Texas healthcare marketing automation under HIPAA and state rules

What to take away

Why healthcare marketing automation in Texas is a different build

Texas is not a small market for healthcare marketing. The state has large hospital systems in Houston, Dallas, San Antonio and Austin, plus hundreds of independent clinics and specialty practices. Marketing operations staff there support service line campaigns, patient recall, appointment reminders and reputation work.

The work looks like ordinary marketing automation until a list contains a diagnosis code or a patient email tied to a treatment.

That is where the build changes. In most industries, a marketing platform ingests any contact record and sends. In Texas healthcare, the same platform may receive PHI, which means the vendor becomes a business associate under HIPAA. The platform configuration, the contract and the workflow logic all have to reflect that.

Texas also has its own privacy statute, the Texas Medical Records Privacy Act, which predates and overlaps with HIPAA. It restricts disclosure of protected health information without written authorization and, in some respects, reaches further than the federal rule.

Texas hospital and clinic teams therefore run two compliance tracks at once, and the marketing automation stack has to satisfy both.

A third factor is scale. A single Texas health system may run dozens of clinic marketing workflows across service lines, each with its own consent language and suppression rules. Without a governed martech workflow automation layer, those workflows drift.

Teams that map identity, consent and triggers before they build campaigns avoid the worst of that drift, as covered in identity, consent and triggers.

The recurring failure mode is concrete. A multi-hospital system runs a service line campaign in Salesforce Marketing Cloud, the audience list carries a diagnosis code, and compliance stops the send because no BAA is on file for that platform. The campaign fails review because the contract was missing, not because the automation was wrong.

For a broader look at how those breakdowns start, see the analysis of low-code marketing workflow automation platforms.

HIPAA basics for marketing teams: PHI, BAAs and the marketing boundary

HIPAA is the federal law that governs protected health information. PHI is health information combined with identifiers that can link it to a person: name, address, dates, email, phone number, device identifiers and more. In marketing systems, PHI shows up in patient lists, appointment data, portal messages and even in email subject lines that mention a condition.

The marketing boundary matters. HIPAA permits treatment, payment and operations uses without patient authorization. Marketing generally is not one of those. If a hospital wants to send a patient a promotional message about a new service, it usually needs prior written authorization, unless the message falls under a narrow exception such as a refill reminder or a treatment communication.

Business associate agreements are the contract mechanism that lets a covered entity share PHI with a vendor. A BAA obligates the vendor to safeguard PHI, report breaches, limit use and return or destroy data at the end of the relationship.

For a Texas marketing team, the HHS press room is worth pulling for the resolution agreements and civil money penalties, because each one lists the documentation reviewers demanded.

From About HHS, the useful item is which operating division owns a privacy complaint, so a team knows where a notice letter originates.

A practical rule for Texas marketing operations: if a platform can see a patient identifier next to a health condition, treat it as PHI and require a BAA. That includes email service providers, CRM systems, analytics tools and call tracking platforms. It also includes the automation layer that joins them.

Texas Medical Records Privacy Act points that add to the federal floor

The Texas Medical Records Privacy Act, often cited as Texas Health and Safety Code Chapter 181, sets state rules for protected health information. It applies to covered entities and to many business associates, and it restricts disclosure of PHI without written authorization.

Texas patients have a right to access their records and to know who received their information.

The state law is not a copy of HIPAA. It defines some terms differently, and it can apply to entities that HIPAA does not reach, such as certain employers and insurers.

For marketing teams, the practical effect is that a workflow compliant under HIPAA may still need a Texas-specific review.

Texas also restricts the use of PHI for marketing and for research without authorization. The attorney general enforces the statute and can seek civil penalties per violation. That state channel is separate from federal HHS enforcement, so one incident can draw scrutiny from two directions.

In 2019, HHS reached a $3 million settlement with Touchstone Medical Imaging, a Texas-based provider, after an unsecured server exposed more than 300,000 patient records. The Texas attorney general has also used state privacy law aggressively, including a $1.4 billion settlement with Meta in 2024 over biometric data.

For marketing operations, the state law adds documentation duties. Teams should be able to show written authorization for marketing uses, the scope of that authorization and the date it was obtained. They should also be able to show how a patient can revoke it and how revocation propagates into suppression lists.

One common gap is the re-use of data. A patient authorizes a message about one service, and the team later uses the same record for a different campaign. Under both HIPAA and the Texas act, that broader use needs its own basis.

Mapping data flows before campaign build is the discipline that prevents this, and it is central to marketing data governance in healthcare settings.

Platform choices Texas hospital and clinic teams actually use

Texas healthcare marketing teams tend to choose platforms that already support a BAA and offer controls for PHI. The table below reflects the platforms most often named in Texas hospital and clinic marketing operations conversations. Pricing varies by contract and volume, so treat the notes as directional.

Confirm each entry against the vendor's current trust page and the signed contract, because BAA availability changes by tier and add-on.

Salesforce Marketing Cloud appears most often in large Texas health systems because it integrates with Salesforce Health Cloud and supports consent and audit objects. HubSpot is common in clinic groups that want faster setup and a usable interface for small teams. Adobe Campaign shows up where a hospital already runs Adobe Experience Cloud.

Klaviyo and Mailchimp appear in smaller practices, but their PHI exposure is usually limited to appointment reminders and general communications. Teams that skip the contract because the volume is low are taking on avoidable risk.

Platform choice is only part of the build. The harder work is configuring consent, suppression and audit behavior inside the platform. That work overlaps with broader hubspot ops hub vs zapier decisions, where cataloging and lineage tools help teams prove where PHI lives.

Texas teams also weigh whether to keep PHI out of the marketing platform entirely. A common pattern is to store PHI in the EHR and pass only a token or a hashed identifier into marketing automation. The platform then triggers messages without holding the clinical detail.

That pattern reduces the BAA surface, though it does not remove the need for one if any identifier remains.

Business associate agreement steps before a campaign goes live

A BAA is not a formality. It is the contract that allows PHI to move into a marketing platform, and it should be executed before any data transfer. The steps below reflect how Texas hospital and clinic teams typically sequence the work.

For the vendor security review, pull the NIST cybersecurity and privacy control catalog and map each BAA clause to a control the vendor must evidence. The NIST Privacy Framework gives a Texas team a structure for documenting consent, retention and revocation inside the automation stack.

A checklist for the pre-launch gate:

Suppression, consent and audit trails for patient communications

Suppression is the control that keeps the wrong patient from receiving the wrong message. In healthcare, suppression lists include patients who opted out, patients who revoked authorization, patients in sensitive service lines, and patients whose records are under legal hold. Texas teams often maintain separate suppression lists per service line.

Consent has to be specific and recorded. A patient who agrees to appointment reminders has not agreed to a newsletter about a new cancer center. Marketing automation should store the scope of consent, the date and the channel.

When consent is withdrawn, the workflow must stop within a defined window, not at the next quarterly cleanup.

Audit trails are the evidence layer. Every send, suppression, consent change and data export should be logged with a timestamp and a user identity. HIPAA and the Texas act both expect covered entities to be able to show what happened.

Retention is where teams get caught. HIPAA sets no specific number for marketing platform logs. It does require six years for compliance documentation, including signed authorizations, counted from creation or the date the authorization was last in effect.

Texas medical record rules set their own minimum, commonly seven years for adult patients and longer for minors. Confirm the figure against the record type. Consent records should carry the same clock as the authorization they document.

Revocation has no federal clock either. A workable Texas build updates the suppression list within one business day and stops queued sends within 24 to 72 hours. Document the window in the BAA and in the workflow itself.

Texas hospital and clinic teams also deal with patient portal messages, which may fall under treatment rather than marketing. The line between a care message and a promotional one is worth documenting in advance. When a message mixes both, the safer path is to treat it as marketing and secure authorization.

A worked example helps. A Dallas clinic wants to promote a new diabetes management program to patients with a diabetes diagnosis. The team pulls a list from the EHR, loads it into a marketing platform, and sends.

Under HIPAA and the Texas act, that use needs authorization, a BAA with the platform, and a suppression check for patients who opted out. If the clinic instead sends a general message to all patients without using diagnosis data, the analysis changes, though the BAA may still be needed if any identifier is present.

Marketing operations staff should also keep the program documented. A short internal note describing the campaign, the legal basis, the data used and the approvals is enough to answer most auditor questions. The marketing workflow automation migration mistakes that come up most often in healthcare reviews tend to focus on exactly these points.

Common questions