HIPAA IVF & fertility clinic advertising compliance guide
A working field guide for fertility clinic leadership, IVF network marketing directors, medical directors and the agencies that support them. Reviewed against the current Office for Civil Rights guidance on online tracking, the Privacy Rule marketing provisions, the Genetic Information Nondiscrimination Act, the Fertility Clinic Success Rate and Certification Act of 1992, and the state medical board rules that layer on top.
- Fertility clinics handle the most sensitive PHI category in reproductive-health marketing. Embryo grading, preimplantation genetic testing (PGT) results, DNA sequence data, gamete provenance and cycle outcomes are all PHI, and the Genetic Information Nondiscrimination Act reinforces protection over the genetic subset.
- Success-rate claims in fertility advertising sit under the FCSRCA of 1992 and CDC's standardized ART reporting framework. Any success-rate claim in a paid campaign should be traceable to CDC-defined denominators, not clinic-favorable custom denominators.
- OCR's 2022 and 2024 tracking-technology guidance applies with heightened sensitivity in this category. Every treatment page (IVF, IUI, egg freezing, donor egg, gestational surrogacy, LGBTQ+ family building) is a condition-relevant surface. Server-side tagging with URL rewriting is standard.
- Patient testimonials are the highest-leverage creative in fertility and the most heavily scoped. Marketing authorizations, state medical board disclosures, FTC endorsement disclosures and platform-level rules on family-planning content all layer.
- Not legal advice. Consult a healthcare-marketing attorney, your state medical board, and where applicable the SART / ASRM guidelines before publishing patient-facing creative.
On this page
- Why fertility clinics sit at the sensitive end of HIPAA scope
- Embryo, gamete, genetic — where PHI lives
- Success-rate claims and the FCSRCA/CDC framework
- Testimonials and the intended-parent authorization stack
- Website tracking on fertility sites
- Donor advertising, third-party reproduction and state overlays
- BAA scoping for fertility martech
- A working compliance checklist
- Dallas, Texas LLC
- 10-person US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
Why fertility clinics sit at the sensitive end of HIPAA scope
Fertility clinics are covered entities under 45 CFR 160.103. Beyond the standard HIPAA framework, four other bodies of law and rule shape what fertility clinics may say in advertising.
- The Genetic Information Nondiscrimination Act (GINA). Genetic information — including family medical history, genetic tests and genetic services — is a specifically protected category. HIPAA's Privacy Rule was harmonized with GINA in 2013 so that genetic information is treated as PHI when held by a covered entity.
- The Fertility Clinic Success Rate and Certification Act of 1992 (FCSRCA). ART clinics are required to report success rates to the CDC using standardized definitions. The CDC publishes the ART Success Rates Report annually.
- State medical board advertising rules. Every state medical board regulates truthfulness, testimonials, before/after imagery, and specialty claims. Fertility is a specialty (Reproductive Endocrinology & Infertility, or REI, board-certified through the American Board of Obstetrics and Gynecology).
- SART / ASRM guidelines. Not regulations, but widely-followed professional standards on advertising claims, donor recruitment, and cross-border reproductive care marketing.
Marketing teams that treat fertility as "just another specialty" tend to run creative that clears HIPAA but fails FCSRCA, FTC substantiation or SART guidelines. The most defensible programs treat all four bodies of rule as a stack.
Embryo, gamete, genetic — where PHI lives in a fertility workflow
Protected Health Information in a fertility workflow is broader than the medical chart. The category-specific surfaces:
- Intended-parent name, address, phone, email, insurance member ID, employer (relevant for infertility-benefit programs).
- Cycle data — stimulation protocol, retrieval date and count, fertilization rate, embryo grades, biopsy status, transfer date, outcome.
- PGT results — aneuploid/euploid/mosaic status, monogenic screening results, HLA typing where relevant.
- DNA sequence data and any downstream analysis.
- Gamete provenance — donor egg, donor sperm, gestational carrier arrangement, third-party reproduction contracts.
- Imaging — ultrasound scans (identifiable through the record), embryology-lab photography.
- Consultation intake forms — often the richest single PHI record in the clinic.
- Call-tracking recordings that identify the caller and capture reproductive-health enquiry content.
Success-rate claims and the FCSRCA / CDC framework
The FCSRCA of 1992 requires every US ART clinic to report success rates annually to the CDC using standardized definitions. The CDC's ART Success Rates Report is the standardized, comparable data source.
The CDC-defined denominators
CDC reports use denominators such as "per intended egg retrieval," "per embryo transfer," "per patient" (cumulative across cycles within a defined window), and stratifies by age band and specific patient factors. These denominators exist so that clinics can be compared on the same basis.
Where advertising fails substantiation
- Custom denominators that select only the most favorable patient sub-population.
- Claims that mix CDC-defined and custom-defined denominators in the same ad without disclosure.
- Live-birth-rate claims that cite an implanted-embryo denominator, understating the true funnel.
- Claims that exclude patients on grounds not disclosed to the reader.
- Aggregate multi-year averages that mask a downward or upward trend.
The safer construction is to use CDC-defined denominators, state the age band, state the year, and link to the underlying CDC record where possible. FTC substantiation rules require the underlying data to support the specific claim made — not a similar claim, and not a claim as of a different reporting period.
Testimonials — the intended-parent authorization stack
A fertility patient testimonial is the highest-converting creative asset in the category and the most heavily scoped from a compliance standpoint. The category-specific concerns are that the testimonial almost always identifies the family (photograph of a baby, family name in the caption, family circumstance mentioned), and that the family's story includes highly sensitive reproductive-health detail.
The authorization stack
- HIPAA marketing authorization under 45 CFR 164.508 — specifically describing the PHI (photographs, video, family details, cycle details to be shared), each channel of use (website, Instagram, YouTube, Meta Ads, Google Ads, press placements), duration or expiration event, right to revoke, and any remuneration.
- Consent for identifiable children — where the baby, toddler or child appears, both parents' authorization for the child's likeness and an appropriate storage-and-revocation policy.
- Third-party reproduction consent — where a donor or gestational carrier is part of the story, their separate consent for the way their role is described. This is often the missed layer.
- State medical board typical-result disclosures — a fertility outcome is almost by definition non-typical, and the state disclosure language exists for that reason.
- FTC endorsement disclosure — where the family is compensated, disclosed clearly and conspicuously.
- Platform content policies — several major platforms have specific rules on family-planning and fertility ad targeting; creative can clear HIPAA and still be paused by the platform.
Website tracking on fertility sites
The OCR tracking-technology bulletin of December 2022 and its March 2024 update apply to fertility clinic sites with heightened sensitivity. Every service page in the category is a condition-relevant surface, and OCR's own examples of PHI-creating URL patterns include reproductive-health page combinations.
The specific surfaces that create PHI when tracked by a non-BAA vendor:
- IVF, IUI, egg freezing, embryo banking, donor egg, donor sperm, gestational surrogacy service pages.
- LGBTQ+ family-building and single-parent-by-choice pages.
- Genetic testing and PGT service pages.
- Insurance and financing pages that reveal a specific benefit program (state-mandated infertility coverage, employer-benefit tie-ins).
- The consultation-booking flow.
- Any patient-portal login page.
The architectural fix mirrors other health-care sites but with tighter allow-listing. Route all events through a server-side pipeline. Rewrite service-page URLs at the server edge into neutral event tokens. Field-level allow-list only a hashed anonymous ID, an event token and an aggregate value. Honor consent-mode signals on every request. Log the pipeline and include it in the annual risk analysis under 45 CFR 164.308(a)(1)(ii)(A).
Donor advertising, third-party reproduction and state overlays
Donor recruitment advertising, gestational-carrier program marketing, and third-party-reproduction financing are three of the highest-scrutiny advertising surfaces in fertility.
Donor recruitment
Donor recruitment advertising is subject to FDA rules on human cells, tissues, and cellular and tissue-based products (HCT/Ps) under 21 CFR Part 1271, ASRM/SART guidelines on compensation, and state-specific rules that vary widely (some states cap donor compensation, some require specific disclosures, a few restrict certain forms of donor recruitment altogether). Every donor-facing ad should be reviewed against the state or states it will run into.
Gestational carrier marketing
State law on gestational-carrier arrangements ranges from permissive with specific disclosures required (e.g. California), to restrictive (a handful of states). Advertising for gestational-carrier candidates should be state-scoped and, in most cases, funnel to a legal-and-medical intake rather than a direct sign-up.
Financing and payment claims
Multi-cycle programs, refund guarantees and shared-risk offerings are common in fertility. FTC substantiation and state consumer-protection rules apply. Refund and shared-risk claims should be traceable to the actual program terms — the fine print is the substantiation, and the ad copy cannot outrun it.
BAA scoping for fertility martech
A first-pass fertility clinic BAA inventory typically includes the EMR, the embryology-lab witnessing system, the PGT lab's data exchange, the consultation-booking tool, the two-way patient text platform, the review-generation vendor, the call-tracking provider, the CRM, the email service, the website host and CMS, the analytics platform, the marketing agency, and any donor or gestational-carrier registry the clinic exchanges data with.
Where BAAs are hardest to get
- Consumer ad platforms — none will sign a BAA for standard ad products.
- Consumer analytics products — most will not sign.
- Donor-matching consumer platforms — verify BAA availability before onboarding any exchange of PHI.
- Some genetic-testing lab APIs require a specific enterprise data-exchange tier for BAA coverage.
A working compliance checklist for a fertility marketing team
Success-rate claims
Every claim tied to a CDC-reported denominator, age band and year. Substantiation file retained. No custom-denominator claims without disclosure.
Testimonial pipeline
Authorizations from every identifiable person — intended parents, children, donor, gestational carrier. State typical-result disclosure applied. FTC endorsement disclosure where compensated.
Website tracking
Ad-platform tags off portal and service pages. Server-side pipeline with URL rewriting, field-level allow-listing, consent-mode signals honored. No PGT or cycle data ever forwarded.
Donor and gestational-carrier
State-scoped creative. Reproductive-law counsel review path in place. FDA HCT/P framework reflected in donor advertising claims.
Financing
Multi-cycle and shared-risk program claims traceable to actual terms. Fine-print substantiation on file. No ad copy that outruns the program.
Annual risk analysis
Marketing surface documented in the clinic's annual HIPAA risk analysis with corrective actions tracked. Genetic-data pathways explicitly scoped.
Fertility HIPAA marketing — common questions
Is embryo or genetic data PHI under HIPAA?
Yes. Genetic information is health information under 45 CFR 160.103, and GINA reinforces that treatment. Embryo grading, PGT results, DNA sequences, gamete provenance and cycle-outcome data are all PHI in a covered fertility clinic. Marketing use requires an authorization under 45 CFR 164.508.
Are the FTC rules on fertility clinics different from other health-care advertising?
FTC has taken enforcement interest in fertility clinic success-rate claims. The FCSRCA of 1992 requires ART clinics to report to CDC using standardized definitions. FTC substantiation means any success-rate claim in an ad should be traceable to the CDC data set and use CDC-defined denominators.
Can a fertility clinic run retargeting ads based on visited service pages?
Retargeting based on a fertility-treatment page URL plus a visitor identifier creates PHI in the hands of a non-BAA ad platform under the March 2024 OCR guidance. The disclosure is arguably more sensitive in fertility because the pages themselves reveal reproductive-health intent.
Are patient testimonials common in IVF marketing?
They are common and they are the highest-risk creative asset the category runs. Every identifiable person featured — intended parents, children, donor, gestational carrier — requires a specific HIPAA marketing authorization, plus state medical board disclosures and FTC endorsement disclosures if compensation is involved.
Do state laws add restrictions on top of HIPAA for fertility marketing?
Several states have specific rules on donor advertising, gestational-carrier arrangements, and third-party-reproduction financing. State medical board advertising rules apply across the board. A multi-state fertility clinic needs a state-by-state review matrix.
Can a fertility clinic use genetic screening data for lookalike targeting?
No. Genetic information cannot be forwarded to a non-BAA ad platform. GINA layers on top of HIPAA to reinforce this. Any lookalike audience built from patient identifiers or genetic screening results is a disclosure of PHI in the absence of a BAA.
Scope your fertility clinic's HIPAA-safe marketing engagement
Book a 30-minute call with the US practice lead, email us, or WhatsApp us in your time zone. Retainers custom-scoped per engagement · from 9/month.