purchase all of the equipment, furniture and materials you’ll need to be business-ready.

You can also spend this time applying for a business license, acquiring the insurance you’ll need, and establishing standard operating procedures for your day-to-day and special-circumstance operations.

That said, the bulk of these decisions should be outlined in your business plan that you’ll need to apply for your loan.

Business Planning

Not only will a business plan be required to secure a loan; it can also serve as a great foundation for conceptualizing what your practice will look like. The business plan should include at least a few detailed pages articulating your plan for financial growth and the services you’ll offer, among other things. Let’s look at each of these in detail:

  • Start with an executive summary. An executive summary is essentially the introduction for your business plan. It should explain your basic business proposal, who it will help or what problem it will solve, your target market, and your financial highlights, like what your major expenses will be, and how you will generate income.
  • The company overview. The company overview will expand upon your practice’s mission statement, legal structure, management team, history, and proposed or general location. The mission statement will require you to consider what your real goals are for the business, aside from the financial ones.
  • Some information about your services. Expand upon your experience as a doctor and what services you plan to provide at your practice.
  • Your marketing plan. For a medical practice, this section is unique. Typically, you’ll want to talk numbers here. You might explain the demographic of your proposed location, what they’re greatest needs will be from a doctor’s office, and how you’ll advertise your services once established. Giving this “numbers portion” of the business plan some context through a story (like, for example, about your grandparents and their aging group of life-long friends and how that translates to the need for a private medical practice) will give you an edge in convincing a loan manager that you’re worth the investment.
  • A list of company milestones. In this section, you’ll establish the long and short-term goals that you hope to reach in the future of your practice. This is a good place to determine concrete deadlines, management terms and budgets for the business.
  • The management team. If you’re going into business with another doctor or other doctors, this is where you’ll talk about their experience and histories as well. Their educational backgrounds can be showcased here, too. If you have an office manager or other individual in place to manage different aspects of the business (ie: a financial manager, a human resources manager, etc.) this is where you’ll highlight the talents of those people and explain their roles within your company.
  • Your financial plan. This can be intimidating for many people. That is hiring a competent personal assistant or accountant may be helpful for this portion of the business plan if it’s overwhelming. To break it down, the financial plan should include the following:
    • Profit and Loss statement
    • Cash flow statement
    • Balance sheet
    • Sales Forecast
    • Personnel Plan
    • Business ratios and break even analysis

(Don’t forget about the office supplies and utilities)

Also It may be helpful to plan for non-payment and if you are going accept private, state medical insurance, medicare, or medicaid.

Staffing Requirements

When considering the staffing requirements for your practice, you’ll need to first consider  its size and scope. Like many businesses, you will need employees to operate various aspects of your practice, including reception, billing, accounting, and marketing. You might decide to hire an office manager, or you may delegate multiple responsibilities to various employees with other medical-related responsibilities (like employing multiple nurses who can also answer the phone and schedule appointments).

According to, the number of employees you will need will depend on a number of factors. Inefficiency creates the need for more hires. If your employees need to leave their desks to handle multiple responsibilities, you’re losing efficiency. The record-keeping and transcription services you use will also determine whether or not you’ll need additional staff to transcribe and file patient records, or whether you’ll spend more initially for software that will save employee costs in the long run.

As your practice grows, it may be practical to have a specific staff member dedicated solely to answering the phone and scheduling appointments. For a budding practice, being able to accommodate new patients in a timely and friendly manner without being rushed or sidetracked is crucial.

Your patient’s first contact with the office will likely be via phone inquiry or email, and having a dedicated staff member to complete those tasks will make the process smoother for a new, or returning, patient. If you miss a new patient’s inquiry, they are much more likely to try a different practice. That is a patient you cannot afford to lose out on!

You will also need to consider whether or not you’ll be a general medicine practice or offer some specialty services. Depending on your type of practice, you may either need a staff member to organize and set up referrals to other doctors, or have specially trained medical staff on duty full or part-time. These could include X-ray technicians or lab technicians, depending on the type of specimens you plan to process in your office.

As a rule of thumb, you’ll want to have enough dedicated triage nurses to greet and process patients as they come in for appointments. You may require a physician’s assistant or other medical practitioners as the volume of your practice grows, or if you plan to operate a fairly large practice from day one. Other staff to consider, based on technology, location and operation size include:

  • Medical billing and records staff
  • Records and transcriptionist staff
  • Marketing, advertising and social media account manager
  • Office manager or practice management, if needed

Hiring highly skilled candidates and cross-training employees can help cut down on human resources expenses in the long run. Holding employees to high standards of efficiency is important.

In the beginning, you likely need to closely monitor and modify standard operating procedures in order to find a system that works for your office and needs. Competitive benefits and paid time off will also attract more qualified candidates. This is also another reason to make sure employees are cross trained so that even your small to mid-sized practice can accommodate employee sick and vacation days.

Business Operation and Licensure Requirements

In order to legally practice medicine in your own private practice, there are several licensing (including the obvious medical licenses) and insurance requirements you will need to meet.

One of the first steps you’ll need to take is applying for a National Provider Identifier number. The national provider identifier (NPI) is a HIPAA-required unique identification code that qualifies your practice to accept different insurance types from your prospective patients. More information on how to apply can be found at

Your staff members will also need to complete HIPAA and OSHA compliance training prior to practice’s opening. This will ensure that your staff is well-educated on workplace safety operating and reporting procedures and patient confidentiality rights.

Finally, you need to insure your practice; the type of insurance you need will depend upon the nature of your practice. Aside from the standard medical malpractice insurance, you’ll also need to purchase business liability and internal theft coverage.

Insurance rates can vary based on a number of factors, but depend mostly on how many employees will be on your staff. Worker’s compensation insurance can cost upwards of $2000 for a staff of three employees, according to You may also want to offer health insurance to your employees and make sure that you and your family remain medically insured as you leave your place of employment.

Challenges You May Face

There are many potential challenges in getting your practice off the ground, as is the case with any other type of business. First and foremost, you’ll need to be sure you’ve given yourself enough time to plan. You’ll likely need to work with both your attorney and accountant to draft some of the legal documents and business plan required to get started. Surrounding yourself with a team of professionals that you can trust will take some of the burden off of your shoulders during the startup process.

Finally, remember to take into account any existing contracts you may have signed at your current place of employment. Some employment contracts contain no-competition clauses; as such, you may need to wait it out or have your attorney review the circumstances. Expect delays to occur, especially now that many agencies have employees working remotely for the first time.

Above all else, try to be patient and persistent. Opening your own practice will be challenging, but also rewarding, and doing your research will help create a smoother process for everyone involved!

Bonus: Affordable ways to market

There are plenty of marketing ideas out there both for new and established medical practices. For those looking to keep costs down, focus on marketing strategies that you can personally carry out. Learn how to build great social media and other marketing courses in Udemy.

However, don’t forget about HIPAA when engaging in social media. Design apps like Canva offer free basic graphic creating tools while a basic internet search can teach you how to put out helpful content. If spending money on advertisements is too costly, focus on word-of-mouth marketing and building a loyal patient list and find some networking groups to gain professional relationships that will help promote your business through referrals.

The world of marketing is expansive. Take time to test different strategies and find what works best for your medical practice.

Protected Health Information: HIPAA PHI Compliance

HIPAA Learning Objectives  (Estimated Read Time – 8 mins)

There are countless HIPAA Settlements each year. With well over half involving digital and network compliance.

At the end of this you will learn:

  1. A brief overview of HIPAA and fines.
  2. What Is PHI? And ePHI.
  3. What the Biggest overlooked gap in HIPAA compliance is.
  4. Example cases.
  5. WHY you should care.
  6. How to close those gaps.

HIPAA Overview

Who falls under HIPAA?

Covered Entities (CE) medical providers, mental health providers, medical insurance providers, and yes that includes medical insurance brokers/agents. Pretty much anyone who accepts insurance as a form of payment, companies who handle Protected Health Information (PHI), or electronic PHI (ePHI), or come in potential contact with it fall under some level of HIPAA. This includes third parties that have entered a Business Associate Agreement (BAA) (And only if they have signed a BAA.)

“A Covered Entity is any entity that receives federal financial assistance from the Department of Health and Human Services or is covered under Title II of the Americans with Disabilities Act as a program, service, or regulatory activity relating to the provision of health care or social services.” HHS

Who doesn’t fall under HIPAA?

Any company that doesn’t handle or has the potential to see/ interact with PHI. That includes your contractor who is building your IT network or repairing your office if they don’t have a BAA.  (See the problem if you don’t do an effective risk analysis for PHI)

If I don’t accept insurance and only accept cash do I have to worry about HIPAA?

It depends.

First, we recommend talking to a lawyer that specializes in HIPAA about your situation. Good rule of thumb: If you have ever fallen under the CE rule, accepted insurance in the past, currently, or will potentially in the future, you still have to protect all of that data. (Some lawyers have even mentioned if you included HIPAA releases on your intake forms you, fall under it.) HIPAA Is Past, Current, and Future client’s PHI.

HOWEVER, even if you are not under HIPAA, you are still open to the governing laws of your state and professional license. While HIPAA has a lot to do with how to best protect data, not protecting your data can open you up to the new consumer protection laws that states are adopting which can still hit you with big fines.

HIPAA Violations and Fines

The Office for Civil Rights (OCR) and the Department of Health and Human Services (HHS) publishes a list of the largest fines and breaches. The HHS lists all HIPAA breaches involving 500 individuals or more on the OCR Portal. There are over 500 large breaches as of 2019 over a 24 month period. The largest fines and select breaches are listed on HIPAA Resolution Agreements website.

Large beaches are only a small fraction of the fines assessed every year.

If you have a breach, you risk not only having a very public description of your incident, you also face a financial penalty based on the size and severity of the breach and practice’s culpability. Not to mention the loss of patient trust and news coverage.

In addition to fines, you may face criminal charges if the violation merits it.

Important to note: You do not need to have a breach to face HIPAA penalties.

What is the penalty for a HIPAA Violation?

There are five tiers based on the violations and what level of responsibility (and negligence) the entity acted in at the time of the violation.

Tier 1: Minimum fine of $100 per violation up to $50,000, with a per-year maximum of $25,000 that the issues persisted.
Tier 2: Minimum fine of $1,000 per violation up to $50,000, with a per-year maximum of $100,000
Tier 3: Minimum fine of $10,000 per violation up to $50,000, with a per-year maximum of $250,000
Tier 4: Minimum fine of $50,000 per violation, with a per-year maximum of $1,500,000.

As of April 2019, fines were adjusted to reflect the maximum amount per tier violation. But the figures could change as they are still pending additional rule-making.

It is important to remember that each State Attorney General can also impose HIPAA fines which the State keeps a percentage. As you can see, a multi-state data breach can get quite costly quickly and the incentive for a state AG to push a case.

Each Tier has maximum criminal penalties as well.

Tier 1: Maximum Up to 1 year in jail
Tier 2: Maximum Up to 5 years in jail
Tier 3: Maximum Up to 10 years in jail

Plus up to 2 years for PHI theft and potential payment of restitution.

What Is PHI and ePHI?

What is PHI?

HIPAA protected health information (PHI) is any information about an individual created in the provision of medical care. This includes past, current, and future care.

Examples of PHI include:

What is ePHI?

ePHI is simply the electronic; storage, transmission, or creation of PHI information which can be on any device. For example: computer, thumb drive, internet, cellphone or any recording device.

HIPAA treats any company that stores or transmits PHI as a Business Associate (BA) with the Covered Entity (CE) and requires a Business Associate Agreement (BAA). If the CE does not get a signed BAA, the CE is the one that will incur the HIPAA violations even if the BA is at fault. Technically a BA does not even have to view the PHI data to fall under the BAA requirement. A BAA helps safeguard both the CE and BA with clear responsibilities in handling PHI and liability in the event of a breach. It also helps lower the risk of a breach since both parties understand and follow HIPAA best practices. Also having a good BAA and documented procedures can help lower the fines associated with a breach or violation.

That means if you create, transmit, pass through, store, potentially see, ePHI with them, they need a signed BAA. But more on that later.

What Is The Most Overlooked Gap HIPAA Compliance Risk?

Digital marketing and websites.


PHI pertains to past, current, and the most commonly overlooked future clients. Remember our list of PHI data? IP addresses, contact information, etc. Yes, you may have invested thousands on protecting at your physical location, staff training, and internal network but you may have left the backdoor wide open.

Your Website

If your site is not hosted on a HIPAA compliant server or does not have end-to-end encryption, and has any of the following: contact form, chat, server hosted email, and a whole host of potential website security gaps, then you are potentially exposed. We have seen some big providers of “medical websites” who built non-compliant sites.

Why is that important?

Your website is the portal of first contact so if it is susceptible to hackers or malware, then your patient data may be intercepted.

Did you know?
Example: Look at all of these glowing reviews and comment cards

Your web designer may post testimonials on your website without a signed release.

This office was one the hook for $25,000 for posting testimonials and photos on their website.

Digital Marketing

While a non-compliant website can cause a huge issue when you start to market online, the company you hire can be an even bigger risk.

More often than not, you may hire a marketing company who does not handle the data (such as lead information) with HIPAA in mind and inadvertently cause a breach. If you don’t have a BAA with them, then you are fully on the hook for their mistakes (not to mention the violation from not having a BAA). And it could put you and your practice at risk.

But how could that happen?

Search Engine Optimization (SEO)

Example: You hire an SEO consultant or company who is helping your site reach the top of the search results. If they know what they are doing, they will ask for FTP access to your site. As well as higher-level access than your average user.

You could be on the hook for $300,000 like this Tennessee medical imaging company who let a contractor have FTP access and did no due diligence.

Or they may install call tracking software to show you proof ot their results, logging all calls to your business, owner name, and traffic source.

Social Media Marketing and Lead generation

Example: Posting a picture of a patient without a signed consent can get you in trouble (even if they are in the background inadvertently).


Your lead generation company may be selling or buying your leads on the open market. Or using your patient list to create lookalike audiences on Facebook. We don’t need to get into the data breaches that Facebook has had…

Real posts from one large Facebook marketing group looking to buy or sell lead data.

Or your marketing company can leave their server open exposing your new clients.

But it doesn’t take much searching to find examples of potential HIPAA violations. There are literally thousands of examples of how your practice can be exposed by third-party vendors.

Why Should You Care?

If you are still in doubt as to why HIPAA compliance or proper vendor due diligence is something to care about, then please re-read or look up fluffy cat videos on YouTube.

How To Close HIPAA Digital Compliance Gaps.

Take our HIPAA compliance quiz to see where you may be at risk and/or contact us to schedule a digital risk assessment.

Want even more examples of Digital HIPAA Violations?

$100,000 HIPAA Breach due to compromised Username and Password

Open Server Database in Search Engines.

Mental health non-profit pays $150,000 fine for un-patched and noncompliant software.

$500,000 for sharing HIPAA data with 3rd party vendor without BAA. 

Allowing sales representatives access to phi to identify patients to market to. Jail time avoided in plea agreement and settlement.

Office closed over $6,500 ransomware.

80,000 exposed in marketing breach

It seems like you can’t attend a networking group or throw a ball without hitting someone who is a social media “marketer.”  It wasn’t too long ago when social media was synonymous for cat memes and chocolate rain, but now it is the driving force behind many huge brands.  There seems to be no rhyme or reason why something has viral magic (there are a few new studies showing potential common themes).  It has the power to join communities or ruin a reputable brand almost overnight.  Navigating this social minefield has made many businesses shy away and resist engaging directly on social media.  By the end of this you will have a better understanding of the psychology behind what puts the “social” in media, by someone qualified to teach psychology.  Sit back, grab your favorite drink, and enjoy this analysis.

You Are Narcissistic.  I’m Just Awesome.

Narcissistic Personality Disorder (NPD) was considered for removal or significant changes from Diagnostic Statistical Manual V (DSM-5) (The DSM-5 is the standard diagnostic tool used by psychiatrists, psychologists, and counselors to define what qualifies as a mental illness, the common symptoms, and what the accepted name is of a specific mental illness).  While completing my masters’ coursework, the potential change to NPD was a highly debated topic.  We could go into the details, but at the end of the day it came down to how subjective it was to diagnose, even as professionals.  Narcissistic Personality Disorder is easily misdiagnosed and not surprisingly, partly attributed to the rise of social media making behaviors traditionally associated with the real disorder harder to discern from new regular behavior.  Think about how many posts are about others in your own feed.  I would be willing to bet that a majority of your posts are self-focused.  You had to share that photo of that cute cat, because you liked it.  That crazy driver post, because you wanted reassurance that you were not at fault.  Think about any status or picture you post: there is an underlying reason as to why it is about you.

Now that I have everyone thinking “No Way, Jason! I am not a narcissist!” Don’t worry, it’s likely not your fault.  It is human nature to be self-preserving or slightly narcissistic, meaning it is normal to care about one’s self-worth and personal survival.  Social media just gives you an outlet for that natural tendency.  An actual narcissist wouldn’t care about how self-serving their posts may be perceived. They would think about how they never do anything close to being a narcissist and would likely comment below about it expecting the praise of others.

Why does this matter to social media marketing?  If we focus our brand or marketing efforts to ourselves, we alienate our customers from engagement.  Think about any successful brand ad or even a high engagement post you had.  More likely than not it was audience-focused instead of you-focused.  The hardest part of a social media strategy is to change that focus from ourselves to our customers effectively.  If that wasn’t the case everyone would be doing it.

Are We All Just Trained?

The driving force behind why we tend to latch into our social media posts is not only due to narcissistic tendencies, but by being trained to by conditioning.  Some may recall learning about Pavlov’s dog (he trained a dog to salivate at only the sound of a bell with the expectation of food.  For fans of the Office, Jim trained Dwight to respond to Altoids due to the sound of his computer. Watch the clip here.) Pavlov’s dog, or classical conditioning, can be defined as a trained physical response to expected reward.  In social media, the reward is gratification from others responding to our need for human contact (Positive social contact triggers neurotransmitters in your brain similarly to how hard drugs will affect you, but I will not go into detail here).

B. F. Skinner expounded Pavlov’s experiments and came up with the theory of operant conditioning and variable schedules. Skinner tested Pavlov’s experiment but also wanted to determine if the schedule of the rewards or punishments mattered for behavior to be learned and maintained or stopped.  He found that random rewards had the largest effect on learned behavior.  His test rats stayed engaged in the desired behavior longer over instant gratification.  Gambling is a prime example of a randomized operant conditioning schedule: the potential to win keeps you playing even when you lose.  The same is true with social media.  The potential for a viral post or a “like” keeps you checking back regularly and posting for those social rewards.

Brands can and do utilize this for awareness and engagement.  If you have randomized engagement and rewards based off responses you may just have higher potential for virality, the golden goal of social media that everyone seems to be chasing.  Many brands think of contests when they try to plan on helping something become viral, but instead think about finding ways to introduce randomness.  One example is featuring a customer in a spotlight post or increasing ways for discussions to happen on your pages.  Contests are great but remember that comment notifications can be just as powerful to your customers as winning something is.

Social Psychology Does What?

One key aspect of social psychology is summed up by a disheartening frequent example by people in crowds who do not seem help those in need it.  The bystander effect (Bibb Latane & John Darley), which simply put: people, when in a crowd, will have defused responsibly to act.  You see this when a crowd witnesses a horrific accident or event and no one moves to help.  Everyone believes that someone else will jump in and it is not until someone challenges that social norm and act, when others join them. This is also true online with social proof or when people lash out at a brand.  For those who may not be familiar with social proof: it is the collective response of people reinforcing your brand such as reviews or comments.  It “proves” that others find significance in what is talked about. If others participate in the discussion they contribute to the growth of the crowd voice and can have either a positive or negative effect.

Since we know that people love to talk about themselves, if you can facilitate that with your brand advertising you may get more reach, and more people may interact with your posts and content.  That does not mean that every post has to be about your customers, but if you create a community for dialog, people will engage and you can use the bystander effect to your advantage.

How Do You Create A Community?  I Don’t Even Have The Budget Or Time To Create One.

Here are two proven community building principles:

Social Presence Theory (Short, Williams, and Christie, 1976) proposed that people perceive others to be interacting with them and present even if they are not. Which means that a brand can build an identity through interactions on a social media page and others’ comments without needing to have any in-person connection.  The same way talking to someone on the phone makes you feel as if they are in the room with you, or a vacation photo from someone can help you imagine as if you were there. (I will be going in depth on this and many other psychological marketing principles in future posts so you can bookmark us.)

Consumer social identity was hypothesized and tested by Champniss, Wilson, and Macdonald published “Why Your Customers’ Social Identities Matter” in Harvard Business Review, 2015.  They found that community identity can be built and also shift almost instantly (in just 20 minutes) without much effort from the brand, which directly impacts customer behavior.  The researchers invented a smoothie brand to pitch “draft marketing ideas” to participants and randomly assigned them to three different groups. The first group was lead to believe they had “superior creative skills”, while the second group were just told they were participants, the third group was informed they were chosen to help create a “pro-sustainability brand”.  The first and third groups engaged more, completed more company requested actions, pledged money, and volunteer time to charities the “brand was working with”.  This was in direct contrast to the second group which under performed in all areas.  Interestingly enough the participants were not all from the same backgrounds nor had any documented prior attitudes towards sustainability/environmental concerns (meaning they did not have to hold the belief of the assigned group before the onset of the group creation).

This means that you don’t have to break the bank building an engaging brand if you project an engaging identity to your customers and work on building social proof.  The power of social media marketing for brand building means that you can engage many different backgrounds and groups, if you correctly create a shared identity.

How do you create a positive shared identity?

There are some common themes that I have seen with the brands I have worked with.

  1. Know your customers and ask relevant questions. What does the consumer want?  Are there any key social questions that are engaging and brand specific?  If you are an eco-friendly brand, are the questions related to social engagement/issues and are you positioning yourself as value additive?  If you are a shoe company, do you have content related to the buyers of your product?
  2. Create marketing and ads that are mindful of the that audience and add value vs information overload.  Simple and different is better than over used and intrusive.  Remember that everyone is a little narcissistic and if your social media marketing interrupts funny cat video time, it better be for a good reason.
  3. Find ways to creatively tell an old story in new ways. Don’t “spin” content (plagiarizing someone’s work by changing it slightly with no value added). It gets old really quick and people start to see that you’re not an authority in your own brand.  Originality is rewarded since consumers want to be in the “in” crowd. The same is true for your ads.
  4. If you need to hire a marketing company make sure they understand and learn to speak in your brand’s voice. If you don’t have a brand voice, create one. People want to feel as if they are having a conversation with the owners and not a third party.  If you don’t have a great voice that is fine, in the online world you create the voice you want.
  5. Master one platform and then move to the next. I hear all the time, “I want your company to do; search engine optimization, pay per click, Facegoogleyyahooyelpaistagramwikideia…”  Yes, that is a new word filed under “new client mumbling”.  My usual response “Do your current sales have the resources to support a large budget on all of those?” I never advise new clients to spread their marketing budget too thin.  A $4,000 ad spend focused under one marketing platform is better than $4,000 spread over many.   You need to spend enough to make an informed decision about your market.
  6. They have a “test and learn” philosophy. They are always testing a new message, ad, or website landing page.  If they don’t get results on one platform they adapt the message to test if it is the content presentation.  Most sales performance problems are related to how message is interpreted.  They also test to constantly improve on “great” results.
  7. Take the time to understand that more content is not better than quality content. Quality is value-additive to daily lives, not just space-filling. Did you know if you stop talking in a conversation the other person is likely to speak very soon after because psychologically people don’t like silence.  Resist the urge to post just to post.  You may be surprised that your audience fills in some of that space.

If you keep these psychological social media marketing fundamentals in the back of your mind you can create a more engaging brand.  Remember we are creatures of habit and if you find ways to keep people engaged they will keep coming back.  Social media is not hard, setting yourself up for engagement is the complicated part.

About the author:
Jason Eland, founder of Eland Consulting, holds a M.A. in Counseling and Psychological Services and has applied this deeper understanding of human psychology to create ads and market strategies that evoke better responses.   When he is not crafting a campaign or improving a website’s conversions, he tends to his lemon tree in cold Minnesota and enjoys fresh lemonade with his family.

Schedule A Free Consultation

Get started now by scheduling an intro call. We’ll talk through your marketing goals, and determine if we’re a great fit.

How long does it take?
A phone, not long at all. I promise we won’t bite. Initial phone calls usually last about 15-20 mins or less. You can call either 612-787-2179 or 612-247-2290 to start your project quote today. Timelines for projects depend on the engagement and scope of work. Website Design takes anywhere from 3 to 4 weeks to much longer for larger complex projects. Most small business websites take between 3 to 4 weeks. SEO really depends on the competitive landscape of your industry. Typically, we see upward trends starting in the first month and then more noticeable movement from 3-6 months.
How much does it cost?
Think of us like your digital real estate agent. Just like a real estate agent would need to know your price range. We help you find a winning solution to best match your budget and project requirements. Our goal is to help make your online presence a digital asset that works to earn you more business even while you sleep.
Can I make changes afterwards?
All of our projects are built so you can take control of as much or as little as you would like. If your needs change during the project, we can adjust the scope of work or quote for the new features if it is a drastic change.

Let’s Work Together!

Our mission is to improve your business utilizing a consumer psychology focused approach in our services
chevron-down linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram