How can healthtech companies publish case studies without exposing PHI?
Healthtech companies publish case studies safely by telling the customer organization's story, not any patient's story. Get the customer's written approval, interview staff rather than patients, report only aggregate operational results the customer agrees to share, use synthetic data in every screenshot, and have both sides' privacy or legal teams review the draft. Using patient information in marketing generally requires the patient's HIPAA authorization, so leave it out entirely.
- The story is about the organization: workflow, implementation and aggregate results, never individual patients.
- Your BAA limits what you can do with PHI: marketing use of customer data is rarely a permitted use.
- Screenshots are the most common leak: use synthetic data and recreate screens rather than cropping real ones.
- Disclose incentives: if the customer got a discount for taking part, the FTC expects that connection to be disclosed.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
Can a healthtech vendor publish a case study about a HIPAA-covered customer?
Yes, when the case study is about the customer as an organization, the customer approves it in writing, and it contains no protected health information. What a vendor may do with PHI is set by its Business Associate Agreement and the HIPAA Privacy Rule, and promotional use of patient data is generally not among the permitted uses. Confirm your position with counsel.
Three rules matter most:
- Business associate limits. A BAA must establish the permitted uses and disclosures of PHI (45 CFR 164.504(e)), and generally cannot let the vendor use PHI in ways the covered entity itself could not.
- Marketing authorization. Under 45 CFR 164.508(a)(3), a covered entity generally needs an individual's authorization to use or disclose PHI for marketing.
- De-identified data is not PHI. Information de-identified under 45 CFR 164.514(b) falls outside the Privacy Rule, but small case studies are hard to de-identify reliably.
The practical answer is to build the story from staff interviews and aggregate metrics, and leave patients out completely.
What details in a case study can count as PHI?
Anything that could identify a patient, alone or combined with other details, can turn a case study into a disclosure. The HIPAA Safe Harbor method lists 18 types of identifiers, including names, geographic units smaller than a state, all date elements except the year, contact details, record numbers, device identifiers, full-face photos and any other unique code. The HHS de-identification guidance explains both methods.
| Risky element | Why it is a problem | Safer alternative |
|---|---|---|
| A patient's story, quote or initials | Names and partial identifiers can identify a person | Quote staff about their workflow instead |
| Screenshots from a live system | Names, dates and record numbers hide in corners and drop-downs | Recreate screens with synthetic test data |
| Exact dates of admissions or visits | Date elements other than year are identifiers under Safe Harbor | Describe periods, such as "in the first quarter after go-live" |
| A rare condition at a small facility | Small numbers can point to one person even without a name | Report results at department or system level |
| Photos taken in clinical areas | Faces, wristbands, whiteboards and screens may be visible | Staged photos in non-clinical spaces with consenting staff |
| Raw data exports for charts | Row-level data can carry identifiers into design files | Ask the customer for aggregate figures only |
Remember the extra Safe Harbor condition: even with identifiers removed, the data does not qualify if you actually know it could still identify someone.
What is a safe step-by-step process for a healthtech case study?
A safe process starts with the contract and ends with written sign-off. Confirm the customer agreement allows publicity, agree the story and metrics with the customer's marketing and privacy contacts, interview staff, draft with aggregate data and synthetic screenshots, then route the draft through both companies' legal or privacy review before anything is published.
- Check the contract: many customer agreements restrict use of the customer's name and logo without consent.
- Agree scope in writing: which metrics, quotes and visuals the customer will allow, and whether they will be named.
- Interview staff, not patients: clinical leads, operations managers and IT owners describe the change in their own work.
- Use customer-supplied aggregates: let the customer calculate and approve every number, and state how it was measured.
- Build visuals from scratch: recreated screens with synthetic data, product diagrams and staff photos.
- Review twice: your privacy or legal reviewer, then the customer's, with a final written approval.
- Disclose connections: the FTC's Endorsement Guides expect disclosure when a featured customer received something of value, such as a discount, and expect clarity when results are not typical.
What should a PHI-free case study include to convince hospital buyers?
A PHI-free case study persuades through specificity about the organization: its setting and size range, the problem it measured, how implementation went, what staff changed, what results the customer approved and how they were measured, and what was harder than expected. Buyers trust stories that admit friction more than polished summaries.
- Context: type of organization and setting, described broadly enough to protect patients.
- Problem: the operational or clinical issue in the customer's own terms.
- Implementation: timeline in phases, IT effort and training.
- Results: customer-approved aggregate measures with the method stated.
- Lessons: what the customer would do differently.
If a customer will not be named, an anonymised story still helps when it is detailed about workflow. Case studies support every member of a hospital buying committee; see how to market healthtech to hospitals and our healthcare SaaS content marketing guide. A fractional CMO for healthcare companies can own the customer-proof program. Book a call with the US team to plan yours.
What proof can you use when customers will not approve a case study?
Many health systems decline public case studies because of brand policy or legal workload. Useful substitutes include private reference calls with your champion, a written statement the customer approves for sales use only, a speaking slot at an industry event where the customer presents in their own words, and a process story that explains your implementation method without naming anyone.
- Reference calls: offer them late in an evaluation, and protect your references from over-use.
- Private proof packs: customer-approved summaries shared under NDA with qualified buyers.
- Method stories: how your implementation team runs go-live, with no customer data at all.
The same privacy rules apply to every format: no patient details, written approval and disclosed incentives.
Related pages from the US team
Fractional CMO for healthcare companies
Senior marketing leadership for healthtech and healthcare companies.
Marketing healthtech to hospitals
Account-based marketing to health system buying committees.
HIPAA for marketing vendors
How HIPAA applies to agencies and vendors that touch patient data.
Healthcare SaaS content marketing
Content by buyer role and stage for healthcare software companies.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Do healthtech case studies need patient authorization?
Not if they contain no protected health information. A case study about the customer organization, built from staff interviews and aggregate results, does not use PHI. If any patient's information or story would appear, HIPAA generally requires the patient's written authorization for marketing use, which is why most vendors leave patients out entirely.
Can a business associate use customer data for its own marketing?
Generally not. A Business Associate Agreement sets the permitted uses of protected health information, and it cannot let the vendor use PHI in ways the covered entity could not. Promotional use of patient data is rarely permitted. Ask counsel before using any customer data, even in aggregate, for marketing.
Is de-identified data safe to use in a case study?
Data properly de-identified under HIPAA, by the Safe Harbor or Expert Determination method, is not PHI. Small case studies are risky, though, because a few details about a small facility can still point to one person. Prefer aggregate results the customer calculates and approves, described at department or system level.
Can we show product screenshots in a healthtech case study?
Yes, if they contain no real patient information. Recreate screens with synthetic test data rather than cropping or blurring live screenshots, because names, dates and record numbers often remain in corners, tabs or drop-down lists. Have a second person check every image before publication.
Can a healthtech company publish an anonymous case study?
Yes. When a customer will not be named, describe the organization broadly, such as a regional health system, and focus on workflow, implementation and customer-approved results. Get the customer's written approval anyway, since the contract may still restrict publicity, and make sure the description cannot identify the organization's patients.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Need customer proof without the privacy risk?
A 30-minute call with the US team. We'll review your customer-story process, contracts and visuals, and show how to publish proof hospital buyers trust.