What HIPAA, ACA Ethics, and State Boards Actually Require for Counselor Marketing

Counselors face a unique compliance challenge: three distinct regulatory bodies govern your marketing activities, and each has different requirements. Understanding how these layers interact prevents costly violations.

Layer 1: HIPAA Privacy Rule (Federal)
The Privacy Rule under 45 CFR §164.508 defines marketing as communication about products or services that encourages recipients to purchase or use them. Using protected health information (PHI) for marketing requires written authorization. This affects testimonials, case studies, and any communication referencing a client's treatment or presence at your practice.

Layer 2: ACA Code of Ethics (Professional)
Section C.6 of the ACA Code of Ethics directly addresses advertising and soliciting clients. It prohibits false or misleading claims, restricts how you can use testimonials, and requires accurate representation of credentials. Unlike HIPAA, which focuses on privacy, ACA ethics focus on preventing exploitation and maintaining professional integrity.

Layer 3: State Licensing Boards (Jurisdictional)
Your state board—whether it's the Board of Professional Counselors, Board of Behavioral Sciences, or equivalent—has advertising rules specific to your jurisdiction. Some states explicitly prohibit client testimonials. Others require specific disclosures in all advertising. These rules have enforcement power: violations can result in license suspension or revocation.

This overview is educational content, not legal advice. Verify current requirements with HIPAA counsel and your state licensing authority.

HIPAA's marketing provisions are often misunderstood. The rule doesn't prohibit marketing—it restricts how you can use client information in marketing.

Prohibited without written authorization:

• Using any PHI to identify potential marketing targets
• Sharing client names, conditions, or treatment details in promotional materials
• Creating testimonials or case studies that include identifiable information
• Contacting former clients for promotional purposes using treatment records

Permitted without authorization:

• General educational content about mental health conditions
• Describing your treatment approaches and specializations
• Listing credentials, certifications, and training
• Marketing that doesn't reference any specific client or their information

The authorization requirement: If you want to use a client's story in marketing—even with their verbal permission—HIPAA requires a written authorization that specifically identifies the marketing use, describes what information will be disclosed, and allows the client to revoke consent. A general treatment consent form does not satisfy this requirement.

The de-identification alternative: HIPAA's Safe Harbor method allows you to use case information if you remove 18 specific identifiers and have no actual knowledge the remaining information could identify someone. In practice, this is difficult for counseling scenarios where treatment details themselves may be identifying in small communities.

The ACA Code of Ethics Section C.6 covers advertising, soliciting, and media presentations. Unlike HIPAA's privacy focus, these rules address truthfulness and professional conduct in marketing.

C.6.a. Accuracy
You cannot make claims about services, outcomes, or qualifications that are misleading or cannot be substantiated. This affects SEO directly: claiming to be "the best anxiety counselor in [city]" or guaranteeing treatment outcomes violates this standard. Superlative claims without objective basis create ethical risk.

C.6.b. Testimonials
The ACA specifically addresses testimonials from current clients: counselors should not use them. The power differential in the therapeutic relationship makes "voluntary" testimonials ethically complicated. Former clients present different considerations, but state boards may prohibit testimonials entirely regardless of timing.

C.6.c. Statements by Others
You're responsible for correcting others' misleading statements about your practice. If a directory lists incorrect credentials or a review makes false claims about your services, you have an ethical obligation to address it.

What this means for SEO:

• Review solicitation must be careful—you cannot selectively request reviews from satisfied clients
• Website copy cannot include outcome guarantees or comparative claims without evidence
• Third-party platforms need monitoring for inaccurate information about your practice

Review the current ACA Code of Ethics and consult your professional association for specific guidance on your situation.

Client reviews present the most common compliance tension for counseling practice SEO. Reviews improve local search visibility, but soliciting them raises HIPAA, ethical, and state board concerns.

The core problem: Asking clients for reviews acknowledges they are your clients—which itself is PHI under HIPAA. If you send review requests to an email list of current clients, you're using treatment relationships for marketing purposes.

The curated review problem: If you only request reviews from clients with positive outcomes, you're engaging in selective solicitation that misrepresents your practice. ACA ethics require accurate representation of your services.

Lower-risk approaches:

• Displaying general review links on your website without targeted solicitation
• Including review information in standard practice materials given to all clients
• Responding to unsolicited reviews professionally without confirming the reviewer is a client

Psychology Today and directory reviews: Many directories allow client reviews. The ethical considerations are the same: you cannot selectively solicit positive reviews, and responding to reviews must not confirm the therapeutic relationship without the client initiating that disclosure.

State board variations: Some states prohibit client testimonials entirely, making any active review solicitation potentially problematic. Check your state's specific rules before implementing any review strategy.

In our experience working with counseling practices, the safest approach is passive: make it easy for clients to leave reviews if they choose, but don't request them.

State licensing boards have independent authority to regulate advertising by licensed counselors. These rules vary significantly and often exceed federal requirements.

Common state board requirements:

• Inclusion of license number in all advertising
• Specific disclosures about supervision status for provisionally licensed counselors
• Restrictions on using certain titles or credentials
• Prohibition on guaranteeing treatment outcomes

States with explicit testimonial restrictions: Several states prohibit client testimonials in any form. In these jurisdictions, even unsolicited Google reviews that you respond to could create compliance questions if your response appears to confirm the therapeutic relationship.

Telehealth and multi-state considerations: If you serve clients in multiple states via telehealth, you're subject to the advertising rules in each state where you're licensed. A marketing approach compliant in one state may violate rules in another.

How to verify your state's requirements:

1. Locate your state licensing board's website
2. Search for advertising, marketing, or public statements in the statutes and administrative rules
3. Review any advisory opinions or guidance documents
4. Contact the board directly if rules are unclear

Enforcement reality: State boards investigate complaints. Most advertising violations come to board attention through competitor complaints or client grievances—not proactive board monitoring. This doesn't reduce the importance of compliance, but it contextualizes the risk.

State rules change. Verify current requirements annually and whenever you modify your marketing approach.

Compliance constraints don't eliminate SEO opportunities—they shape the approach. Counselors can build significant search visibility using strategies that stay clearly within ethical boundaries.

Educational content (lowest risk): Writing about mental health conditions, treatment approaches, and wellness topics requires no client information. This content builds authority, attracts potential clients searching for information, and creates no compliance exposure. Most successful counseling practice SEO relies heavily on educational content.

Credential and specialization clarity: Clearly communicating your training, certifications, treatment modalities, and population focus helps potential clients find appropriate care. This is straightforward factual information that ACA ethics explicitly support.

Local SEO fundamentals: Google Business Profile optimization, directory listings on platforms like Psychology Today and GoodTherapy, and NAP consistency improve local visibility without requiring testimonials or client information.

Technical SEO: Site speed, mobile optimization, and proper schema markup help search engines understand and rank your site. None of this involves client information.

What to avoid:

• Before/after narratives (even anonymized) that could identify clients
• Outcome statistics from your practice without de-identification meeting Safe Harbor standards
• Comparative claims against other counselors without substantiation
• Endorsements from current clients in any form

The counselors we work with find that compliance constraints actually simplify their marketing: focus on education, be accurate about credentials, and let the therapeutic relationship remain private.