Family Data, Ad Tracking and HIPAA in ABA Lead Follow-Up
Relay handles practical family screening, follow-up and tour booking under your clinic’s branding. Your team handles clinical intake and benefits verification. Family information can be sensitive before someone becomes a patient, so the data flow and permissions need review before a CRM, form or advertising tracker is connected.
What family information does Relay use?
Relay checks the family’s location, the child’s age, requested services and whether the stated plan is one your clinic accepts. Our team and automation handle the agreed follow-up and booking; your clinic decides clinical suitability and verifies individual benefits.
A lead record is not automatically outside HIPAA just because intake has not happened. Identifiable information about someone seeking care can be protected health information (PHI). Keep clinical histories, assessment documents and insurance identifiers in the clinic’s approved intake process rather than putting them into ad copy or tracking events.
Where do the leads and conversations belong?
Relay is a marketing and follow-up service, not a clinical-record storage system. Your clinic owns the leads and growth system. A CRM tracks inquiry status and follow-up; your clinic’s approved clinical system holds care records. Calling a product a CRM does not exempt its information from privacy obligations.
Before sharing family information, document the systems involved, who can access each record, what each vendor receives, and how long records are kept. Agree the return or deletion process, including what happens when access ends. Those details depend on the actual clinic setup.
When is a business associate agreement needed?
If Relay or another vendor creates, receives, maintains or transmits PHI on behalf of a HIPAA-covered clinic in a business-associate role, the required business associate agreement (BAA) and safeguards must be in place. HHS business-associate guidance explains these obligations.
A BAA is not a blanket compliance certificate. The services, vendor chain and enabled configuration still matter. Ask for the proposed data flow and agreements before approving access; this page does not certify any particular CRM or client implementation.
What about Meta, Google and website tracking?
Review what each tag sends, including URLs, form answers and event parameters. Do not assume that hashing an identifier, using server-side tracking or adding a cookie banner makes a disclosure of health information permissible.
HHS online-tracking guidance addresses PHI disclosures and notes a court ruling that vacated part of its public-webpage interpretation. An IP address plus a visit to a public health-related page does not automatically establish PHI. Appointment forms and patient portals still need careful review.
Google’s personalized-ad policy separately restricts health-based audiences. Platform rules and HIPAA are different checks; neither a permitted ad nor an aggregate dashboard proves the underlying data flow is compliant.
How should email and text follow-up work?
Match the message to the family’s request and current status. Keep an inquiry reply separate from a promotional sequence, respect contact preferences, and stop booking prompts once the family books or opts out.
HHS marketing guidance distinguishes uses of PHI for marketing from certain treatment and operations communications. HHS email guidance also calls for reasonable safeguards. Permission to receive a text does not by itself authorize every use or disclosure of health information.
What should you confirm before launch?
Use this checklist with the people responsible for your clinic’s privacy and operations. It is a review guide, not a statement that every configuration has passed an audit.
- Name the form fields, destinations and vendors in the family-data flow.
- Confirm required BAAs and safeguards before any PHI access.
- Review page URLs and actual tracking payloads, not just event names.
- Document access roles, message permissions and opt-out handling.
- Agree retention, deletion and incident-reporting responsibilities.
For information about ABA owners contacting Relay through our own website and booking tools, read Relay’s privacy policy. That business-inquiry policy is separate from your clinic’s family-data requirements. This guide is general information, not legal advice or a HIPAA certification.
Frequently asked questions
Does a marketing CRM replace our clinical system?
No. Relay’s growth system supports acquisition and follow-up. Your clinic keeps responsibility for clinical records, individual benefits verification and care decisions.
Does a flat monthly marketing fee guarantee legal compliance?
No. Billing structure alone does not resolve privacy or referral-payment requirements. Review the actual contract, data flow and applicable law, including any performance guarantee.
Put the plan to work.
Relay turns your service priorities into videos, social content, paid campaigns, email, and search pages. For clinic engagements, we also call leads, check practical fit and book the agreed visits. Your team handles clinical decisions, benefits and intake.